CESNET-DeviceType24: Dataset for Device Type Classification on ISP Network

This dataset was created in the work "Device Type Classification on ISP Network using Time Series Analysis" submitted to the IEEE/IFIP Network Operations and Management Symposium 2026. Please cite usage fo this dataset as:

@article{koumar2025cesnet,
title={CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting},
author={Koumar, Josef and Hynek, Karel and {\v{C}}ejka, Tom{\'a}{\v{s}} and {\v{S}}i{\v{s}}ka, Pavel},
journal={Scientific Data},
volume={12},
number={1},
pages={338},
year={2025},
publisher={Nature Publishing Group UK London}
}

Dataset origin and creation

The dataset was created from the CESNET-TimeSeries-24 dataset [1], which captures traffic from the CESNET network. A standout feature of the CESNET-TimeSeries-24 dataset is its breadth and depth, encompassing not only overall network traffic but also highly detailed time series across 297 institutions, 610 institutional subnets, and over 270,000 individual IP addresses. This extensive range provides a robust basis for comparative analysis of neural network models, enabling researchers to benchmark forecasting performance across multiple hierarchical levels within the network. By facilitating such a granular and comprehensive examination, this dataset is ideally suited for testing model scalability, adaptability, and accuracy. Spanning a substantial 40-week period, from October 2023 to July 2024, the dataset captures both long-term trends and fine-grained fluctuations, offering an invaluable resource for rigorous neural network model assessment.

In our work, we utilized a dataset subset comprising distinct communicating IP addresses and corresponding annotations, which we also published within the open-source tool CESNET TS-Zoo [2]. The annotation process was done using a semi-automated method. Initially, the annotation was based on prior knowledge of the CESNET3 network infrastructure and the devices connected to it. After that, other unknown IP addresses were annotated using reverse DNS lookups and queries to the Shodan \footnote{https://www.shodan.io} platform. However, this approach does not allow reliable annotation of all captured devices within the CESNET3 network and the dataset itself.

A label could be reliably assigned to 82,504 devices, which were placed into three different classes: end-device, net-device, and server.  As expected, the majority class is end-device, which was assigned to 72,523 devices. The end-device class covers both user devices and NATs. The server class was assigned to 7,875 devices, and 2,106 IP addresses were annotated as net-device.

The data are split into Train, Validation, and Test sets. We split the data using the temporal splitting technique, which allows the assessment of the generalization of models and stability on future data. Moreover, this approach addresses the problem of data drifts, which are commonly present in the network monitoring domain [3,4,5]. The first 26 weeks were used as the training set, the next 2 weeks as the validation set, and the remaining 12 weeks as the test set. The long test set allows us to evaluate the performance of models over multiple weeks. Thus, we can evaluate whether the data drift is present in the device type recognition. The train set contains 2,401,854 samples, the validation set contains 184,758 samples, and the test set contains 1,108,548 samples.

File description

We publish 3 files:

train.csv - File contains the Train set, which should be used for training.

val.csv - File contains the Val set, which should be used for validation of the model during hyperparameter training.

test.csv - File contains the Test set, which should be used for testing of the final model.

Each row represents a week of the data for the corresponding class. For each time series metric, we publish its datapoints using the index i (from 0 to 41, corresponding to 42 4-hour windows in one week). The following table describes each time series metric and column.

Field name
Description

class
Device type label

n_flows_i
Number of IP flows for the i-th datapoint in the week

n_packets_i
Number of packetsfor the i-th datapoint in the week

n_bytes_i
Number of bytes for the i-th datapoint in the week

n_dest_asn_i
Number of unique destination ASNsfor the i-th datapoint in the week

n_dest_ports_i
Number of unique destination portsfor the i-th datapoint in the week

n_dest_ip_i
Number of unique destination IPs for the i-th datapoint in the week

tcp_udp_ratio_packets_i
TCP/UDP packet ratio for the i-th datapoint in the week

tcp_udp_ratio_bytes_i
TCP/UDP bytes ratio for the i-th datapoint in the week

dir_ratio_packets_i
Directional ratio of packets for the i-th datapoint in the week

dir_ratio_bytes_i
Directional ratio of bytes for the i-th datapoint in the week

avg_duration_i
Average duration for the i-th datapoint in the week

avg_ttl_i
Average TTL for the i-th datapoint in the week

References

[1] Koumar, J., Hynek, K., Čejka, T., & Šiška, P. (2025). CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting. Scientific Data, 12(1), 338.

[2] Kureš, M., Koumar, J., & Hynek, K. (2025). CESNET TS-Zoo: A Library for Reproducible Analysis of Network Traffic Time Series. In 2025 21th International Conference on Network and Service Management (CNSM). IEEE.

[3]L. Jančička, D. Soukup, J. Koumar, F. Němec, and T. Čejka, “Mfwdd: Model-based feature weight drift detection showcased on tls and quic traffic,” in 2024 20th International Conference on Network and Service Management (CNSM). IEEE, 2024, pp. 1–5.

[4] N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “Deep learning for encrypted traffic classification in the face of data drift: An empirical study,” Computer Networks, vol. 225, p. 109648, 2023.

[5] N. Malekghaini, E. Akbari, M. A. Salahuddin, N. Limam, R. Boutaba, B. Mathieu, S. Moteau, and S. Tuffin, “Data drift in dl: Lessons learned from encrypted traffic classification,” in 2022 IFIP Networking Conference (IFIP Networking). IEEE, 2022, pp. 1–9.