- Papers
- Datasets
- Tools
- License
- A Comprehensive Survey on Network Traffic Synthesis From Statistical Models to Deep Learning,
arxiv 2025[paper] - Introducing a Comprehensive, Continuous, and Collaborative Survey of Intrusion Detection Datasets,
CSET 2024[paper] - A Survey of Public IoT Datasets for Network Security Research,
CST 2023[paper] - SoK: A Critical Evaluation of Efficient Website Fingerprinting Defenses,
S&P 2023[paper] - SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection,
EuroS&P 2023[paper] [code] - Dos and Don'ts of Machine Learning in Computer Security,
Security 2022[paper]
- Convolutions are Competitive with Transformers for Encrypted Traffic Classification with Pre-training,
arxiv 2025[paper] - Demystifying Network Foundation Models,
NeurIPS 2025[paper] - FlowletFormer: Network Behavioral Semantic Aware Pre-training Model for Traffic Classification,
arxiv 2025[paper] - MM4flow: A Pre-trained Multi-modal Model for Versatile Network Traffic Analysis,
CCS 2025[paper] - TrafficFormer: An Efficient Pre-trained Model for Traffic Data,
S&P 2025[paper] [code] - netFound: Foundation Model for Network Security,
arxiv 2025[paper] - A Novel Self-Supervised Framework Based on Masked Autoencoder for Traffic Classification,
ToN 2024[paper] - Lens: A Foundation Model for Network Traffic in Cybersecurity,
arxiv 2024[paper] - NetBench: A Large-Scale and Comprehensive Network Traffic Benchmark Dataset for Foundation Models,
arxiv 2024[paper] - NetMamba: Efficient Network Traffic Classification via Pre-training Unidirectional Mamba,
ICNP 2024[paper] [code] - PTU: Pre-trained Model for Network Traffic Understanding,
ICNP 2024 - TrafficGPT: Breaking the Token Barrier for Efficient Long Traffic Analysis and Generation,
arxiv 2024[paper] [code] - Flow-MAE: Leveraging Masked AutoEncoder for Accurate, Efficient and Robust Malicious Traffic Classification,
RAID 2023[paper] [code] - Listen to Minority: Encrypted Traffic Classification for Class Imbalance with Contrastive Pre-Training,
SECON 2023[paper] - NetGPT: Generative Pretrained Transformer for Network Traffic,
arxiv 2023[paper] [code] - Yet Another Traffic Classifier: A Masked Autoencoder Based Traffic Transformer with Multi-Level Flow Representation,
AAAI 2023[paper] [code] - ET-BERT: A Contextualized Datagram Representation with Pre-training Transformers for Encrypted Traffic Classification,
WWW 2022[paper] [code] - Pert: Payload Encoding Representation from Transformer for Encrypted Traffic Classification,
ITU 2020[paper]
- Pacc: Protocol-Aware Cross-Layer Compression for Compact Network Traffic Representation,
arxiv 2026[paper] - Synecdoche: Efficient and Accurate In-Network Traffic Classification via Direct Packet Sequential Pattern Matching,
arxiv 2026[paper] - Cato: End-to-End Optimization of ML-Based Traffic Analysis Pipelines,
S&P 2025[paper] - FastFlow: Early Yet Robust Network Flow Classification using the Minimal Number of Time-Series Packets,
sigmetrics 2025[paper] [code] - Less is More: Simplifying Network Traffic Classification Leveraging RFCs,
arxiv 2025[paper] - Miett: Multi-Instance Encrypted Traffic Transformer for Encrypted Traffic Classification,
AAAI 2025[paper] - Multi-view Correlation-aware Network Traffic Detection on Flow Hypergraph,
arxiv 2025[paper] - One task to rule them all: A closer look at traffic classification generalizability,
arxiv 2025[paper] - Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model,
AAAI 2025[paper] - SoK: Decoding the Enigma of Encrypted Network Traffic Classifiers,
S&P 2025[paper] - The Sweet Danger of Sugar: Debunking Representation Learning for Encrypted Traffic Classification,
sigcomm 2025[paper] - TrafficLLM: Enhancing Large Language Models for Network Traffic Analysis with Generic Traffic Representation,
arxiv 2025[paper] [code] - When Simple Model Just Works: Is Network Traffic Classification in Crisis?,
arxiv 2025[paper] - Fingerprinting the Shadows: Unmasking Malicious Servers with Machine Learning-Powered TLS Analysis,
WWW 2024[paper] - Identifying VPN Servers through Graph-Represented Behaviors,
WWW 2024[paper] - Mpaf: Encrypted Traffic Classification With Multi-Phase Attribute Fingerprint,
TIFS 2024[paper] - ServeFlow: A Fast-Slow Model Architecture for Network Traffic Analysis,
arxiv 2024[paper] - Understanding Web Fingerprinting with a Protocol-Centric Approach,
RAID 2024[paper] - Classify Traffic Rather Than Flow: Versatile Multi-Flow Encrypted Traffic Classification With Flow Clustering,
TNSM 2023[paper] - GGFAST: Automating Generation of Flexible Network Traffic Classifiers,
Sigcomm 2023[paper] - ProGraph: Robust Network Traffic Identification With Graph Propagation,
ToN 2023[paper] - Replication: Contrastive Learning and Data Augmentation in Traffic Classification Using a Flowpic Input Representation,
