# NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2011.09144 · HTML: https://mlsanity.com/paper/2011.09144/

## Key facts

- Cited by 45 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Nov 2020.

## Built on by (most cited first, 30 of 45)

- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [Towards Explainable Network Intrusion Detection using Large Language Models](https://mlsanity.com/paper/2408.04342/) (2024)
- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [AnoShift: A Distribution Shift Benchmark for Unsupervised Anomaly Detection](https://mlsanity.com/paper/2206.15476/) (2022)
- [Large Language Models for Security Operations Centers: A Comprehensive Survey](https://mlsanity.com/paper/2509.10858/) (2025)
- [Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML-based Network Intrusion Detection](https://mlsanity.com/paper/2104.07183/) (2021)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [DI-NIDS: Domain Invariant Network Intrusion Detection System](https://mlsanity.com/paper/2210.08252/) (2022)
- [Explaining Tree Model Decisions in Natural Language for Network Intrusion Detection](https://mlsanity.com/paper/2310.19658/) (2023)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [Benchmarking the Benchmark -- Analysis of Synthetic NIDS Datasets](https://mlsanity.com/paper/2104.09029/) (2021)
- [A Cyber Threat Intelligence Sharing Scheme based on Federated Learning for Network Intrusion Detection](https://mlsanity.com/paper/2111.02791/) (2021)
- [Survey of Graph Neural Network for Internet of Things and NextG Networks](https://mlsanity.com/paper/2405.17309/) (2024)
- [We Need to Rethink Benchmarking in Anomaly Detection](https://mlsanity.com/paper/2507.15584/) (2025)
- [LBDMIDS: LSTM Based Deep Learning Model for Intrusion Detection Systems for IoT Networks](https://mlsanity.com/paper/2207.00424/) (2022)
- [Investigation and rectification of NIDS datasets and standardized feature set derivation for network attack detection with graph neural networks](https://mlsanity.com/paper/2212.13994/) (2022)
- [Evaluating ML-Based Anomaly Detection Across Datasets of Varied Integrity: A Case Study](https://mlsanity.com/paper/2401.16843/) (2024)
- [Expectations Versus Reality: Evaluating Intrusion Detection Systems in Practice](https://mlsanity.com/paper/2403.17458/) (2024)
- [Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems](https://mlsanity.com/paper/2503.04404/) (2025)
- [Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection](https://mlsanity.com/paper/2603.22365/) (2026)
- [DOC-NAD: A Hybrid Deep One-class Classifier for Network Anomaly Detection](https://mlsanity.com/paper/2212.07558/) (2022)
- [Systematic Evaluation of Synthetic Data Augmentation for Multi-class NetFlow Traffic](https://mlsanity.com/paper/2408.16034/) (2024)
- [Visually Analyze SHAP Plots to Diagnose Misclassifications in ML-based Intrusion Detection](https://mlsanity.com/paper/2411.02670/) (2024)
- [MEGA: Message Passing Neural Networks for Multigraphs with EdGe Attributes](https://mlsanity.com/paper/2412.00241/) (2024)
- [A systematic literature review of unsupervised learning algorithms for anomalous traffic detection based on flows](https://mlsanity.com/paper/2503.08293/) (2025)
- [Hybrid Reputation Aggregation: A Robust Defense Mechanism for Adversarial Federated Learning in 5G and Edge Network Environments](https://mlsanity.com/paper/2509.18044/) (2025)
- [Harnessing Disagreement: Detecting Correlated Agreement Blindness in Multi-Agent Triage](https://mlsanity.com/paper/2607.19899/) (2026)

## Abstract (arXiv)

Machine Learning (ML)-based Network Intrusion Detection Systems (NIDSs) have proven to become a reliable intelligence tool to protect networks against cyberattacks. Network data features has a great impact on the performances of ML-based NIDSs. However, evaluating ML models often are not reliable, as each ML-enabled NIDS is trained and validated using different data features that may do not contain security events. Therefore, a common ground feature set from multiple datasets is required to evaluate an ML model's detection accuracy and its ability to generalise across datasets. This paper presents NetFlow features from four benchmark NIDS datasets known as UNSW-NB15, BoT-IoT, ToN-IoT, and CSE-CIC-IDS2018 using their publicly available packet capture files. In a real-world scenario, NetFlow features are relatively easier to extract from network traffic compared to the complex features used in the original datasets, as they are usually extracted from packet headers. The generated Netflow datasets have been labelled for solving binary- and multiclass-based learning challenges. Preliminary results indicate that NetFlow features lead to similar binary-class results and lower multi-class classification results amongst the four datasets compared to their respective original features datasets. The NetFlow datasets are named NF-UNSW-NB15, NF-BoT-IoT, NF-ToN-IoT, NF-CSE-CIC-IDS2018 and NF-UQ-NIDS are published at http://staff.itee.uq.edu.au/marius/NIDS_datasets/ for research purposes.