Skip to main content
Powered by ShareScore

Find research datasets worth reusing

Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.

68

datasets available to search

ShareScore release 0.9.0

Reset

Dataset results

68 results for “Flow networks”

Learn how ShareScore rates datasets ↗
zenodo48/100

Network Digital Twin-Generated Dataset for Machine Learning-based Detection of Benign and Malicious Heavy Hitter Flows

<h3>Overview</h3> <p>This record provides a dataset created as part of the study presented in the following publication and is made <strong>publicly available for research purposes</strong>. The associated article provides a comprehensive description of the dataset, its structure, and the methodology used in its creation. If you use this dataset, please <strong>cite the following article </strong>published in the journal <strong>IEEE Communications Magazine</strong>:</p> <blockquote> <p><strong>A. Karamchandani, J. Nunez, L. de-la-Cal, Y. Moreno, A. Mozo, and A. Pastor, &ldquo;On the Applicability of Network Digital Twins in Generating Synthetic Data for Heavy Hitter Discrimination,&rdquo; IEEE Communications Magazine, pp. 2&ndash;8, 2025, DOI: 10.1109/MCOM.003.2400648.</strong></p> </blockquote> <p>More specifically, the record contains several synthetic datasets generated to differentiate between benign and malicious heavy hitter flows within a realistic virtualized network environment. Heavy Hitter flows, which include high-volume data transfers, can significantly impact network performance, leading to congestion and degraded quality of service. Distinguishing legitimate heavy hitter activity from malicious Distributed Denial-of-Service traffic is critical for network management and security, yet existing datasets lack the granularity needed for training machine learning models to effectively make this distinction.</p> <p>To address this, a Network Digital Twin (NDT) approach was utilized to emulate realistic network conditions and traffic patterns, enabling automated generation of labeled data for both benign and malicious HH flows alongside regular traffic.</p> <h3>Feature Set:</h3> <p>The feature set includes the following flow statistics commonly used in the literature on network traffic classification:</p> <ul> <li>The protocol used for the connection, identifying whether it is TCP, UDP, ICMP, or OSPF.</li> <li>The time (relative to the connection start) of the most recent packet sent from source to destination at the time of each snapshot.</li> <li>The time (relative to the connection start) of the most recent packet sent from destination to source at the time of each snapshot.</li> <li>The cumulative count of data packets sent from source to destination at the time of each snapshot.</li> <li>The cumulative count of data packets sent from destination to source at the time of each snapshot.</li> <li>The cumulative bytes sent from source to destination at the time of each snapshot.</li> <li>The cumulative bytes sent from destination to source at the time of each snapshot.</li> <li>The time difference between the first packet sent from source to destination and the first packet sent from destination to source.</li> </ul> <h3>Dataset Variations:</h3> <p>To accommodate diverse research needs and scenarios, the dataset is provided in the following variations:</p> <ol> <li> <p><strong><code>All at Once</code></strong>:</p> <ol> <li>Contains a synthetic dataset where all traffic types, including benign, normal, and malicious DDoS heavy hitter (HH) flows, are combined into a single dataset.</li> <li>This version represents a holistic view of the traffic environment, simulating real-world scenarios where all traffic occurs simultaneously.</li> </ol> </li> <li> <p><strong><code>Balanced Traffic Generation</code></strong>:</p> <ol> <li>Represents a balanced traffic dataset with an equal proportion of benign, normal, and malicious DDoS traffic.</li> <li>Designed for scenarios where a balanced dataset is needed for fair training and evaluation of machine learning models.</li> </ol> </li> <li> <p><strong><code>DDoS at Intervals</code></strong>:</p> <ol> <li>Contains traffic data where malicious DDoS HH traffic occurs at specific time intervals, mimicking real-world attack patterns.</li> <li>Useful for studying the impact and detection of intermittent malicious activities.</li> </ol> </li> <li> <p><strong><code>Only Benign HH Traffic</code></strong>:</p> <ol> <li>Includes only benign HH traffic flows.</li> <li>Suitable for training and evaluating models to identify and differentiate benign heavy hitter traffic patterns.</li> </ol> </li> <li> <p><strong><code>Only DDoS Traffic</code></strong>:</p> <ol> <li>Contains only malicious DDoS HH traffic.</li> <li>Helps in isolating and analyzing attack characteristics for targeted threat detection.</li> </ol> </li> <li> <p><strong><code>Only Normal Traffic</code></strong>:</p> <ol> <li>Comprises only regular, non-HH traffic flows.</li> <li>Useful for understanding baseline network behavior in the absence of heavy hitters.</li> </ol> </li> <li> <p><strong><code>Unbalanced Traffic Generation</code></strong>:</p> <ol> <li>Features an unbalanced dataset with varying proportions of benign, normal, and malicious traffic.</li> <li>Simulates real-world scenarios where certain types of traffic dominate, providing insights into model performance in unbalanced conditions.</li> </ol> </li> </ol> <p>For each variation, the output of the different packet aggregators is provided separated in its respective folder.</p> <p>Each variation was generated using the NDT approach to demonstrate its flexibility and ensure the reproducibility of our study's experiments, while also contributing to future research on network traffic patterns and the detection and classification of heavy hitter traffic flows. The dataset is designed to support research in network security, machine learning model development, and applications of digital twin technology.</p>

opencc-by-4.0Nov 2024View details →
zenodo48/100

Short-term traffic flow prediction based on secondary hybrid decomposition and deep echo state networks