IMC 2023[paper] - Revolutionizing Cyber Threat Detection with Large Language Models,
arxiv 2023[paper] - TFE-GNN: A Temporal Fusion Encoder Using Graph Neural Networks for Fine-grained Encrypted Traffic Classification,
WWW 2023[paper] [code] - A few shots traffic classification with mini-FlowPic augmentations,
IMC 2022[paper] [code] - MT-FlowFormer: A Semi-Supervised Flow Transformer for Encrypted Traffic Classification,
KDD 2022[paper] - MTT: an efficient model for encrypted network traffic classification using multi-task transformer,
springer 2022[paper] - Packet Representation Learning for Traffic Classification,
KDD 2022[paper] [code] - Seeing Traffic Paths: Encrypted Traffic Classification With Path Signature Features,
TIFS 2022[paper] - Accurate Decentralized Application Identification via Encrypted Traffic Analysis Using Graph Neural Networks,
TIFS 2021[paper] - New Directions in Automated Traffic Analysis,
CCS 2021[paper] - TSCRNN: A novel classification scheme of encrypted traffic based on flow spatiotemporal features for efficient management of IIoT,
ComNet 2021[paper] - Deep packet: a novel approach for encrypted traffic classification using deep learning,
SoftComputing 2020[paper] - FS-Net: A Flow Sequence Network For Encrypted Traffic Classification,
Infocom 2019[paper] [code] - FlowPic: Encrypted Internet Traffic Classification is as Easy as Image Recognition,
Infocom workshop 2019[paper] [code] - Seq2Img: A sequence-to-image based approach towards IP traffic classification using convolutional neural networks,
BigData 2017[paper] - A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification,
sigmetrics 2006[paper] - BLINC: Multilevel Traffic Classification in the Dark,
sigcomm 2005[paper] - Internet traffic classification using bayesian analysis techniques,
sigmetrics 2005[paper]
- Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed,
NSDI 2024[paper] [code] - Caravan: Practical Online Learning of In-Network ML Models with Labeling Agents,
OSDI 2024[paper] - High-Throughput Stateless-But-Complex Packet Processing Within a Tbps Programmable Switch,
ICNP 2024[paper] - IIsy: Hybrid In-Network Classification Using Programmable Switches,
ToN 2024[paper] [code] - Linc: Enabling Low-Resource in-Network Classification and Incremental Model Update,
ICNP 2024[paper] [code] - Leo: Online ML-based Traffic Classification at Multi-Terabit Line Rate,
NSDI 2024[paper] [code] - Recursive Multi-Tree Construction With Efficient Rule Sifting for Packet Classification on FPGA,
ToN 2024[paper] [code]
- DiffuPac: Contextual Mimicry in Adversarial Packets Generation via Diffusion Model,
NeurIPS 2024[paper] - Diffusion Model-based Mobile Traffic Generation with Open Data for Network Planning and Optimization,
KDD 2024[paper] - Feasibility of State Space Models for Network Traffic Generation,
NAIC 2024[paper] - NetDiff: A Service-Guided Hierarchical Diffusion Model for Network Flow Trace Generation,
CoNext3 2024[paper] - Synthetic and privacy-preserving traffic trace generation using generative ai models for training network intrusion detection systems,
elsevier 2024[paper] [code] - Datacenter Network Deserves Better Traffic Models,
Hotnets 2023[paper] - NetDiffus: Network Traffic Generation by Diffusion Models through Time-Series Imaging,
arxiv 2023[paper] [code] - NetDiffusion: Network Data Augmentation Through Protocol-Constrained Traffic Generation,
SIGMETRICS 2023[paper] [code] - PAC-GPT: A novel approach to generating synthetic network traffic with GPT-3,
arxiv 2023[paper] [code] - Locality Matters! Traffic Demand Modeling in Datacenter Networks,
APNET 2022[paper] - Necstgen: An approach for realistic network traffic generation using deep learning,
GLOBECOM 2022[paper] [code] - Practical GAN-based synthetic IP header trace generation using NetShare,
SIGCOMM 2022[paper] [code] - Stan: Synthetic Network Trafic Generation with Generative Neural Models,
arxiv 2021[paper] [code] - Using GANs for Sharing Networked Time Series Data: Challenges, Initial Promise, and Open Questions,
IMC 2020[paper] [code]
- MalMoE: Mixture-of-Experts Enhanced Encrypted Malicious Traffic Detection Under Graph Drift,
arxiv 2026 - Continual Learning with Strategic Selection and Forgetting for Network Intrusion Detection,
arxiv 2025[paper] - Generative Active Adaptation for Drifting and Imbalanced Network Intrusion Detection,
arxiv 2025 - Hierarchical Local-Global Feature Learning for Few-shot Malicious Traffic Detection,
arxiv 2025 - Self-Supervised Learning of Graph Representations for Network Intrusion Detection,
arxiv 2025 -
