Network intrusion / netflow
500 hosts and 20,000 labeled flows, where a port scan, a DDoS flood, and a brute-force attempt each carry the real statistical signature their MITRE ATT&CK technique actually leaves in traffic.
A protocol column and an is_attack flag with no statistical relationship between them doesn't help test an IDS. A port scan is a single bare TCP SYN swept across a wide, largely non-repeating spread of ports. A DDoS is a wide fan-in of distinct sources converging on one or two targets, each flow tiny. DNS exfiltration is forced onto real UDP/port 53 transport but with an oversized payload. Brute force is repeated short flows against the same few attacker/target pairs on SSH or RDP. Each of those signatures is generated here, not just labeled, grounded in the ID2T / UNSW-NB15 construction methodology and four named MITRE ATT&CK technique IDs.
20,500 rows across 2 tables, 515 KB zipped. Public domain (CC0), no signup, no attribution required.
What is in it
host_id, zone, ip_address
internal hosts get RFC 1918 addresses, external hosts don't
flow_id, src_host_id, dst_host_id, start_time, attack_cat, protocol, src_port, dst_port, packet_count, byte_count, duration_ms, label
attack_cat and label match each flow's actual packet/byte/port signature
What holds, and how it was checked
Each line was measured against these exact files rather than asserted. The same checks ship inside the zip as INTEGRITY.txt, so you can re-run them yourself.
- port_scan: 100% single-packet, 40-60 byte frames on 2,348 flows (a bare SYN, no reply)
- port_scan hosts hit 469 distinct ports on average vs 9.8 for an ordinary benign host
- ddos: 289 distinct sources converge on exactly 2 destinations (593 flows)
- dns_exfiltration: 100% UDP/port 53, averaging 179 bytes/packet vs 80 for this file's own benign DNS traffic (410 flows)
- brute_force: 100% TCP on port 22 or 3389, averaging 34 flows per attacker/target pair vs 1.1 for benign traffic (610 flows)
- no flow implies an impossible sub-40-byte-per-packet frame, across all 20,000 flows
- 0 orphaned foreign keys joining flows to hosts
Questions it can answer
- Can a detection rule tell a port scan's single-packet SYN spread from ordinary traffic?
- Does a DDoS rule catch the fan-in signature (many sources, few targets) rather than just high volume?
- Is a DNS exfiltration query's payload size actually distinguishable from a normal lookup?
- How concentrated are brute-force attempts on the same attacker/target pair vs benign traffic?
Generate a custom version
This dataset is fixed. Different borrower counts, a different rating mix, or a different seed all come from the same underlying schema, so start on the canvas and shape the loan and borrower tables to what you need.
This dataset builds each attack category's packet/byte/port signature from its MITRE ATT&CK technique rather than a per-column declared distribution, so it ships as a runnable script rather than a schema.yaml a bare misata generate could regenerate honestly.
pip install misata curl -O https://raw.githubusercontent.com/rasinmuhammed/misata/main/examples/network_intrusion_netflow.py python -c "from network_intrusion_netflow import build, verify; t = build(n_hosts=500, n_flows=20000, seed=13); verify(t)"Read the docs
Other datasets
- Retail star schema
A dimensional model you can actually practise joins on: one fact table, four dimensions, 63,170 rows, and every join resolving.
- Machine degradation
100 machines monitored from commissioning to failure, with an exact remaining-useful-life label on every one of 23,118 readings.
- Ecommerce storefront
A year of orders across five joined tables, with a real Q4 peak and totals that reconcile to the cent.
- B2B SaaS subscription analytics
Accounts, seats, MRR, churn and support load, where company size actually drives the plan.
- Credit risk portfolio
3,000 borrowers and 4,200 commercial loans, where a credit rating actually predicts whether the loan defaults, at the rate S&P's own data says it should.
- Contact center queueing (Erlang C)
4 queues, 2,400 half-hour intervals over a full business month, where agents_staffed is what Erlang C (1917) says is actually required to clear each queue's own SLA target, not a plausible-looking number.
- Manufacturing SPC (Cpk / Xbar-R)
5 processes, 450 subgroups, 2,250 measurements, where process capability and out-of-control detection come from a real Xbar-R control chart -- including one process with an engineered tool-wear drift that actually trips Western Electric rules where it happens.