<p>The publication titled "Short-term traffic flow prediction based on secondary hybrid decomposition and deep echo state networks" is supported by the STRIDE K3 project. The dataset used in the publication is uploaded here.</p>

opencc-by-4.0Dec 2023View details →
edi48/100

Advanced Resolution Canopy FLOw (ARCFLO) experiment employing the SUbcanopy Sonic Anemometer Network (SUSAN) in WS01 of the HJ Andrews Experimental Forest, July-September 2012

This dataset was collected during one of the ARCFLO (Advanced Resolution Canopy FLOw) experiment series’ field campaigns. This field campaign was carried out in WS1 of the HJ Andrews Experimental forest during July-September 2012 by the biomicrometeorology group, PI Christoph Thomas. The ARCFLO experiment series spanned a wide range of topographic conditions (flat, sloped, mountainous) and canopy architectures (grassland, orchard, open forest, dense forest) and was carried out between 2011 and 2014. It was funded through the NSF Career Award in Physical and Dynamical Meteorology to PI Christoph Thomas. The main goal of this project was to develop a novel improved framework to describe the airflow and its transport under weak-wind conditions for a continuous variation of overstory density and stratification. The objective is to i) identify forcing mechanisms of submeso motions, ii) evaluate the impact of plant canopies of different overstory density on the wind, temperature, and humidity fields, and iii) improve predictors for mixing in plant canopies that incorporate the important physical mechanisms. Observations were be made with a unique combination of new and standard techniques including optical fiber measurement of temperature structure, acoustic remote sensing, ultrasonic anemometers, and laser-illuminated flow visualizations.

openCC0Jun 2017View details →
zenodo44/100

Dataset of 'Complete flow characterization from snapshot PIV, fast probes and physics-informed neural networks'

<p>Dataset of the article 'Complete flow characterization from snapshot PIV, fast probes and physics-informed neural networks' (https://doi.org/10.1016/j.cma.2023.116652). The codes processing data here are on https://github.com/AlvaroMS90/Complete-flow-characterization-from-snapshot-PIV-fast-probes-and-physics-informed-neural-networks.</p> <p>This project has received funding from the European Research Council (ERC) under the European Union&rsquo;s Horizon 2020 research and innovation program (grant agreement No 949085) and by MCIN/AEI /10.13039/501100011033 and the European Union &lsquo;NextGenerationEU/PRTR&rsquo; as part of the grant FJC2020-044342-I.</p>

opencc-by-4.0Nov 2023View details →
zenodo44/100

Daily observed, modelled, and infilled river flows for an Irish hydrometric reference network of river flow stations

<p>Here we present a dataset of observed, modelled, and infilled daily river flow data relating to the newly updated Irish Hydrometric Reference Network (IHRN) of high-quality gauging stations located across the Republic of Ireland. Internationally applied selection criteria, analysis of historical observations and flow gauge metadata, stakeholder feedback, and trend assessments aided in the identification of the network&rsquo;s 51 stations. A combination of the GR4J conceptual hydrological model and a backpropagation neural network driven by catchment specific precipitation and temperature extracted from gridded datasets was used to model flows that subsequently infilled gaps in the observational record for each of the series (from commencement of each station&rsquo;s record till the end of 2022). Also included are the 2.5 and 97.5 quantile values for each station&rsquo;s modelled data, which represent the upper and lower uncertainty bounds of the respective ensemble flows derived during the flow generation process. As well as providing a useful means for evaluating the impact of changing climatic conditions on Irish catchments, the IHRN data offers utility for assessing catchment based impacts for flow extremes, and the generation of both historical reconstructions and future climate projections for a range of flow regimes across the island of Ireland.</p>