$\mathsf{TCG}\text{-}\mathsf{IDS}$ : Robust Network Intrusion Detection via Temporal Contrastive Graph Learning,TIFS 2025[paper] - ContraMTD: An Unsupervised Malicious Network Traffic Detection Method based on Contrastive Learning,
WWW 2024[paper] - Delm: Deep Ensemble Learning Model for Anomaly Detection in Malicious Network Traffic-based Adaptive Feature Aggregation and Network Optimization,
TOPS 2024[paper] - Detecting Tunneled Flooding Traffic via Deep Semantic Analysis of Packet Length Patterns,
CCS 2024[paper] - Device Identification and Anomaly Detection in IoT Environments,
IOT 2024[paper] - Divide, Conquer, and Coalesce: Meta Parallel Graph Neural Network for IoT Intrusion Detection at Scale,
WWW 2024[paper] - Enhanced Few-Shot Malware Traffic Classification via Integrating Knowledge Transfer With Neural Architecture Search,
TIFS 2024[paper] - Foss: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum With Variable Legitimate Traffic,
ToN 2024[paper] - K-GetNID: Knowledge-Guided Graphs for Early and Transferable Network Intrusion Detection,
TIFS 2024[paper] - Mateen: Adaptive Ensemble Learning for Network Anomaly Detection,
RAID 2024[paper] [code] - NetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center Security,
NSDI 2024[paper] [code] - Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System,
TIFS 2024[paper] - RFG-HELAD: A Robust Fine-Grained Network Traffic Anomaly Detection Model Based on Heterogeneous Ensemble Learning,
TIFS 2024[paper] - Relative Frequency-Rank Encoding for Unsupervised Network Anomaly Detection,
ToN 2024[paper] - Spider: A Semi-Supervised Continual Learning-based Network Intrusion Detection System,
Infocom 2024[paper] - TMG-GAN: Generative Adversarial Networks-Based Imbalanced Learning for Network Intrusion Detection,
TIFS 2024[paper] - TrafCL: Robust Encrypted Malicious Traffic Detection via Contrastive Learning,
CIKM 2024[paper] - Trident: A Universal Framework for Fine-Grained and Class-Incremental Unknown Traffic Detection,
WWW 2024[paper] [code] - 3D-IDS: Doubly Disentangled Dynamic Intrusion Detection,
KDD 2023[paper] - Application of a Dynamic Line Graph Neural Network for Intrusion Detection With Semisupervised Learning,
TIFS 2023[paper] - CPS-GUARD: Intrusion detection for cyber-physical systems and IoT devices using outlier-aware deep autoencoders,
CS 2023[paper] - ERNN: Error-Resilient RNN for Encrypted Traffic Detection towards Network-Induced Phenomena,
TDSC 2023[paper] - Learning from Limited Heterogeneous Training Data: Meta-Learning for Unsupervised Zero-Day Web Attack Detection across Web Domains,
CCS 2023[paper] - Point Cloud Analysis for ML-Based Malicious Traffic Detection: Reducing Majorities of False Positive Alarms,
CCS 2023[paper] - TS-IDS: Traffic-aware self-supervised learning for IoT Network Intrusion Detection,
KBS 2023[paper] - Toward Early and Accurate Network Intrusion Detection Using Graph Embedding,
TIFS 2023[paper] - Augmented Memory Replay-based Continual Learning Approaches for Network Intrusion Detection,
NeurIPS 2023[paper] - Anomal-E: A self-supervised network intrusion detection system based on graph neural networks,
arxiv 2022[paper] - Encrypted Malware Traffic Detection via Graph-based Network Analysis,
RAID 2022[paper] - Conditional Variational Auto-Encoder and Extreme Value Theory Aided Two-Stage Learning Approach for Intelligent Fine-Grained Known/Unknown Intrusion Detection,
TIFS 2021[paper] - E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT,
arxiv 2021[paper] [code] - Enad: An Ensemble Framework for Unsupervised Network Anomaly Detection,
CSR 2021[paper] - Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms,
arxiv 2021[paper] - Random Partitioning Forest for Point-Wise and Collective Anomaly Detection - Application to Network Intrusion Detection,
TIFS 2021[paper] - Unveiling the potential of Graph Neural Networks for robust Intrusion Detection,
arxiv 2021[paper] - Automating Botnet Detection with Graph Neural Networks,
arxiv 2020[paper] - Anomaly-Based Intrusion Detection From Network Flow Features Using Variational Autoencoder,
IEEE Access 2020[paper] - Improving Attack Detection Performance in NIDS Using GAN,
COMPSAC 2020[paper] - Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices,
ITJ 2020[paper] - Throwing Darts in the Dark? Detecting Bots with Limited Data using Neural Data Augmentation,
S&P 2020[paper] - Unsupervised learning approach for network intrusion detection system using autoencoders,
JS 2019[paper] - Detecting HTTP-based application layer DoS attacks on web servers in the presence of sampling,
Computer Networks 2017[paper]
- AOC-IDS: Autonomous Online Framework with Contrastive Learning for Intrusion Detection,
Infocom 2024[paper] [code] - Effective DDoS Mitigation via ML-Driven In-Network Traffic Shaping,
