UGR'16: A New Dataset for the Evaluation of Cyclostationarity-Based Network IDSs
The dataset presented here is built with real traffic and up-to-date attacks. These data come from several netflow v9 collectors strategically located in the network of a spanish ISP. It is composed of two differentiated sets of data that are previously split in weeks:
- A CALIBRATION set of data gathered from March to June of 2016 (4 months) containing real background traffic data
- A TEST set of data gathered from July to August of 2016 containing real background and synthetically generated traffic data that corresponds with several and well know types of attacks.
The main advantage of this dataset over previous ones is its usefulness for evaluating IDSs that consider long-term evolution and traffic periodicity. Models that consider differences in daytime/night or labour weekdays/weekends can also be trained and evaluated with it.
Reference: Gabriel Maciá Fernández, José Camacho, Roberto Magán-Carrión, Pedro García-Teodoro, Roberto Theron, Ugr'16: a new dataset for the evaluation of cyclostationarity-based network IDSs, In Computers & Security, 2017
Author paper version available for download by clicking here 
August - Week #1 Date range: 08/01/2016 - 08/07/2016
All traffic flows
| # | File Name | File Type | Description | Upload time | Download |
|---|---|---|---|---|---|
| 1 | august_week1_nfcapd |  |
Collected binary netflow | 10/06/2017 17:58:38 | |
| 2 | august_week1_csv |  |
Collected CSV netflow flows (labeled) | 06/27/2018 18:29:46 |
Attack execution timestamps (mins)
| # | File Name | File Type | Description | Upload time | Download |
|---|---|---|---|---|---|
| 1 | attack_ts_august_week1.csv | |
Contains the timestamps (in mins) where the attacks were executed | 11/30/2017 08:59:58 |
Flows per type of attack (labeled)
| # | File Name | File Type | Description | Upload time | Download |
|---|---|---|---|---|---|
| 1 | dos_august_week1_csv |  |
Extracted flows for DoS attacks | 11/30/2017 08:59:37 | |
| 2 | scan11_august_week1_csv | |
Extracted flows for scan11 attacks | 11/30/2017 08:59:38 | |
| 3 | scan44_august_week1_csv | |
Extracted flows for scan44 attacks | 11/30/2017 08:59:38 | |
| 4 | blacklist_august_week1_csv | |
Extracted flows where the involved IPs are in the black lists | 11/30/2017 08:59:35 | |
| 5 | spam_august_week1_csv | |
Extracted flows for spam attacks | 11/30/2017 08:59:57 | |
| 6 | sshscan_august_week1_csv | |
Extracted flows for SSH scan attacks | 11/30/2017 08:59:57 | |
| 7 | udpscan_august_week1_csv | |
Extracted flows for UDP scan attacks | 11/30/2017 08:59:57 | |
| 8 | botnet_august_week1_csv | |
Extracted flows for Neris botnet attack | 11/30/2017 08:59:36 |