opencc-by-4.0Oct 2024View details →
zenodo44/100

Network traffic datasets created by Single Flow Time Series Analysis

<p><strong>Network traffic datasets created by Single Flow Time Series Analysis</strong></p> <p>Datasets were created for the paper: Network Traffic Classification based on Single Flow Time Series Analysis -- Josef Koumar, Karel Hynek, Tom&aacute;&scaron; Čejka -- which was published at The 19th International Conference on Network and Service Management (CNSM) 2023. Please cite usage of our datasets as:<br>&nbsp;</p> <blockquote> <p>J. Koumar, K. Hynek and T. Čejka, "Network Traffic Classification Based on Single Flow Time Series Analysis," <em>2023 19th International Conference on Network and Service Management (CNSM)</em>, Niagara Falls, ON, Canada, 2023, pp. 1-7, doi: 10.23919/CNSM59352.2023.10327876.</p> </blockquote> <p>This Zenodo repository contains 23 datasets created from 15 well-known published datasets which are cited in the table below. Each dataset contains 69 features created by Time Series Analysis of Single Flow Time Series. The detailed description of features from datasets is in the file: <em>feature_description.pdf</em></p> <p>&nbsp;</p> <p>In the following table is a description of each dataset file:</p> <table> <tbody> <tr> <td><strong>File name</strong></td> <td><strong>Detection problem</strong></td> <td><strong>Citation of original raw dataset</strong></td> </tr> <tr> <td>botnet_binary.csv&nbsp;</td> <td>Binary detection of botnet&nbsp;</td> <td>S. Garc&iacute;a et al. An Empirical Comparison of Botnet Detection Methods. Computers &amp; Security, 45:100&ndash;123, 2014.&nbsp;</td> </tr> <tr> <td>botnet_multiclass.csv&nbsp;</td> <td>Multi-class classification of botnet&nbsp;</td> <td>S. Garc&iacute;a et al. An Empirical Comparison of Botnet Detection Methods. Computers &amp; Security, 45:100&ndash;123, 2014.&nbsp;</td> </tr> <tr> <td>cryptomining_design.csv</td> <td>Binary detection of cryptomining; the design part&nbsp;</td> <td>Richard Pln&yacute; et al. Datasets of Cryptomining Communication. Zenodo, October 2022&nbsp;</td> </tr> <tr> <td>cryptomining_evaluation.csv&nbsp;</td> <td>Binary detection of cryptomining; the evaluation part&nbsp;</td> <td>Richard Pln&yacute; et al. Datasets of Cryptomining Communication. Zenodo, October 2022&nbsp;</td> </tr> <tr> <td>dns_malware.csv&nbsp;</td> <td>Binary detection of malware DNS&nbsp;</td> <td>Samaneh Mahdavifar et al. Classifying Malicious Domains using DNS Traffic Analysis. In DASC/PiCom/CBDCom/CyberSciTech 2021, pages 60&ndash;67. IEEE, 2021.&nbsp;</td> </tr> <tr> <td>doh_cic.csv&nbsp;</td> <td>Binary detection of DoH&nbsp;</td> <td> <p>Mohammadreza MontazeriShatoori et al. Detection of doh tunnels using time-series classification of encrypted traffic. In DASC/PiCom/CBDCom/CyberSciTech 2020, pages 63&ndash;70. IEEE, 2020&nbsp;</p> </td> </tr> <tr> <td>doh_real_world.csv&nbsp;</td> <td>Binary detection of DoH&nbsp;</td> <td>Kamil Jeř&aacute;bek et al. Collection of datasets with DNS over HTTPS traffic. Data in Brief, 42:108310, 2022&nbsp;</td> </tr> <tr> <td>dos.csv&nbsp;</td> <td>Binary detection of DoS&nbsp;</td> <td>Nickolaos Koroniotis et al. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Future Gener. Comput. Syst., 100:779&ndash;796, 2019.</td> </tr> <tr> <td>edge_iiot_binary.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Mohamed Amine Ferrag et al. Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications: Centralized and federated learning, 2022.</td> </tr> <tr> <td>edge_iiot_multiclass.csv</td> <td>Multi-class classification of IoT malware</td> <td>Mohamed Amine Ferrag et al. Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications: Centralized and federated learning, 2022.</td> </tr> <tr> <td>https_brute_force.csv</td> <td>Binary detection of HTTPS Brute Force</td> <td>Jan Luxemburk et al. HTTPS Brute-force dataset with extended network flows, November 2020</td> </tr> <tr> <td>ids_cic_binary.csv</td> <td>Binary detection of intrusion in IDS</td> <td>Iman Sharafaldin et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1:108&ndash;116, 2018.</td> </tr> <tr> <td>ids_cic_multiclass.csv&nbsp;</td> <td>Multi-class classification of intrusion in IDS&nbsp;</td> <td>Iman Sharafaldin et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1:108&ndash;116, 2018.&nbsp;</td> </tr> <tr> <td>ids_unsw_nb_15_binary.csv&nbsp;</td> <td>Binary detection of intrusion in IDS&nbsp;</td> <td>Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 military communications and information systems conference (MilCIS), pages 1&ndash;6. IEEE, 2015.</td> </tr> <tr> <td>ids_unsw_nb_15_multiclass.csv&nbsp;</td> <td>Multi-class classification of intrusion in IDS&nbsp;</td> <td>Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 military communications and information systems conference (MilCIS), pages 1&ndash;6. IEEE, 2015.</td> </tr> <tr> <td>iot_23.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Sebastian Garcia et al. IoT-23: A labeled dataset with malicious and benign IoT network traffic, January 2020. More details here https://www.stratosphereips.org /datasets-iot23</td> </tr> <tr> <td>ton_iot_binary.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Nour Moustafa. A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994, 2021</td> </tr> <tr> <td>ton_iot_multiclass.csv&nbsp;</td> <td>Multi-class classification of IoT malware&nbsp;</td> <td>Nour Moustafa. A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994, 2021</td> </tr> <tr> <td>tor_binary.csv&nbsp;</td> <td>Binary detection of TOR&nbsp;</td> <td>Arash Habibi Lashkari et al. Characterization of Tor Traffic using Time based Features. In ICISSP 2017, pages 253&ndash;262. SciTePress, 2017.&nbsp;</td> </tr> <tr> <td>tor_multiclass.csv&nbsp;</td> <td>Multi-class classification of TOR&nbsp;</td> <td>Arash Habibi Lashkari et al. Characterization of Tor Traffic using Time based Features. In ICISSP 2017, pages 253&ndash;262. SciTePress, 2017.&nbsp;</td> </tr> <tr> <td>vpn_iscx_binary.csv&nbsp;</td> <td>Binary detection of VPN&nbsp;</td> <td>Gerard Draper-Gil et al. Characterization of Encrypted and VPN Traffic Using Time-related. In ICISSP, pages 407&ndash;414, 2016.&nbsp;</td> </tr> <tr> <td>vpn_iscx_multiclass.csv&nbsp;</td> <td>Multi-class classification of VPN&nbsp;</td> <td>Gerard Draper-Gil et al. Characterization of Encrypted and VPN Traffic Using Time-related. In ICISSP, pages 407&ndash;414, 2016.&nbsp;</td> </tr> <tr> <td>vpn_vnat_binary.csv&nbsp;</td> <td>Binary detection of VPN&nbsp;</td> <td>Steven Jorgensen et al. Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification. CoRR, abs/2205.05628, 2022</td> </tr> <tr> <td>vpn_vnat_multiclass.csv</td> <td>Multi-class classification of VPN&nbsp;</td> <td>Steven Jorgensen et al. Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification. CoRR, abs/2205.05628, 2022</td> </tr> </tbody> </table> <p>&nbsp;</p>