TDSC 2024[paper] - Enhancing Network Attack Detection with Distributed and In-Network Data Collection System,
Security 2024[paper] - Online Self-Supervised Deep Learning for Intrusion Detection Systems,
TIFS 2024[paper] - Proteus: A Difficulty-Aware Deep Learning Framework for Real-Time Malicious Traffic Detection,
ICNP 2024[paper] - Rids: Towards Advanced IDS via RNN Model and Programmable Switches Co-Designed Approaches,
Infocom 2024[paper] [code] - Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis,
NDSS 2023[paper] [code] - HorusEye: A Realtime IoT Malicious Traffic Detection Framework using Programmable Switches,
Security 2023[paper] [code] - Real-Time Malicious Traffic Detection With Online Isolation Forest Over SD-WAN,
TIFS 2023[paper] - Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis,
CCS 2021[paper] - Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection,
NDSS 2018[paper] [code]
- AN-Net: an Anti-Noise Network for Anonymous Traffic Classification,
WWW 2024[paper] - Cactus: Obfuscating Bidirectional Encrypted TCP Traffic at Client Side,
TIFS 2024[paper] - Detecting and Mitigating Sampling Bias in Cybersecurity with Unlabeled Data,
Security 2024[paper] - Low-Quality Training Data Only? A Robust Framework for Detecting Encrypted Malicious Network Traffic,
NDSS 2024[paper] [code] - MCRe: A Unified Framework for Handling Malicious Traffic With Noise Labels Based on Multidimensional Constraint Representation,
TIFS 2024[paper] - ProGen: Projection-Based Adversarial Attack Generation Against Network Intrusion Detection,
TIFS 2024[paper] - ReCDA: Concept Drift Adaptation with Representation Enhancement for Network Intrusion Detection,
KDD 2024[paper] - Scrr: Stable Malware Detection under Unknown Deployment Environment Shift by Decoupled Spurious Correlations Filtering,
TDSC 2024[paper] - Anomaly Detection in the Open World: Normality Shift Detection, Explanation, and Adaptation,
NDSS 2023[paper] [code] - Bars: Local Robustness Certification for Deep Learning based Traffic Analysis Systems,
NDSS 2023[paper] [code] - CADE: Detecting and Explaining Concept Drift Samples for Security Applications,
Security 2021[paper] [code] - Fare: Enabling Fine-grained Attack Categorization under Low-quality Labeled Data,
NDSS 2021[paper]
- Building Transparency in Deep Learning-Powered Network Traffic Classification: A Traffic-Explainer Framework,
arxiv 2025[paper] - Genos: General In-Network Unsupervised Intrusion Detection by Rule Extraction,
Infocom 2024[paper] - IDS-Agent: An LLM Agent for Explainable Intrusion Detection in IoT Networks,
NeurIPS Workshop 2024 - Rules Refine the Riddle: Global Explanation for Deep Learning-Based Anomaly Detection in Security Applications,
CCS 2024[paper] - Towards Explainable Network Intrusion Detection using Large Language Models,
arxiv 2024[paper] - True Attacks, Attack Attempts, or Benign Triggers? An Empirical Measurement of Network Alerts in a Security Operations Center,
Security 2024[paper] - Dissect Black Box: Interpreting for Rule-Based Explanations in Unsupervised Anomaly Detection,
NeurIPS 2024[paper] - Everybody’s Got ML, Tell Me What Else You Have: Practitioners’ Perception of ML-Based Security Tools and Explanations,
S&P 2023[paper] - Finer: Enhancing State-of-the-art Classifiers with Feature Attribution to Facilitate Security Analysis,
CCS 2023[paper] - Towards Understanding Alerts raised by Unsupervised Network Intrusion Detection Systems,
RAID 2023[paper] - Interpreting Unsupervised Anomaly Detection in Security via Rule Extraction,
NeurIPS 2023[paper] - xNIDS: Explaining Deep Learning-based Network Intrusion Detection Systems for Active Intrusion Responses,
Security 2023[paper] [code] - AI/ML for Network Security: The Emperor has no Clothes,
CCS 2022[paper] [code] - I
$^{2}$ RNN: An Incremental and Interpretable Recurrent Neural Network for Encrypted Traffic Classification,TDSC 2022[paper]
- Contrastive Fingerprinting: A Novel Website Fingerprinting Attack over Few-shot Traces,
WWW 2024[paper] - Fingerprinting Obfuscated Proxy Traffic with Encapsulated TLS Handshakes,
Security 2024[paper] - Robust Multi-tab Website Fingerprinting Attacks in the Wild,
S&P 2023[paper] - Transformer-based Model for Multi-tab Website Fingerprinting Attack,
CCS 2023[paper]
- AppSniffer: Towards Robust Mobile App Fingerprinting Against VPN,
WWW 2023[paper] [code] - FOAP: Fine-Grained Open-World Android App Fingerprinting,
Security 2022[paper] - FlowPrint: Semi-Supervised Mobile-App Fingerprinting on Encrypted Network Traffic,
NDSS 2020[paper] [code] - Robust Smartphone App Identification via Encrypted Network Traffic Analysis,
TIFS 2018[paper] [code]
- ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems,
Security 2025[paper] [code] - Flash: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning,
