Synthetic Data for Network Intrusion Detection
A protocol column and an is_attack flag with no statistical relationship between them doesn't help test an IDS. Misata generates flows where each attack category's packet count, byte-per-packet size, port spread, and source/destination fan pattern actually match its named technique, grounded in the ID2T / UNSW-NB15 construction methodology security researchers use to build real intrusion-detection benchmarks.
The tables Misata generates
hostsInternal (RFC 1918) and external hosts, each with a zone-correct IP addressflowsNetflow-style flows: ports, protocol, packet/byte counts, duration, and an attack label whose columns match its technique's real signatureWhat holds true, every time
- port_scan flows are a single bare TCP SYN (1 packet, 40-60 bytes) swept across a wide, largely non-repeating spread of ports
- ddos flows fan in from dozens of distinct sources onto one or two targets, each flow itself tiny
- dns_exfiltration is forced onto real UDP/port 53 transport, but with a materially larger payload than an ordinary DNS query
- brute_force flows repeat densely against the same few attacker/target pairs on SSH or RDP only
Frequently asked
Do I need real network intrusion data to generate this?
No. Misata builds the dataset from a specification, not a sample. There is no real network intrusion data to source, anonymize, or leak. You describe the tables you need and the engine constructs them with referential integrity and realistic distributions.
Is the generated network intrusion data privacy safe?
Yes, by construction. Nothing is learned from real records, so there is no membership to infer and nothing to leak. It runs entirely on your machine with no API key for the core engine.
Can I control the outcomes, like rates and totals?
Yes. Declare a target such as a monthly volume curve or an event rate and Misata produces rows that hit it exactly, while foreign keys stay intact and roll-up columns reconcile after a JOIN.
What makes this different from a random port/byte column with an attack label?
Each attack category's numeric columns are generated to actually carry that category's real statistical signature, not assigned independently of the label. A port_scan row isn't just tagged port_scan: it has exactly 1 packet, a 40-60 byte frame, and a destination port drawn from a wide spread, because that's what a real SYN scan looks like in netflow data.
What is the ID2T / UNSW-NB15 methodology?
It's the construction approach security researchers at the Cyber Range Lab (Australian Centre for Cyber Security) use to build labeled intrusion-detection datasets: protocol-realistic background traffic with attacks injected against documented behavior patterns and known ground-truth labels, rather than an anonymized real packet capture. This dataset follows the same approach, plus UNSW-NB15's own convention of shipping both a binary label and a multi-class attack category.
Which attack techniques are modeled?
Four, each tied to a named MITRE ATT&CK technique ID: port scanning (T1595, Active Scanning), DDoS (T1498, Network Denial of Service), DNS exfiltration (T1048.003, Exfiltration Over DNS), and brute force (T1110, Brute Force). Each is generated to carry that technique's real packet/byte/port signature, checked against the rows themselves.
Is there a free sample network intrusion dataset?
Yes, at https://misata.studio/datasets/network-intrusion-netflow: 500 hosts and 20,000 flows, public domain (CC0), no signup. The zip includes an INTEGRITY.txt with every signature re-measured against the exact files, so you can check it yourself rather than take the description's word for it.
Choosing a tool? How Misata compares