opencc-by-4.0Jun 2023View details →
zenodo44/100

Network traffic datasets with novel extended IP flow called NetTiSA flow

<p><strong>Network traffic datasets with novel extended IP flow called NetTiSA flow</strong></p> <p>Datasets were created for the paper: NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification -- Josef Koumar, Karel Hynek, Jaroslav Pe&scaron;ek, Tom&aacute;&scaron; Čejka -- which is published in The International Journal of Computer and Telecommunications Networking&nbsp;<a href="https://doi.org/10.1016/j.comnet.2023.110147" rel="nofollow">https://doi.org/10.1016/j.comnet.2023.110147</a><br><br>Please cite the usage of our datasets as:</p> <blockquote> <p>Josef Koumar, Karel Hynek, Jaroslav Pe&scaron;ek, Tom&aacute;&scaron; Čejka, "NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification", Computer Networks, Volume 240, 2024, 110147, ISSN 1389-1286<br><br></p> <pre><code>@article{KOUMAR2024110147, title = {NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification}, journal = {Computer Networks}, volume = {240}, pages = {110147}, year = {2024}, issn = {1389-1286}, doi = {https://doi.org/10.1016/j.comnet.2023.110147}, url = {https://www.sciencedirect.com/science/article/pii/S1389128623005923}, author = {Josef Koumar and Karel Hynek and Jaroslav Pe&scaron;ek and Tom&aacute;&scaron; Čejka} } </code></pre> </blockquote> <p>This Zenodo repository contains 23 datasets created from 15 well-known published datasets, which are cited in the table below. Each dataset contains the NetTiSA flow feature vector.<br><br>&nbsp;</p> <p><strong>NetTiSA flow feature vector</strong></p> <p><br>The novel extended IP flow called NetTiSA (Network Time Series Analysed) flow contains a universal bandwidth-constrained feature vector consisting of 20 features. We divide the NetTiSA flow classification features into three groups by computation. The first group of features is based on classical bidirectional flow information---a number of transferred bytes, and packets.&nbsp; The second group contains statistical and time-based features calculated using the time-series analysis of the packet sequences. The third type of features can be computed from the previous groups (i.e., on the flow collector) and improve the classification performance without any impact on the telemetry bandwidth.</p> <p>&nbsp;</p> <p><strong>Flow features</strong></p> <p>The flow features are:</p> <ul> <li><strong><em>Packets</em></strong> is the number of packets in the direction from the source to the destination IP address.</li> <li><em><strong>Packets in reverse order</strong></em> is the number of packets in the direction from the destination to the source IP address.</li> <li><strong><em>Bytes</em> </strong>is the size of the payload in bytes transferred in the direction from the source to the destination IP address.</li> <li><strong><em>Bytes in reverse order</em></strong> is the size of the payload in bytes transferred in the direction from the destination to the source IP address.</li> </ul> <p>&nbsp;</p> <p><strong>Statistical and Time-based features</strong></p> <p>The features that are exported in the extended part of the flow. All of them can be computed (exactly or in approximative) by stream-wise computation, which is necessary for keeping memory requirements low. The second type of feature set contains the following features:</p> <ul> <li><strong><em>Mean</em></strong> represents mean of the payload lengths of packets</li> <li><strong><em>Min</em></strong> is the minimal value from payload lengths of all packets in a flow</li> <li><strong><em>Max</em></strong> is the maximum value from payload lengths of all packets in a flow</li> <li><strong><em>Standard deviation</em></strong> is a measure of the variation of payload lengths from the mean payload length</li> <li><strong><em>Root mean square</em></strong> is the measure of the magnitude of payload lengths of packets</li> <li><strong><em>Average dispersion</em></strong> is the average absolute difference between each payload length of the packet and the mean value</li> <li><strong><em>Kurtosis</em></strong> is the measure describing the extent to which the tails of a distribution differ from the tails of a normal distribution</li> <li><em><strong>Mean of relative times</strong></em> is the mean of the relative times which is a sequence defined as <span>\(st = \{t_1 - t_1, t_2 - t_1, ..., t_n - t_1\} \)</span></li> <li><em><strong>Mean of time differences</strong></em> is the mean of the time differences which is a sequence defined as <span>\(dt = \{ t_j - t_i | j = i + 1, i \in \{1, 2, \dots, n - 1\} \}.\)</span></li> <li><em><strong>Min from time differences</strong></em> is the minimal value from all time differences, i.e., min space between packets.</li> <li><em><strong>Max from time differences</strong></em> is the maximum value from all time differences, i.e., max space between packets.</li> <li><em><strong>Time distribution</strong></em> describes the deviation of time differences between individual packets within the time series. The feature is computed by the following equation:<br><span>\(tdist = \frac{ \frac{1}{n-1} \sum_{i=1}^{n-1} \left| \mu_{\{dt_{n-1}\}} - dt_i \right| }{ \frac{1}{2} \left(max\left(\{dt_{n-1}\}\right) - min\left(\{dt_{n-1}\}\right) \right) }\)</span></li> <li><em><strong>Switching ratio</strong></em> represents a value change ratio (switching) between payload lengths. The switching ratio is computed by equation:<br><span>\(sr = \frac{s_n}{\frac{1}{2} (n - 1)}\)</span></li> </ul> <p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; where&nbsp;<span>\(s_n\)</span> is number of switches.</p> <p>&nbsp;&nbsp;</p> <p><strong>Features computed at the collector</strong><br>The third set contains features that are computed from the previous two groups prior to classification. Therefore, they do not influence the network telemetry size and their computation does not put additional load to resource-constrained flow monitoring probes. The NetTiSA flow combined with this feature set is called the Enhanced NetTiSA flow and contains the following features:</p> <ul> <li><em><strong>Max minus min</strong></em>&nbsp; is the difference between minimum and maximum payload lengths</li> <li><em><strong>Percent deviation</strong></em> is the dispersion of the average absolute difference to the mean value</li> <li><em><strong>Variance</strong></em> is the spread measure of the data from its mean</li> <li><em><strong>Burstiness</strong></em> is the degree of peakedness in the central part of the distribution</li> <li><em><strong>Coefficient of variation</strong></em> is a dimensionless quantity that compares the dispersion of a time series to its mean value and is often used to compare the variability of different time series that have different units of measurement</li> <li><em><strong>Directions</strong></em> describe a percentage ratio of packet direction computed as <span>\(\frac{d_1}{ d_1 + d_0}\)</span>, where&nbsp;<span>\(d_1\)</span> is a number of packets in a direction from source to destination IP address and&nbsp;<span>\(d_0\)</span> the opposite direction. Both&nbsp;&nbsp;<span>\(d_1\)</span> and&nbsp;<span>\(d_0\)</span> are inside the classical bidirectional flow.