EISIM-compatible graph mapping of public benchmark network intrusion datasets

This set of datasets provides a mapping of public network intrusion benchmarks to a graph-based format compatible with the (E)ISIM model. Each dataset is mapped to an using only the publicly available CSV flow records, without any testbed-specific topology, vulnerability data, or node-type schema. For the UNSW-NB15, CIC-IDS-2017, AIT Log Dataset V2.0 datasets, unique source and destination IP addresses are transformed into Host nodes to create an IP-level graph. A directed edge is added for every unique (src ip, dst ip) pair observed in the data; self-loops are discarded. IPs appearing in fewer than 5 flows are dropped as noise. Node features aggregate all numeric flow columns per IP: mean, standard deviation, and maximum across all flows in which the IP participates as source and as destination, plus connectivity indicators (ndst unique, nsrc unique, nflows,src, nflows,dst, and unique port counts per role). The AIT Log dataset combines two tstat-format files (TCP and UDP); both are merged into a single IP-level graph at load time, with protocol-specific columns zero-filled for rows of the other protocol. KDD Cup 1999 contains no IP addresses. Each unique (protocol type, service) combination becomes a NetworkService node, yielding a 65-node service-level graph. Structural edges are absent from the raw data; instead, a directed k-NN graph (k = 5) is constructed in normalized feature space: for each node the 5 most similar nodes by Euclidean distance are connected. Node features are the mean, standard deviation, and maximum of the 38 numeric KDD flow columns plus a flow-count scalar nflows, for 115 features total. The full node feature matrix is z-score normalized column-wise (zero-mean, unit-variance) after aggregation; constant columns are left at zero.The full node feature matrix is z-score normalized column-wise (zero-mean, unit-variance) after aggregation; constant columns are left at zero.