S&P 2024[paper] [code] - Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance,
S&P 2024[paper] [code] - MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning,
Security 2024[paper] [code] - Nodlink: An Online System for Fine-Grained APT Attack Detection and Investigation,
NDSS 2024[paper] [code] - Understanding and Bridging the Gap Between Unsupervised Network Representation Learning and Security Analytics,
S&P 2024[paper] - Distdet: A Cost-Effective Distributed Cyber Threat Detection System,
Security 2023[paper] - EdgeTorrent: Real-time Temporal Graph Representations for Intrusion Detection,
RAID 2023[paper] - Prographer: An Anomaly Detection System based on Provenance Graph Embedding,
Security 2023[paper] - Euler: Detecting Network Lateral Movement via Scalable Temporal Link Prediction,
NDSS 2022[paper] [code] - SHADEWATCHER: Recommendation-guided Cyber Threat Analysis using System Audit Records,
S&P 2022[paper] [code] - THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning,
TIFS 2022[paper] [code] - ATLAS: A Sequence-based Learning Approach for Attack Investigation,
Security 2021[paper] [code] - DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications,
CCS 2021[paper] [code] - Hopper: Modeling and Detecting Lateral Movement,
Security 2021[paper] - Detecting Lateral Movement in Enterprise Computer Networks with Unsupervised Graph AI,
RAID 2020[paper] - Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats,
NDSS 2020[paper] [code]
- CD-Net: Robust mobile traffic classification against apps updating,
ComSec 2025[paper] - Detection of Unknown Attacks Through Encrypted Traffic: A Gaussian Prototype-Aided Variational Autoencoder Framework,
TIFS 2025[paper] - FG-SAT: Efficient Flow Graph for Encrypted Traffic Classification Under Environment Shifts,
TIFS 2025[paper] - Facing Anomalies Head-On: Network Traffic Anomaly Detection via Uncertainty-Inspired Inter-Sample Differences,
WWW 2025[paper] - M3S-UPD: Efficient Multi-Stage Self-Supervised Learning for Fine-Grained Encrypted Traffic Classification with Unknown Pattern Discovery,
arxiv 2025[paper] - Reliable Open-Set Network Traffic Classification,
TIFS 2025[paper] - Respond to Change With Constancy: Instruction-Tuning With LLM for Non-I.I.D. Network Traffic Classification,
TIFS 2025[paper] - Training Robust Classifiers for Classifying Encrypted Traffic under Dynamic Network Conditions,
CCS 2025[paper] - ECNet: Robust Malicious Network Traffic Detection With Multi-View Feature and Confidence Mechanism,
TIFS 2024[paper] - TrafficLLM: LLMs for improved open-set encrypted traffic analysis,
arxiv 2024[paper] [code] - Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification,
TAI 2023[paper] - Realistic Website Fingerprinting By Augmenting Network Traces,
CCS 2023[paper] - Rosetta: Enabling Robust TLS Encrypted Traffic Classification in Diverse Network Environments with TCP-Aware Traffic Augmentation,
Security 2023[paper] - Zero-relabelling mobile-app identification over drifted encrypted network traffic,
ComNet 2023[paper] - Distributionally Robust Neural Networks for Group Shifts: On the Importance of Regularization for Worst-Case Generalization,
ICLR 2020[paper] - Transfer Learning with Dynamic Adversarial Adaptation Network,
ICDM 2019[paper] - Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants,
Security 2016[paper]
- Exploring QUIC Dynamics: A Large-Scale Dataset for Encrypted Traffic Analysis,
arxiv 2025[paper] - A Large-Scale Mobile Traffic Dataset For Mobile Application Identification,
computer journal 2024[paper] - Bad Design Smells in Benchmark NIDS Datasets,
EuroS&P 2024[paper] - Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML-Based Network Intrusion Detection,
ToN-IoT:BoT-IoT 2022[paper] - ToN_IoT: The Role of Heterogeneity and the Need for Standardization of Features and Attack Types in IoT Network Intrusion Data Sets,
IOT 2022[paper] - A Detailed Analysis of the CICIDS2017 Benchmark Dataset for Intrusion Detection,
2021 - Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic,
DoH 2020[paper] - Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy,
CICDDoS2019 2019[paper] - Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,
CICIDS 2018[paper] - Characterization of Tor Traffic using Time based Features,
ISCXTor2016 2017[paper] - Characterization of Encrypted and VPN Traffic using Time-related Features,
ISCXVPN2016 2016[paper]
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| Darknet 2020 (CICDarknet2020) | 2020 | Detection and characterisation of darknet (Tor + VPN) traffic, supporting early malware monitoring and post-outbreak analysis. | 8 | CSV | — | link |
