A survey of intrusion detection datasets for communication networks

Abstract

This paper presents a comprehensive survey of datasets used for intrusion detection in communication networks, examining 124 datasets and characterizing each across 20 key dimensions, such as attack diversity, temporal coverage, data formats, and availability. We systematically analyze how these datasets support research on intrusion detection systems (IDS) in networking environments by reviewing detection approaches, machine and deep learning models, feature selection techniques, traffic analysis tools, and performance metrics. Beyond descriptive comparison, the survey analyzes datasets according to their application domains, readiness for modern AI-driven IDS architectures, realism, quality and benchmarking risks, and sustainability and reproducibility. Our in-depth comparative analysis reveals critical gaps—such as limited real-world traffic representation, inconsistent documentation, dataset bias, evaluation risks, and underrepresentation of emerging attack vectors—and provides actionable recommendations for dataset standardization, high-fidelity data collection, improved labeling, quantitative dataset assessment, and privacy-preserving sharing. Furthermore, we introduce SHIELD, a continuously evolving online repository that supports centralized dataset discovery, comparison, and selection. This survey aims to guide researchers in selecting appropriate datasets for evaluating IDS in communication networks and to inform future efforts toward more realistic, scalable, reliable, and reproducible intrusion detection research.