Cybersecurity Datasets

Please submit a pull request to add or modify content.

Los Alamos National Lab (LNN)

• Unified host and network data set Release: 2017
• Comprehensive, Multi-Source Cyber-Security Events Release: 2015
• User-Computer Authentication Associations in Time Relase: 2014

DARPA Intrustion Detection Evaluation

• Year 1998
• Year 1999
• Year 2000
• KDD Cup 1999 Data (Subset of DARPA 1999 Release)*
• ISCX NSL-KDD Improved Dataset Release: 2009*

*These are the most commonly used datasets for IDS evaluation (still)

Canadian Institute for Cybersecurity

• ISCX IDS dataset Release: 2012
• ISCX NSL-KDD Improved Dataset Release: 2009
• VPN-nonVPN dataset Release: 2016
• Botnet dataset Release: 2014
• Android validation dataset Release: 2014
• Android Botnet dataset Release: 2015
• Tor-nonTor dataset Release: 2017
• FlowMeter Release: 2016
• CIC DoS dataset Release: 2017

To obtain these datasets, contact the Canadian Institute for Cybersecurity directly via email

Software Engineering Institute

• Synthetic Insider Threat Data Release: 2012

Center for Applied Internet Data Analysis (CAIDA)

• https://www.caida.org/data/overview/

Long list of other datasets:

• http://www.secrepo.com
• http://www.netresec.com/?page=PcapFiles