| Tor-nonTor dataset (ISCXTor2016) | 2016 | Tor vs non-Tor traffic classification using time-based flow features extracted with ISCXFlowMeter. | 7 (browsing, email, chat, audio, video, FTP, VoIP) | pcap CSV | 22 GB | link |
| VPN-nonVPN traffic dataset (ISCXVPN2016) | 2016 | VPN vs non-VPN traffic classification using time-related flow features. | 14 (VoIP, VPN-VoIP, P2P, VPN-P2P, …) | pcap CSV | 28 GB | link |
| AppSniffer mobile-app dataset (×4) | — | Four labelled mobile-app traffic captures released with AppSniffer (WWW '23). | — | — | — | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| Realistic IDS — DoS and spoofing attack in IoV (CICIoV2024) | 2024 | Realistic IDS evaluation for in-vehicle (IoV) CAN-bus DoS and spoofing attacks captured on a 2019 Ford vehicle. | 2 (DoS, spoofing) | CSV | 6.3 MB | link |
| CICEV2023 / CICDataset_Organized (CICEV2023 & CICDataset_Organized) | 2023 | Detection of DDoS attacks against electric-vehicle (EV) charging infrastructure under four simulated attack scenarios. | 4 attack scenarios | json | — | link |
| DDoS evaluation dataset (CIC-DDoS2019) | 2019 | Benchmark for distributed denial-of-service attack detection algorithms. | 13 | pcap CSV | multi | link |
| CIC UNSW-NB15 Augmented Dataset (CIC-UNSW-NB15) | — | Augmented UNSW-NB15 derivative with new CICFlowMeter features for adversarial NIDS evaluation. | 10 (9 attack types + benign) | CSV | 1.8 GB | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| CIC Bell DNS EXF 2021 (CICBellEXFDNS2021) | 2021 | Low-rate covert data exfiltration over DNS tunnels. | 3 (heavy attack, light attack, benign) | pcap CSV | 270.8 MB | link |
| DNS over HTTPS (CIRA-CIC-DoHBrw2020) | 2020 | Encrypted DNS-over-HTTPS traffic for covert-channel and tunnel detection. | 3 (benign DoH, malicious DoH, non-DoH) | pcap CSV | — | link |
| CIC Bell DNS 2021 (CICBellDNS2021) | — | Malicious-domain detection using lexical, DNS-statistical, and third-party features. | 4 (benign, spam, phishing, malware) | CSV | 400K benign / 13,011 malicious samples | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| ISCX botnet dataset 2014 (ISCX-Bot-2014) | 2014 | Composite botnet detection benchmark mixing benign traffic with multiple botnet families. | 7 (train) / 16 (test) | archive | 5.3 GB train / 8.5 GB test | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| Attack vectors in healthcare (CICIoMT 2024) | 2024 | Security evaluation for Internet-of-Medical-Things devices over Wi-Fi/MQTT and Bluetooth Low Energy. | 5 (DDoS, DoS, Recon, MQTT, spoofing) | pcap CSV | 10 GB | link |
| CIC EV charger attack dataset 2024 (CICEVSE2024) | 2024 | EV-charging-station security: behavioural analysis and binary/multi-class anomaly detection from ~900 hardware performance counters. | multi | CSV | 2.6 GB | link |
| A real-time IoT attack benchmark (CICIoT 2023) | 2023 | Large-scale IoT attack benchmark with 33 attacks across 105 IoT devices. | 7 (DDoS, DoS, Recon, Web, Brute Force, Spoofing, Mirai) | pcap CSV | multi | link |
| iCloud Private Relay traffic-analysis dataset | 2023 · UMass | Website-fingerprinting and traffic-correlation experiments against Apple iCloud Private Relay (UMass, ASIACCS '23). | n/a | pcap CSV | 1.8 GB | link |
| IoT profiling dataset (CICIoT 2022) | 2022 | IoT device profiling, behavioural analysis and identification across Power/Idle/Interactive/Scenario/Active/Attack regimes. | 3 device classes (Audio, Camera, Home Automation) | pcap CSV | <5 GB | link |
| IPS/IDS dataset on AWS (CSE-CIC-IDS2018) | 2018 | Network-based anomaly IDS evaluation on AWS-hosted infrastructure. | 7 attack classes (Brute Force, Heartbleed, Botnet, DoS, DDoS, Web, Infiltration) | CSV | — | link |
| Intrusion detection evaluation dataset (CIC-IDS2017) | 2017 | IDS/IPS evaluation benchmark with diverse attack scenarios. | 8 (FTP/SSH brute force, DoS, Heartbleed, Web, Infiltration, Botnet, DDoS) | pcap CSV | ~51.1 GB | link |
| CSIC 2010 | 2010 | HTTP web-attack detection benchmark. | — | — | — | link |
| Enriching IoT datasets (Enriched_IOT_Datasets) | — | Horizontally and vertically enriched combinations of Bot-IoT and TON-IoT for security analytics. | multi | CSV | — | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| CSTNET 2023 | 2023 · CAS / CSTNET | Anonymised institutional Internet traffic from CSTNET (CAS). | — | json | — | link |
| CW-100 2018 | 2023 | Encrypted mobile-app classification benchmark (100 apps). | — | json | — | link |
| NUDT MobileTraffic Dataset | 2023 · Network Forensics Research Lab | Anonymised mobile-app traffic with three label levels: 22 categories, 350 apps, 9 brands × 94 phone models. | 22 traffic categories / 350 apps / 9 brands / 94 models | pcap CSV | 293 GB | link |
| Application Based Network Traffic Dataset | 2021 | Packet captures of 22 commonly used desktop applications (Kaggle). | 22 applications | PCAP | 6.96 GB | link |