</li> <li><em><strong>Duration</strong></em> is the duration of the flow</li> </ul> <p>&nbsp;</p> <p>The NetTiSA flow is implemented into IP flow exporter <a href="https://github.com/CESNET/ipfixprobe">ipfixprobe</a>.</p> <p>&nbsp;</p> <p><strong>Description of dataset files</strong></p> <p>In the following table is a description of each dataset file:</p> <table> <tbody> <tr> <td> <p><strong>File name</strong></p> </td> <td> <p><strong>Detection problem</strong></p> </td> <td> <p><strong>Citation of the original raw dataset</strong></p> </td> </tr> <tr> <td>botnet_binary.csv&nbsp;</td> <td>Binary detection of botnet&nbsp;</td> <td>S. Garc&iacute;a et al. An Empirical Comparison of Botnet Detection Methods. Computers &amp; Security, 45:100&ndash;123, 2014.&nbsp;</td> </tr> <tr> <td>botnet_multiclass.csv&nbsp;</td> <td>Multi-class classification of botnet&nbsp;</td> <td>S. Garc&iacute;a et al. An Empirical Comparison of Botnet Detection Methods. Computers &amp; Security, 45:100&ndash;123, 2014.&nbsp;</td> </tr> <tr> <td>cryptomining_design.csv&nbsp;</td> <td>Binary detection of cryptomining; the design part&nbsp;</td> <td>Richard Pln&yacute; et al. Datasets of Cryptomining Communication. Zenodo, October 2022&nbsp;</td> </tr> <tr> <td>cryptomining_evaluation.csv&nbsp;</td> <td>Binary detection of cryptomining; the evaluation part&nbsp;</td> <td>Richard Pln&yacute; et al. Datasets of Cryptomining Communication. Zenodo, October 2022&nbsp;</td> </tr> <tr> <td>dns_malware.csv&nbsp;</td> <td>Binary detection of malware DNS&nbsp;</td> <td>Samaneh Mahdavifar et al. Classifying Malicious Domains using DNS Traffic Analysis. In DASC/PiCom/CBDCom/CyberSciTech 2021, pages 60&ndash;67. IEEE, 2021.&nbsp;</td> </tr> <tr> <td>doh_cic.csv&nbsp;</td> <td>Binary detection of DoH&nbsp;</td> <td>Mohammadreza MontazeriShatoori et al. Detection of doh tunnels using time-series classification of encrypted traffic. In DASC/PiCom/CBDCom/CyberSciTech 2020, pages 63&ndash;70. IEEE, 2020&nbsp;</td> </tr> <tr> <td>doh_real_world.csv&nbsp;</td> <td>Binary detection of DoH&nbsp;</td> <td>Kamil Jeř&aacute;bek et al. Collection of datasets with DNS over HTTPS traffic. Data in Brief, 42:108310, 2022&nbsp;</td> </tr> <tr> <td>dos.csv&nbsp;</td> <td>Binary detection of DoS&nbsp;</td> <td>Nickolaos Koroniotis et al. Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset. Future Gener. Comput. Syst., 100:779&ndash;796, 2019.&nbsp;</td> </tr> <tr> <td>edge_iiot_binary.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Mohamed Amine Ferrag et al. Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications: Centralized and federated learning, 2022.&nbsp;</td> </tr> <tr> <td>edge_iiot_multiclass.csv&nbsp;</td> <td>Multi-class classification of IoT malware&nbsp;</td> <td>Mohamed Amine Ferrag et al. Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications: Centralized and federated learning, 2022.&nbsp;</td> </tr> <tr> <td>https_brute_force.csv&nbsp;</td> <td>Binary detection of HTTPS Brute Force&nbsp;</td> <td>Jan Luxemburk et al. HTTPS Brute-force dataset with extended network flows, November 2020&nbsp;</td> </tr> <tr> <td>ids_cic_binary.csv&nbsp;</td> <td>Binary detection of intrusion in IDS&nbsp;</td> <td>Iman Sharafaldin et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1:108&ndash;116, 2018.&nbsp;</td> </tr> <tr> <td>ids_cic_multiclass.csv&nbsp;</td> <td>Multi-class classification of intrusion in IDS&nbsp;</td> <td>Iman Sharafaldin et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1:108&ndash;116, 2018.&nbsp;</td> </tr> <tr> <td>unsw_binary.csv&nbsp;</td> <td>Binary detection of intrusion in IDS&nbsp;</td> <td>Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 military communications and information systems conference (MilCIS), pages 1&ndash;6. IEEE, 2015.&nbsp;</td> </tr> <tr> <td>unsw_multiclass.csv&nbsp;</td> <td>Multi-class classification of intrusion in IDS&nbsp;</td> <td>Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In 2015 military communications and information systems conference (MilCIS), pages 1&ndash;6. IEEE, 2015.&nbsp;</td> </tr> <tr> <td>iot_23.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Sebastian Garcia et al. IoT-23: A labeled dataset with malicious and benign IoT network traffic, January 2020. More details here https://www.stratosphereips.org /datasets-iot23&nbsp;</td> </tr> <tr> <td>ton_iot_binary.csv&nbsp;</td> <td>Binary detection of IoT malware&nbsp;</td> <td>Nour Moustafa. A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994, 2021&nbsp;</td> </tr> <tr> <td>ton_iot_multiclass.csv&nbsp;</td> <td>Multi-class classification of IoT malware&nbsp;</td> <td>Nour Moustafa. A new distributed architecture for evaluating ai-based security systems at the edge: Network ton iot datasets. Sustainable Cities and Society, 72:102994, 2021&nbsp;</td> </tr> <tr> <td>tor_binary.csv&nbsp;</td> <td>Binary detection of TOR&nbsp;</td> <td>Arash Habibi Lashkari et al. Characterization of Tor Traffic using Time based Features. In ICISSP 2017, pages 253&ndash;262. SciTePress, 2017.&nbsp;</td> </tr> <tr> <td>tor_multiclass.csv&nbsp;</td> <td>Multi-class classification of TOR&nbsp;</td> <td>Arash Habibi Lashkari et al. Characterization of Tor Traffic using Time based Features. In ICISSP 2017, pages 253&ndash;262. SciTePress, 2017.&nbsp;</td> </tr> <tr> <td>vpn_iscx_binary.csv&nbsp;</td> <td>Binary detection of VPN&nbsp;</td> <td>Gerard Draper-Gil et al. Characterization of Encrypted and VPN Traffic Using Time-related. In ICISSP, pages 407&ndash;414, 2016.&nbsp;</td> </tr> <tr> <td>vpn_iscx_multiclass.csv&nbsp;</td> <td>Multi-class classification of VPN&nbsp;</td> <td>Gerard Draper-Gil et al. Characterization of Encrypted and VPN Traffic Using Time-related. In ICISSP, pages 407&ndash;414, 2016.&nbsp;</td> </tr> <tr> <td>vpn_vnat_binary.csv&nbsp;</td> <td>Binary detection of VPN&nbsp;</td> <td>Steven Jorgensen et al. Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification. CoRR, abs/2205.05628, 2022&nbsp;</td> </tr> <tr> <td>vpn_vnat_multiclass.csv&nbsp;</td> <td>Multi-class classification of VPN&nbsp;</td> <td>Steven Jorgensen et al. Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification. CoRR, abs/2205.05628, 2022&nbsp;</td> </tr> </tbody> </table> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p>

