Nearly every intrusion detection paper benchmarks against one of two public datasets, and knowing their history matters for reading the literature honestly.
Tool in focus: NSL-KDD
NSL-KDD is a refined version of the 1999 KDD Cup 99 dataset, itself derived from network traffic captured during a 1998 DARPA intrusion detection evaluation. NSL-KDD removes the massive redundant-record problem in the original KDD Cup 99 set, where a trivial classifier could score artificially high simply by memorising repeated records. It remains widely used for teaching and quick benchmarking, exactly as in this course's own Unit 3 figures, but its underlying traffic is now over two decades old and does not reflect modern attack techniques or modern network protocols.
Tool in focus: CICIDS2017
CICIDS2017, published by the Canadian Institute for Cybersecurity at the University of New Brunswick, captures a full working week of labelled traffic including modern attack types, brute force, DoS, web attacks, infiltration, and botnet activity, alongside realistic benign background traffic generated to resemble genuine user behaviour. It is now one of the standard modern benchmarks for intrusion detection research, used specifically because it addresses NSL-KDD's realism and recency gap.
Tool in focus: A Third Benchmark: UNSW-NB15
UNSW-NB15, built by Moustafa and Slay at the University of New South Wales (2015), is the other modern benchmark cited alongside CICIDS2017 in current intrusion-detection research, combining real modern normal traffic with nine contemporary attack categories generated with the IXIA PerfectStorm tool. Where this course's Unit 3 used KDD Cup 99 to demonstrate the realism problem directly, UNSW-NB15 and CICIDS2017 are the two datasets a paper published today is most likely to report results on.
Caution: A Benchmark Dataset Is Not a Production Dataset
A classifier that scores well on NSL-KDD or CICIDS2017 has demonstrated that it can learn that specific dataset's patterns, which is useful for comparing techniques but is not proof that it will perform well on your organisation's own, differently shaped traffic. Every benchmark dataset reflects the network it was captured on, the attack tools available at the time, and the choices its creators made about what to label as benign.