Security Data Sources: NSL-KDD and CICIDS2017

The field's standard public intrusion-detection benchmarks, NSL-KDD's fix for KDD Cup 99's redundant-record problem, CICIDS2017's modern realism, UNSW-NB15 as a third current benchmark, and why a benchmark dataset is not a production dataset.

~5 min total·4 quadrants of structured content

By the end of this topic, you will

Explain what problem in the original KDD Cup 99 dataset NSL-KDD was built to fix
Describe what makes CICIDS2017 and UNSW-NB15 more realistic benchmarks than NSL-KDD for current research
Explain why scoring well on a benchmark dataset does not prove a model will perform well on an organisation's own traffic

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Video content coming soon.

Quadrant 2 · e-Content

Articles and case studies

Security Data Sources: NSL-KDD and CICIDS2017

Nearly every intrusion detection paper benchmarks against one of two or three public datasets. Knowing their history, and their age, matters for reading the literature honestly.

Quadrant 3 · Web Resources