opencc-by-4.0Aug 2023View details →
zenodo40/100

HTTPS Brute-force dataset with extended network flows

<p>We are publishing a dataset we created for designing a brute-force detector of attacks in HTTPS. The dataset consists of extended network flows that we captured with flow exporter <a href="https://github.com/CESNET/ipfixprobe">Ipifixprobe</a>.&nbsp;Apart from traditional fields like source and destination IP addresses and ports, each flow contains information (size, direction, inter-packet time, TCP flags) about up to the first 100 packets. The sizes of packets are taken from the transport layer (TCP, UPD); packets with zero payload (e.g., TCP ACKs) are ignored.</p> <p>We publish three files:</p> <ul> <li><em>flows.csv</em>, which contains raw flow data.</li> <li><em>aggregated_flows.csv</em>, which contains aggregated flows</li> <li><em>samples.csv</em>,&nbsp;which contains samples with extracted features. This data can be used for training a machine-learning classification model.</li> </ul> <p>&nbsp;</p> <p>All IP addresses, source ports, TLS SNIs are sha256-hashed. Column <em>CLASS</em>&nbsp;is 0 for benign samples and 1 for brute-force samples.</p> <p><br> <strong>Brute-force data</strong><br> The brute-force data were generated with three popular attack tools - Ncrack, Thc-hydra, and Patator. Attacks were performed against these applications:</p> <ul> <li>&nbsp; &nbsp; WordPress</li> <li>&nbsp; &nbsp; Joomla&nbsp;</li> <li>&nbsp; &nbsp; MediaWiki</li> <li>&nbsp; &nbsp; Ghost</li> <li>&nbsp; &nbsp; Grafana</li> <li>&nbsp; &nbsp; Discourse</li> <li>&nbsp; &nbsp; PhpBB</li> <li>&nbsp; &nbsp; OpenCart</li> <li>&nbsp; &nbsp; Redmine</li> <li>&nbsp; &nbsp; Nginx</li> <li>&nbsp; &nbsp; Apache</li> </ul> <p>The <em>SCENARIO</em>&nbsp;columns indicate which tool and application were used to generate the sample.</p> <p><strong>Benign data</strong><br> Bening data consists of eight captures from a backbone network. The <em>SCENARIO</em>&nbsp;column indicates individual captures.</p> <p>&nbsp;</p> <p>&nbsp;</p> <p>&nbsp;</p>

