Real-Time Network Intrusion Detection Dataset: Campus Traffic and Behavioral Features

Description

This dataset supports the development and evaluation of real-time Network Intrusion Detection Systems (NIDS). It combines synthetic benign and attack traffic generated in a controlled lab environment via Wireshark, real human browsing traffic captured on a personal machine, and real institutional traffic captured from a university campus network (COMSIT, University of Ilorin, Nigeria). Five raw Wireshark packet-capture CSV files are provided (ultra_normal_92k.csv, ultra_attack_90k.csv, human_traffic_wireshark.csv, comsit_traffic.csv, and campus_attack_capture.csv), sharing a common 10-column export schema (frame number, timestamp, length, source/destination IP, ports, TCP flags, window size, and ACK round-trip time). Alongside these, a processed file (engineered_realtime_dataset.csv, 3,270,480 records) provides 12 behavioral features extracted via a rolling-window pipeline (50-packet, 100-packet, and 1-second windows), including flow duration, inter-arrival time, packet-size variance, port diversity, and SYN/ACK ratio — plus source and label metadata columns. These features were deliberately designed to capture how traffic behaves structurally (e.g., connection timing and packet-rate patterns) rather than relying on static IP addresses or ports, which do not generalize across networks. IP addresses were replaced with sentinel values in the engineered file to force models to learn from behavior rather than memorizing endpoints. Baseline Random Forest and Deep Neural Network classifiers trained on this data achieved a 1.0000 F1-score and 0.0000 false-positive rate on a held-out test split, with the same near-zero false-alarm rate holding when only the physical, real-world portion of that holdout was examined. A separate 5.2-million-record file of real campus attack traffic (held out entirely from training) confirmed near-perfect true-positive detection against real volumetric attacks. Researchers can use the raw files to build and test their own feature-engineering pipelines, or use the processed file directly for model training/benchmarking. The dataset is intended to help address a known weakness in NIDS research — models trained only on static, single-origin benchmark datasets (e.g., older synthetic sets) tend to generalize poorly and produce high false-positive rates on real network traffic. A Data_description.md file included in this repository documents the file structure and column definitions in further detail.

Steps to reproduce

Download the Dataset Files Download the raw capture CSV files, generate_dataset.py, and requirements.txt to your local machine. Set up the Directory Structure Create a directory named "data/raw/" relative to where you place the Python script, and move the four primary capture files into it. Your folder structure must look exactly like this: generate_dataset.py requirements.txt data/raw/ultra_normal_92k.csv data/raw/ultra_attack_90k.csv data/raw/human_traffic_wireshark.csv data/raw/comsit_traffic.csv (Note: campus_attack_capture.csv is used for separate adversarial testing experiments and is not required to generate the primary engineered dataset). Install Dependencies Open a terminal in the directory containing generate_dataset.py and install the required Python packages (Python 3.9+ is recommended): pip install -r requirements.txt Generate the Engineered Dataset Run the self-contained reproducibility script: python generate_dataset.py Verify Output The script will read the four raw CSVs, apply a rolling-window behavioral feature extraction pipeline (extracting 12 features such as Inter-Arrival Time, packet sizes, and flow durations), and output the final merged dataset to: data/processed/engineered_realtime_dataset.csv (approx. 1.6M rows).

Institutions

• University of Ilorin

  Kwara State, Ilorin

Categories

Licence