CTU-IDSEVAL-6: A Labeled Network Dataset for the Evaluation of Intrusion Detection Systems

CTU-IDSEVAL-6 is a labeled network dataset designed for the evaluation of intrusion detection systems. The dataset contains network captures with both benign and malicious traffic, including malware command-and-control activity and port scan attacks. The dataset consists of 6 network captures grouped by traffic behavior: one benign user traffic capture, two malware captures from the CTU Malware Capture Facility, and three port scan captures. Raw network traffic was processed using Zeek to generate labeled network flows. Each flow is assigned a high-level label (Benign, Malicious, or Background) and a detailed label describing the specific behavior observed. The dataset contains a total of 1,106,116 packets and 286,704 labeled network flows across approximately 1,000 hours of captured traffic. The total uncompressed size is 112 MB.