opencc-by-4.0Nov 2020View details →
zenodo40/100

Diffusion in Temporal Networks: London Tube passenger flows

<p>This video shows the diffusion of visitation probabilities of a random walk in a temporal network that has been constructed based on time-stamped data on passenger flows in the London Tube network.</p> <p>The left panel shows a random walk based on the empirical temporal network. This temporal network exhibits non-Markovian characteristics as shown in [1]. The right panel shows a random walk based on a a shuffled version of the same network, in which all order correlations are destroyed. This corresponds to a Markovian temporal network in which all time-respecting path statistics correspond to what is expected based on the static, time-aggregated network.</p> <p>This video is an illustrative&nbsp;supporting animation for the following paper:</p> <p><em>[1] Ingo Scholtes, Nicolas Wider, Ren&eacute; Pfitzner, Antonios Garas, Claudio Juan Tessone and Frank Schweitzer: </em><strong>Causality-driven</strong><strong> slow-down and speed-up of diffusion in non-Markovian temporal networks, </strong>Nature Communications, Vol. 5, Article 5024, September 24, 2014</p>

opencc-by-4.0Jul 2015View details →
zenodo40/100

Averaged results of blood flow simulations with discrete RBC tracking for microvascular networks

<p>The dataset contains the results for blood flow simulations&nbsp;in 3 cerebral micorvascular networks.The microvascular networks are from the mouse parietal cortex (Blinder&nbsp;et al., 2013) and embedded in a tissue volume of approximately 1 cubic mm. For the blood flow simulations we used a numercial model with discrete tracking of RBCs&nbsp;which is described in Schmid et al.,&nbsp;2017.</p> <p>For each network the following data are&nbsp;provided:<br> - Microvascular network with averaged flow and pressure field, as well as averaged values for the distribution and motion of red blood cells (RBCs).<br> - RBC trajectories describing the motion of individual RBCs through the microvascular networks.<br> - The data is stored as a graph, i.e. vertices connected by edges.<br> - Details regarding the simulation parameters can be found in Schmid et al., 2017.<br> -&nbsp;Data format (pickle - files containing&nbsp;python dictonairies).<br> <br> <strong>Microvascular networks:</strong><br> <strong>edgesDict.pkl:</strong> dictionary with edge related data (dictionary keys: flow [um^3/ms], diameter [um], tuple [-], httBC [-], nkind&nbsp;[-], length [um], htt [-], nRBC [-], diameters [um], points [um])<br> <strong>verticesDict.pkl:</strong> dictionary with vertex related data (dictionary keys: pressure [mmHg], coordinates [um], pBC [mmHg])</p> <p>Additional comments on dictionary keys:<br> - pBC: pressure boundary conditions. &#39;None&#39; for internal nodes. Assigned based on the hierarchical boundary conditions approach (see Schmid et al. 2017 for details)<br> - tuple: connectivity of graph, tuple of vertices<br> - httBC: tube hematocrit boundary conditions. &#39;None&#39; for internal nodes. Constant value assigned.<br> - nkind: integere to describe the vessel type. 0: pial artery, 1: pial venule, 2: descending arteriole, 3: ascending venule, 4: capillaries, 5: unknown<br> - htt: tube hematocrit<br> - nRBC: number of red blood cells<br> - points: list of tortuous vessel coordinates per edge<br> - diameters: local diameter measurements associated to the &#39;points&#39; key.</p> <p><br> <strong>RBC trajectories:</strong><br> <strong>RBC_trajectories.pkl:&nbsp;</strong>dictonary&nbsp;for each RBC with relevant tracking data (dictionary key: RBC index). The relavant tracking data per RBC is stored in another dictionary with the following keys: edges, lengths, times, pressure, nkindsMod, RBCleft</p> <p>Additional comments on dictionary keys per RBC:<br> - RBCleft: bool to indicate that RBC left the computational domain<br> - edges: edge indices&nbsp;through which the RBC moves on its way through the vasculature<br> - pressure: pressure [mmHg] values at the nodes along the RBC trajectory<br> - times: time [ms] the RBC spends in the respective edge segment<br> - nkindsMod: nkind at the nodes along the RBC trajectory&nbsp;<br> - lengths: cummulative length travelled [um]</p>

opencc-by-4.0Feb 2017View details →
zenodo40/100

Dataset for manuscript 'CeyeHao: AI-driven microfluidic flow programming with hierarchically assembled obstacles in microchannel and receptive-field-augmented neural network'

<p>This dataset contains:<br>1. The dataset used to train the models related to the manuscript 'CeyeHao: AI-driven microfluidic flow programming using hierarchically assembled obstacles in microchannel with receptive-field-augmented neural network'.<br>2. A checkpoint of trained 'CEyeNet' proposed in the manuscript.<br>3. Example microchannels designed in the manuscript to produce semantic flow profiles</p> <p>This dataset is intended for research and academic purpose.</p> <p>Detailed description please refer to the enclosed ReadMe.txt.</p>

opencc-by-4.0Aug 2024View details →
zenodo40/100

Local optima network metrics from the IEEE CEC 2024 paper "Information flow and Laplacian dynamics on local optima networks"

<p>Local optima network metrics from the IEEE CEC 2024 paper "Information flow and Laplacian dynamics on local optima networks".&nbsp;</p> <p>There are two CSV files: one for each of the two iterated local search confgurations used to construct the networks (low or high). In each file, a row contains information about one QAPLIB instance. Easch row contains all the metrics computed for the associated LON and also algorithm performance data on the instance.&nbsp;</p>

opencc-by-4.0Mar 2024View details →
zenodo40/100

Global Positioning System Based on Optical Flow and Convolutional Neural Network

<p>Two datasets used in the paper Global Positioning System Based on Optical Flow and Convolutional Neural Network, to evaluate the proposed CNN model to the task of position estimation. The datasets cover 2 different modes of motion of a drone, and were captured using Google API.</p>

opencc-by-4.0Aug 2022View details →
zenodo40/100

WaterGEMS models for flow starved water transmission network

<p><strong>This data contains WaterGEMS models of a Water Transmission Network (WTN) in India. It deploys a newly developed modeling approach, Pressure Driven Analysis for Flow Straved Condition(PDA-FSC). It is used for evaluating the performance of flow-starved WTN.&nbsp;</strong></p>

opencc-by-4.0Feb 2022View details →
dryad40/100

Physics-informed neural networks (PINNs) with unsaturated water flow models for inverse analysis of soil hydraulic parameters of layered soil profiles