| CrossNet2021 | 2021 | Cross-network mobile-app classification benchmark used by ProGraph. | — | — | — | link |
| MaMPF | 2018 · Chang Liu; Zigang Cao; Gang Xiong; Gaopeng Gou; Siu-Ming Yiu; Longtao He | Encrypted-traffic classification using multi-attribute Markov probability fingerprints over length-block sequences. | — | — | 950,000+ encrypted flows | link |
| Cross-Platform iOS/Android Apps (Northeastern Recon) | 2017 · The Northeastern University | Cross-country (China / India / US) mobile-app traffic captured on Nexus 5 (Android 6) and iPhone 5 / 5s (iOS 10). | — | pcap | — | link |
| International Privacy Risks of Mobile Apps | 2017 · Jingjing Ren, Daniel J. Dubois, David Choffnes | Manual five-minute interaction traces for the top 100 iOS and Android apps to study cross-app privacy leakage. | — | pcap | 8 GB | link |
| ANDRUBIS | 2016 · Martina Lindorfer, Matthias Neugschwandtner, Lukas Weichselbaum, Yanick Fratantonio, Victor van der Veen, Christian Platzer | Static + dynamic analysis traces for over 1M Android apps (~40 % malicious). | — | CSV pcap | 1,000,000+ Android apps | link |
| USTC TFC 2016 | 2016 · USTC | Encrypted-traffic classification benchmark from USTC. | — | pcap | — | link |
| UNIBS-2009 | 2009 · U. Brescia | Edge-router traffic from a U. Brescia campus network covering 20 workstations. | multi | by request | 27 GB raw / 2.7 GB anonymised + payload-stripped | link |
| Moore & Zuev hand-labelled flows | 2005 · Andrew W. Moore, Denis Zuev (Queen Mary, University of London) | Hand-labelled flow dataset (10 application classes) accompanying Moore & Zuev's SIGMETRICS '05 paper, in WEKA format. | — | paid | 5–17 MB (gzip) | link |
| MAWI Working Group Traffic Archive | 1999-2024 · WIDE Project | Long-running (1999–) backbone Internet trace archive captured via tcpdump on the WIDE backbone, with anonymised IPs. | — | pcap | — | link |
| MAWILab | daily-updated · WIDE Project | Daily-updated network anomaly labels derived from MAWI traces by combining multiple independent detectors with a graph-based scheme. | — | web view + CSV | — | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| APP-53 2023 | 2023 | Mobile-app traffic with 53 classes for concept-drift evaluation. | — | — | — | link |
| Dataset | Year | Description | Classes | Format | Size | Link |
|---|---|---|---|---|---|---|
| Evasive PDF Mal 2022 (Evasive-PDFMal2022) | 2022 | Evasive malicious-PDF detection benchmark; evasive samples are filtered via K-means over 32 features. | multi | archive | 1.2 GB | link |
| Malware Memory Analysis (CIC MalMem 2022) | 2022 | Memory-dump benchmark for detecting obfuscated malware. | multi | CSV | 358 MB | link |
| Android Malware (CIC MalDroid 2020) | 2020 | Five-class Android malware benchmark (Adware, Banking, SMS, Riskware, Benign) with semi-supervised baselines. | 5 (Adware, Banking, SMS, Riskware, Benign) | APK files Capturing-logs CSV files: | 111 GB+ | link |
| CCCS-CIC-AndMal2020 (Android Malware 2020) | 2020 | Android malware benchmark co-developed with the Canadian Centre for Cyber Security; 200 K malicious + 200 K benign apps. | 14 categories / 191 malware families | CSV | 400 K apps | link |
| Android Adware and General Malware Dataset (CIC-AAGM2017) | 2017 | Android adware and general-malware network traffic captured on real devices. | 3 (Adware, General Malware, Benign) | pcap CSV | 9.1 GB | link |
| Android Malware Dataset (CIC-AndMal2017) | 2017 | Android malware traffic captured on real smartphones to evade emulator detection. | 4 (Adware, Ransomware, Scareware, SMS) | pcap | — | link |
| Tool | Type | Language | Description | Link |
|---|---|---|---|---|
| Wireshark | GUI | C / C++ | De-facto graphical network-protocol analyser; deep dissection of 3000+ protocols, capture filters (BPF) and display filters, follow-stream view, decryption (TLS, WPA, …), and a rich plug-in ecosystem. | link |
| tshark | CLI | C / C++ | Command-line companion to Wireshark sharing the same dissector library; ideal for batch processing and scripted feature extraction (e.g. tshark -r in.pcap -T fields -e ip.src -e tls.handshake.extensions_server_name). |
link |
| tcpdump | CLI | C | Veteran libpcap-based capture and inspection tool; lightweight, ubiquitous on UNIX, the canonical source for raw pcap captures. | link |
| Zeek | CLI / framework | C++ | Stateful protocol analyser (formerly Bro) that turns live or replayed traffic into structured logs (conn / dns / ssl / http / files). Many academic NIDS datasets ship Zeek-derived features. | link |
| Scapy | Python library | Python | Programmable packet-manipulation framework — sniff, craft, send, fuzz and dissect arbitrary protocols; widely used for traffic generation in research code. | link |
