# Network Intrusion Datasets: A Survey, Limitations, and Recommendations

arXiv: https://arxiv.org/abs/2502.06688 · HTML: https://mlsanity.com/paper/2502.06688/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Feb 2025.

## Built on by (most cited first, 7 of 7)

- [When Simple Model Just Works: Is Network Traffic Classification in Crisis?](https://mlsanity.com/paper/2506.08655/) (2025)
- [CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts](https://mlsanity.com/paper/2603.04186/) (2026)
- [An Evaluation Framework for Network IDS/IPS Datasets: Leveraging MITRE ATT&CK and Industry Relevance Metrics](https://mlsanity.com/paper/2511.12743/) (2025)
- [AutoGraphAD: Unsupervised network anomaly detection using Variational Graph Autoencoders](https://mlsanity.com/paper/2511.17113/) (2025)
- [An AI Security Agent for University ACMIS: Multi-Vector Threat Detection and Automated Response](https://mlsanity.com/paper/2606.08270/) (2026)
- [An Autonomous AI Security Agent for Banking: Multi-Vector Fraud and AML Detection Across Retail and Corporate Accounts](https://mlsanity.com/paper/2606.17555/) (2026)
- [Machine Unlearning for the XGBoost Model with Network Intrusion Datasets](https://mlsanity.com/paper/2606.19220/) (2026)

## Abstract (arXiv)

Data-driven cyberthreat detection has become a crucial defense technique in modern cybersecurity. Network defense, supported by Network Intrusion Detection Systems (NIDSs), has also increasingly adopted data-driven approaches, leading to greater reliance on data. Despite the importance of data, its scarcity has long been recognized as a major obstacle in NIDS research. In response, the community has published many new datasets recently. However, many of them remain largely unknown and unanalyzed, leaving researchers uncertain about their suitability for specific use cases. In this paper, we aim to address this knowledge gap by performing a systematic literature review (SLR) of 89 public datasets for NIDS research. Each dataset is comparatively analyzed across 13 key properties, and its potential applications are outlined. Beyond the review, we also discuss domain-specific challenges and common data limitations to facilitate a critical view on data quality. To aid in data selection, we conduct a dataset popularity analysis in contemporary state-of-the-art NIDS research. Furthermore, the paper presents best practices for dataset selection, generation, and usage. By providing a comprehensive overview of the domain and its data, this work aims to guide future research toward improving data quality and the robustness of NIDS solutions.