<p>Information about the spatial distribution of soil hydraulic parameters is necessary for the accurate prediction of soil water flow and coupled movement of chemicals and heat at the field scale using a process-based model. Physics-informed neural networks (PINNs), which can provide physical constraints in deep learning to obtain a mesh-free solution, can be used to inversely estimate the soil hydraulic parameters from less and noisy training data. Previous studies using PINNs have successfully estimated soil hydraulic parameters for homogeneous soil but estimating such parameters of layered soil profiles where the interface depth and the parameters are unknown still has some difficulties. The objective of this study was to develop PINNs to inversely estimate the distribution of soil hydraulic parameters, such as saturated hydraulic conductivity and <em>α</em> and <em>n</em>, of the Mualem-van Genuchten model directly within layered soil profiles by predicting changes in pressure head from training data based on simulation results at given depths during infiltration. The impact of factors affecting PINNs performance, such as the weights assigned to each component of the loss function, the time range used in error computations, and the number of samples used to assess physical constraint was investigated. By assigning a larger weight to the physical constraint and excluding the earlier stage of infiltration in the loss function, the changes in pressure head and the three soil hydraulic parameter distributions within the layered soil profiles were successfully estimated. The developed PINNs can be further applied to more complex soils and can be improved.</p>

opencc-zeroMay 2024View details →
zenodo40/100

Fig. 4 in Drainage Network Morphology Influences Population Structure and Gene Flow of the Andean Water Frog (Anura: Telmatobiidae) of the Atacama Desert, Northern Chile.

Fig. 4. Results of the Geneland analysis. A: Bar plot of posterior probability density according to the number of clusters; B: posterior probability maps for the delimited clusters.

opencc-by-4.0Aug 2023View details →
zenodo40/100

Fig. 3 in Drainage Network Morphology Influences Population Structure and Gene Flow of the Andean Water Frog (Anura: Telmatobiidae) of the Atacama Desert, Northern Chile.

Fig. 3. Pairwise FST between localities of Telmatobius pefauri obtained using mitochondrial (A) and microsatellite (B) data. The colour scale corresponding to the values of FST is shown to the right of each matrix. Significant (Bonferroni corrected) comparisons showing p &lt;0.05, p &lt;0.01 and p &lt;0.001 are denoted by *, ** and ***, respectively.

opencc-by-4.0Aug 2023View details →
zenodo40/100

Fig. 2 in Drainage Network Morphology Influences Population Structure and Gene Flow of the Andean Water Frog (Anura: Telmatobiidae) of the Atacama Desert, Northern Chile.

Fig. 2. Median-joining network based on the fragment of the analysed control region. Table 1. Indices of mitochondrial diversity, nuclear diversity, and inbreeding coefficients (FIS) by locality

opencc-by-4.0Aug 2023View details →
zenodo40/100

Fig. 1 in Drainage Network Morphology Influences Population Structure and Gene Flow of the Andean Water Frog (Anura: Telmatobiidae) of the Atacama Desert, Northern Chile.

Fig. 1. Study area, distribution of Telmatobius pefauri. Localities, 1: Socoroma (Socoroma River); 2: Murmuntani; 3: Copaquilla; 4: Chapiquiña; 5: Belén; 6: Lupica; 7: Saxamar. Localities 2 and 3 belong to the Seco River drainage; localities 4–7 belong to the Tignamar River drainage. Basin limits are indicated with dashed lines. The inset map shows the study area (highlighted by a red box) in relation to South America. SAAD = South American Arid Diagonal.

opencc-by-4.0Aug 2023View details →
zenodo40/100

Fig. 5 in Drainage Network Morphology Influences Population Structure and Gene Flow of the Andean Water Frog (Anura: Telmatobiidae) of the Atacama Desert, Northern Chile.

Fig. 5. Scatter plot for the first two principal components obtained in the Principal Components Analysis using SSR data.

opencc-by-4.0Aug 2023View details →

ScienceDex guides

Understand access before you commit

These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.

Compare curated datasets

Allen Brain Atlas

Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.

allen-brain-atlas
neuroscienceopenDocumentation, web resources, and API references are available online.
Last verified 2026-04-30Open record

Annotated Behaviour and Observability Dataset (ABODe)

ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.

abode-home-cage
behavioral-neuroscienceopenThe DataShare record exposes download links for annotations, documentation, license text, and the zipped per-snippet data directory.
Last verified 2026-04-30Open record

DANDI Archive for NWB datasets

DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.

dandi-nwb
electrophysiologyopenPublished Dandiset metadata and archive endpoints are available through the production DANDI API.
Last verified 2026-04-30Open record

International Brain Laboratory public data

The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.

ibl
behavioral-neuroscienceopenPublic sessions can be searched and loaded from the IBL public data server through ONE.
Last verified 2026-04-29Open record

OpenNeuro

OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.

openneuro
neuroscienceopenPublished datasets are available on demand over the internet.
Last verified 2026-04-29Open record