| PyShark | Python library | Python | Pythonic wrapper around tshark; exposes the full Wireshark dissector tree as Python objects for scripted field-level analysis. | link |
| dpkt | Python library | Python | Pure-Python, zero-dependency pcap parser focused on L2–L4 plus common L7 protocols; often 10–50× faster than PyShark for ML feature extraction loops. | link |
| nFStream | Python library | Python / C | High-throughput pcap-to-flow streaming with 80+ statistical features and optional nDPI application identification; modern alternative to CICFlowMeter for ML pipelines. | link |
| flowcontainer | Python library | Python | Lightweight tshark wrapper that turns a pcap into per-flow records (5-tuple, packet sizes, inter-arrival times, payload bytes, TLS SNI, HTTP host, …) ready for ML feature engineering. | link |
| Tool | Type | Language | Description | Link |
|---|---|---|---|---|
| SplitCap | CLI (Windows / .NET) | C# | Splits a pcap into smaller pcaps per flow, host pair, MAC, port, packet count or seconds; widely cited preprocessing baseline. | link |
| splitpcap | CLI / Python library | Python | Open-source SplitCap-style tool with extra modes (per-session, per-direction, sampling); cross-platform and embeddable in Python pipelines. | link |
| netkit | CLI | Rust | High-throughput pcap manipulation toolkit (split / merge / extract / stats) written in Rust; targets million-flow corpora where Python tooling becomes a bottleneck. | link |
| ShieldGPT pcap_tool | CLI | C++ | Pcap preprocessing utilities released alongside ShieldGPT — flow splitting, sampling, filtering, anonymisation and dataset packaging for LLM-based traffic analysis. | link |
| editcap | CLI (ships with Wireshark) | C | Pcap surgery swiss-army knife: split by chunk count or seconds, trim time ranges, fix timestamps, change link-layer encapsulation, anonymise MACs, deduplicate, and convert between pcap/pcapng. | link |
| mergecap | CLI (ships with Wireshark) | C | Counterpart to editcap: merge multiple pcaps preserving timestamps; concatenate or interleave by capture time. | link |
| pcapfix | CLI | C | Repairs truncated or corrupted pcap and pcapng files; useful when reusing legacy academic captures with broken global / packet headers. | link |
| Tool | Type | Language | Description | Link |
|---|---|---|---|---|
| CICFlowMeter | CLI / library | Java | Reference flow-feature extractor used to label every CIC-* dataset (CIC-IDS2017, CIC-DDoS2019, …); the 80-feature schema mirrored by most published NIDS baselines. | link |
| Argus | CLI / daemon | C | Long-running bidirectional flow-record generator producing detailed per-flow records (counts, bytes, timing, performance metrics); standard for academic flow analytics for two decades. | link |
| Tranalyzer2 | CLI | C | Modular plug-in-based flow analyzer that emits 700+ features per flow; supports live capture, offline pcap, and IPv6. | link |
| joy | CLI | C | Cisco-released flow extractor designed for encrypted-traffic analysis: TLS metadata, byte distribution, packet length / inter-arrival sequences, DNS / HTTP enrichment. | link |
| Tool | Type | Language | Description | Link |
|---|---|---|---|---|
| tcpreplay | CLI suite | C | Replay pcaps onto live interfaces at controlled rates with tcpreplay, rewrite addresses with tcprewrite, and run interactive client/server replay with tcpliveplay. The default tool for testbed-based NIDS evaluation. |
link |
| MoonGen | CLI | Lua / DPDK | Scriptable line-rate (10–100 Gbps) packet generator built on DPDK; the standard reproducible testbed used in NSDI / SIGCOMM dataplane evaluations. | link |
| TRex | CLI / Python API | C++ / Python (DPDK) | Cisco's stateful traffic generator: supports realistic application emulation, multi-million flow scaling, and a Python client for orchestrated experiments. | link |
| Tool | Type | Language | Description | Link |
|---|---|---|---|---|
| CryptoPAn | C library / CLI | C | Prefix-preserving IP-address anonymisation; the de-facto scheme cited in MAWI, CAIDA and most anonymised-trace dataset releases. | link |
| tcpdpriv | CLI | C | Older but still-used trace anonymiser with flexible per-field policies (drop / random / prefix-preserving). The original tool used by the WIDE / MAWI archives. | link |
| PktAnon | CLI | C++ | Protocol-aware pcap anonymiser from KIT with an XML/YAML profile describing which headers, payloads, MACs and IPs to strip or pseudonymise. | link |
To the extent possible under law, the maintainers have waived all copyright and related rights to this work under CC0 1.0 Universal. The list itself is a curation of publicly available paper metadata; copyright on the underlying papers and code repositories belongs to their respective authors.