Network intrusion / netflow
500 hosts and 20,000 labeled flows, where a port scan, a DDoS flood, and a brute-force attempt each carry the real statistical signature their MITRE ATT&CK technique actually leaves in traffic.
A protocol column and an is_attack flag with no statistical relationship between them doesn't help test an IDS. A port scan is a single bare TCP SYN swept across a wide, largely non-repeating spread of ports. A DDoS is a wide fan-in of distinct sources converging on one or two targets, each flow tiny. DNS exfiltration is forced onto real UDP/port 53 transport but with an oversized payload. Brute force is repeated short flows against the same few attacker/target pairs on SSH or RDP. Each of those signatures is generated here, not just labeled, grounded in the ID2T / UNSW-NB15 construction methodology and four named MITRE ATT&CK technique IDs.
- network security
- intrusion detection
- netflow
- MITRE ATT&CK
- IDS
Explore
Every table, profiled
Each column's type, spread, empties and most common values, measured from the CSVs in the download. Switch to the first rows to see the data exactly as it sits in the file.
2 tables
flows.csv
20,000 rows · 12 columns · 2 foreign keys
- benign80%
- port_scan12%
- brute_force3.0%
- ddos3.0%
- dns_exfiltration2.0%
- TCP71%
- UDP25%
- ICMP4.1%
- benign80%
- malicious20%
Keys
Every join resolves
2 foreign keys, 40,000 references checked against the table each one points at. None points at a row that does not exist.
flows
- src_host_idhosts.host_id20,000 rows checked0 orphans
- dst_host_idhosts.host_id20,000 rows checked0 orphans
Checks
What we checked
- port_scan: 100% single-packet, 40-60 byte frames on 2,348 flows (a bare SYN, no reply)
- port_scan hosts hit 469 distinct ports on average vs 9.8 for an ordinary benign host
- ddos: 289 distinct sources converge on exactly 2 destinations (593 flows)
- dns_exfiltration: 100% UDP/port 53, averaging 179 bytes/packet vs 80 for this file's own benign DNS traffic (410 flows)
- brute_force: 100% TCP on port 22 or 3389, averaging 34 flows per attacker/target pair vs 1.1 for benign traffic (610 flows)
- no flow implies an impossible sub-40-byte-per-packet frame, across all 20,000 flows
- 0 orphaned foreign keys joining flows to hosts
The same checks ship in the zip as INTEGRITY.txt, so you can rerun them in any SQL engine. How we verify
Questions
Worth asking it
- 1Can a detection rule tell a port scan's single-packet SYN spread from ordinary traffic?
- 2Does a DDoS rule catch the fan-in signature (many sources, few targets) rather than just high volume?
- 3Is a DNS exfiltration query's payload size actually distinguishable from a normal lookup?
- 4How concentrated are brute-force attempts on the same attacker/target pair vs benign traffic?
Use it
Take it, or make one shaped like yours
Rebuild it byte for byte
pip install misata curl -O https://raw.githubusercontent.com/rasinmuhammed/misata/main/examples/network_intrusion_netflow.py python -c "from network_intrusion_netflow import build, verify; t = build(n_hosts=500, n_flows=20000, seed=13); verify(t)"
This dataset builds each attack category's packet/byte/port signature from its MITRE ATT&CK technique rather than a per-column declared distribution, so it ships as a runnable script rather than a schema.yaml a bare misata generate could regenerate honestly.
Your own tables, your own numbers
Describe the data you need in Studio and get connected tables with the totals you state, profiled like this and checked before you download.
Premium datasets
All premiumWeekly sales, at regular price and on promotion
Grocery chain, 10 stores, fiscal 2024 and 2025
Two fiscal years of a grocery chain, from the shelf to the receipt
Answer key
- baseline_units
- price_effect
- promo_lift
- +7 more
- Rows
- 2,790,852
- Tables
- 14
- Checks
- 117 of 117
Free previewProfile and previewAn X-bar chart with the truth underneath: flatness, characteristic 139
3 plants, 36 CNC machines, six months
Six months of control charts with the ground truth underneath
Answer key
- active_cause_id
- true_cause_shift_sigma
- true_tool_wear_sigma
- +6 more
- Rows
- 515,442
- Tables
- 15
- Checks
- 101 of 101
Free previewProfile and previewVibration through a life that ends in failure
240 machines at 4 plants, two years
Two years of sensor readings, failures, repairs and costs for 240 machines
Answer key
- failure_mode
- true_life_days
- true_failure_at
- +6 more
- Rows
- 179,038
- Tables
- 6
- Checks
- 67 of 67
Free previewProfile and preview
Related free datasets
All 12- Retail star schemaA dimensional model you can actually practise joins on: one fact table, four dimensions, 47,051 rows, every join resolving and every total known.47,051 rows · 5 tables
- Machine degradation100 machines monitored from commissioning to failure, with an exact remaining-useful-life label on every one of 23,118 readings.46,336 rows · 3 tables
- Ecommerce storefrontA year of orders across five joined tables, with best sellers, heavy buyers, a real Q4 peak and totals that reconcile to the cent.49,493 rows · 5 tables
- B2B SaaS subscription analyticsAccounts, seats, MRR, churn and support load, where company size actually drives the plan.42,240 rows · 5 tables
- Credit risk portfolio3,000 borrowers and 4,200 commercial loans, where a credit rating actually predicts whether the loan defaults, at the rate S&P's own data says it should.7,200 rows · 2 tables
- Contact center queueing (Erlang C)4 queues, 2,400 half-hour intervals over a full business month, where agents_staffed is what Erlang C (1917) says is actually required to clear each queue's own SLA target, not a plausible-looking number.2,404 rows · 2 tables
Fully synthetic. No real person, company or transaction is represented, and no production data was read to make it. CC0: use it anywhere, no attribution needed.