VNIDS 2026: A Synthetic Alert-Level Network Intrusion Detection Benchmark

Overview Records: ~16 million (~2–2.5 million/day × 7 days) Days: 2026-01-06 to 2026-01-12 (Tuesday–Monday) Attack categories: 28 (27 attack types + BENIGN) Alert level: Semantic IDS alert output (Suricata / Zeek / Wazuh) Format: Gzip-compressed CSV (.csv.gz), one file per day Total size: ~171 MB compressed (~1.4 GB uncompressed) License: CC BY-NC 4.0 Attack ratio: ~15% of total traffic Label leakage: None — ground-truth labels isolated in label column only Dataset Description VNIDS 2026 is purpose-built to address a fundamental gap in existing IDS benchmark datasets. Prior benchmark datasets provide raw network-flow statistics, not the semantic IDS alert output that a SOC analyst or AI system receives in practice. Each record represents a single security event as emitted by Suricata, Wazuh, or Zeek — complete with alert signatures, MITRE ATT&CK-mapped event types, severity scores, and contextual flow features — rather than raw packet statistics. Files (one per day) VNIDS2026_20260106.csv.gz — 2,500,000 records — 2026-01-06 (Tuesday) VNIDS2026_20260107.csv.gz — 2,500,000 records — 2026-01-07 (Wednesday) VNIDS2026_20260108.csv.gz — 2,500,000 records — 2026-01-08 (Thursday) VNIDS2026_20260109.csv.gz — 2,500,000 records — 2026-01-09 (Friday) VNIDS2026_20260110.csv.gz — 2,000,000 records — 2026-01-10 (Saturday) VNIDS2026_20260111.csv.gz — 2,000,000 records — 2026-01-11 (Sunday) VNIDS2026_20260112.csv.gz — 2,500,000 records — 2026-01-12 (Monday) Attack Categories (28) Benign (1): BENIGN Volumetric DDoS (5): DDoS-UDP-Flood, DDoS-HTTPS-Flood, DDoS-DNS-Amplification, DDoS-NTP-Amplification, DDoS-AI-Volumetric Reconnaissance (3): PortScan-SYN-Stealth, PortScan-XMAS, PortScan-NULL Application-layer (5): WebAttack-SQLi, WebAttack-XSS, WebAttack-SSRF, WebAttack-Log4Shell, WebAttack-SSTI Credential attacks (4): BruteForce-SSH, BruteForce-RDP, BruteForce-HTTP, BruteForce-Credential-Stuffing C2 / Persistence (3): C2-Beacon-HTTP, C2-DNS-Tunneling, C2-HTTPS-Covert Malware (4): Ransomware-LateralMovement, Ransomware-Encryption, Cryptomining, Botnet-IRC Exfiltration (2): Insider-DataExfil, Supply-Chain-Exfil AI-era threats (2): AI-Powered-Scan, LLM-Prompt-Injection Scientific Basis Traffic parameters are calibrated against published measurement studies: Benign traffic: CAIDA MAWI (2019); Benson et al. IMC 2010; Leland et al. 1994 DDoS: Mirsky et al. NDSS 2018; Agrawal et al. Wireless Networks 2019 Brute force: Bhardwaj & Goundar 2020; Cowrie honeypot statistics 2022–2024 Port scan: Durumeric et al. USENIX Security 2014 C2 / Botnet: Yin et al. 2018; Stone-Gross et al. 2009 Ransomware: Moussaileb et al. 2021; Cabaj et al. 2018 Label Isolation (Scientific Integrity) The label column is the only ground-truth field. It is never present in any of the 46 feature columns. Alert signatures are generated independently of labels. A full audit of all 74 distinct signatures confirms zero signatures map exclusively to a single category. Reproducibility The dataset is fully deterministic (fixed random seed). To regenerate locally: git clone https://github.com/huynhtrungcsc/memory-augmented-agentic-ai-soc cd memory-augmented-agentic-ai-soc/evaluation/datasets/vnids2026 python3 generator.py Associated System Created to evaluate the Memory-Augmented Agentic AI SOC system. GitHub: memory-augmented-agentic-ai-soc Cold-start benchmark: F1 = 77.7%, Recall = 94.6%, Precision = 65.9%, FPR = 49.2% (n=371, 28 categories)