A Survey of Network-based Intrusion Detection Data Sets
Abstract
Labeled data sets are necessary to train and evaluate anomaly-based network intrusion detection systems. This work provides a focused literature survey of data sets for network-based intrusion detection and describes the underlying packet- and flow-based network data in detail. The paper identifies 15 different properties to assess the suitability of individual data sets for specific evaluation scenarios. These properties cover a wide range of criteria and are grouped into five categories such as data volume or recording environment for offering a structured search. Based on these properties, a comprehensive overview of existing data sets is given. This overview also highlights the peculiarities of each data set. Furthermore, this work briefly touches upon other sources for network-based data such as traffic generators and traffic repositories. Finally, we discuss our observations and provide some recommendations for the use and creation of network-based data sets.
Cite
@article{arxiv.1903.02460,
title = {A Survey of Network-based Intrusion Detection Data Sets},
author = {Markus Ring and Sarah Wunderlich and Deniz Scheuring and Dieter Landes and Andreas Hotho},
journal= {arXiv preprint arXiv:1903.02460},
year = {2019}
}
Comments
submitted manuscript to Computer & Security