A review on intrusion detection datasets: tools, processes, and features

Abstract

Network intrusion detection systems are fundamental to the early detection of anomalous behaviour in networks. Modern versions of these tools take advantage of Machine Learning to process large amounts of data, identify patterns, and make predictions. Their development relies on the ability to access good historical network data. Therefore, the research community has been actively working on creating new datasets, and network traffic analysis tools are frequently used in this context. This study provides a comprehensive review of existing tools for network traffic analysis, highlighting their main advantages and drawbacks. A categorisation for these tools is introduced, as well as an overview of the dataset creation process by combining one or more of these categories. An updated analysis of existing datasets is also provided, along with details regarding their creation, highlighting the progression in dataset production. Finally, the impact of dataset features is discussed, underscoring their role in enhancing the effectiveness of network intrusion detection systems.