Real-World Multi-Class Network Flow Dataset for Intrusion Detection

The dataset comprises labeled network traffic flows collected from real-world enterprise environments, totaling approximately 12.7 million entries. It includes both benign (10.1 million) and malicious (2.6 million) flows. Each entry records protocol-specific metadata such as source and destination IP addresses, ports, packet size, timestamps, flags, and flow duration. Malicious entries span various attack types, supporting evaluation of evasion-resilient intrusion detection. This dataset is designed for training and evaluating machine learning-based NIDS models, particularly in high-class-imbalance scenarios, and is structured to support feature selection, protocol-aware preprocessing, and adversarial robustness testing.