A Survey of Network-based Intrusion Detection Data Sets

By Markus Ring, Sarah Wunderlich, Deniz Scheuring, Dieter Landes, Andreas Hotho. Computers & security, 2019

800 citations recorded by the source corpus.

Abstract Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for network-based intrusion detection and describes the underlying packet- and flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and data repositories. Finally, we discuss our observations and provide some recommendations for the use and the creation of network-based data sets.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/cbe3fda28a29052fb82dcaca66be1edf549180d4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study (2020, background): “Recently, Ring et al. [14] presented a study of intrusion detection datasets.”
Towards a Standard Feature Set for Network Intrusion Detection System Datasets (2021, methodology): “The generated datasets are published and made publicly accessible for use in the design and evaluation phases of ML-based NIDS models [12].”
InSDN: A Novel SDN Intrusion Dataset (2020, background): “More details about these datasets descriptions and discussion properties can be found in [27], [28].”