An Unlabeled Netflow Cybersecurity Sandbox Dataset with Attack and Benign Traffic

Overview

This dataset contains 2465 CSV files exported from ntopng, each representing a batch of Netflow records.

All files follow the naming pattern: batch-local-only.$id.csv, where $id is between 00001 and 02465.

The traffic has been recorded in a sandbox environment, as part of a cybersecurity challenge. Challenge participants were divided into teams, and each team was assigned a VM where purposefully vulnerable software was deployed. Each team was tasked with defending their own VM, while attacking as many other VMs as possible. The provided dataset only includes the internal traffic between the VMs and the traffic between the challenge participants' workstations and the sandbox.

Each row represents a network flow with extended metadata, as described below. In total, there are 69 features available.

Field Description

1. Flow Timing and Identity

Field
Description

FIRST_SEEN
Timestamp when the flow started

LAST_SEEN
Timestamp when the flow ended

DURATION
Flow duration

TIME_DELTA
Inter-arrival time between flows

FLOW_ID
Unique flow identifier

COMMUNITY_ID
Flow hash for cross-system correlation

2. Traffic Volume

Field
Description

PACKETS
Total packets in the flow

TOTAL_BYTES
Total bytes in the flow

SRC2DST_BYTES
Bytes from source to destination

DST2SRC_BYTES
Bytes from destination to source

SRC2DST_PACKETS
Packets from source to destination

DST2SRC_PACKETS
Packets from destination to source

THROUGHPUT
Estimated throughput

3. Network and Transport Layer

Field
Description

PROTOCOL
L4 protocol (e.g. TCP, UDP)

IP_PROTOCOL_VERSION
IP version (IPv4 or IPv6)

IPV4_SRC_ADDR_FORMATTED
Source IPv4 address

IPV4_DST_ADDR_FORMATTED
Destination IPv4 address

IPV6_SRC_ADDR_FORMATTED
Source IPv6 address

IPV6_DST_ADDR_FORMATTED
Destination IPv6 address

IP_SRC_PORT
Source port

IP_DST_PORT
Destination port

SRC2DST_TCP_FLAGS
TCP flags (src -> dst)

DST2SRC_TCP_FLAGS
TCP flags (dst -> src)

SRC2DST_DSCP
DSCP value (src -> dst)

DST2SRC_DSCP
DSCP value (dst -> src)

VLAN_ID
VLAN identifier

4. Application Layer (L7)

Field
Description

L7_PROTO
Detected application protocol

L7_PROTO_MASTER
Parent protocol

L7_CATEGORY
Application category

DOMAIN_NAME
Associated domain name

PROTOCOL_INFO_JSON
Additional protocol metadata

5. Performance and QoE

Field
Description

SCORE
Flow score assigned by ntopng

QOE_SCORE
Quality of Experience score

CLIENT_NW_LATENCY_US
Client-side latency (microseconds)

SERVER_NW_LATENCY_US
Server-side latency (microseconds)

6. Security and Alerts

Field
Description

FLOW_RISK
Risk classification

ALERT_JSON
Structured alert information

STATUS
Flow status

INFO
Additional descriptive information

7. Autonomous Systems and Geolocation

Field
Description

SRC_ASN
Source Autonomous System Number

DST_ASN
Destination Autonomous System Number

SRC_COUNTRY_CODE
Source country

DST_COUNTRY_CODE
Destination country

CLIENT_LOCATION
Client geographic location

SERVER_LOCATION
Server geographic location

8. NAT Information

Field
Description

PRE_NAT_IPV4_SRC_ADDR_FORMATTED
Source IP before NAT

PRE_NAT_SRC_PORT
Source port before NAT

PRE_NAT_IPV4_DST_ADDR_FORMATTED
Destination IP before NAT

PRE_NAT_DST_PORT
Destination port before NAT

POST_NAT_IPV4_SRC_ADDR_FORMATTED
Source IP after NAT

POST_NAT_SRC_PORT
Source port after NAT

POST_NAT_IPV4_DST_ADDR_FORMATTED
Destination IP after NAT

POST_NAT_DST_PORT
Destination port after NAT

9. Observation and Probe Metadata

Field
Description

OBSERVATION_POINT_ID
Identifier of observation point

PROBE_IP_FORMATTED
IP of the monitoring probe

INPUT_SNMP
Input interface index

OUTPUT_SNMP
Output interface index

NTOPNG_INSTANCE_NAME
Exporting ntopng instance

10. Network Segmentation and Labeling

Field
Description

SRC_NETWORK_ID
Source network identifier

DST_NETWORK_ID
Destination network identifier

SRC_HOST_POOL_ID
Source host pool

DST_HOST_POOL_ID
Destination host pool

SRC_LABEL
Source label

DST_LABEL
Destination label

11. Connection State

Field
Description

MAJOR_CONNECTION_STATE
High-level connection state

MINOR_CONNECTION_STATE
Detailed connection state

12. Wireless Context

Field
Description

WLAN_SSID
Wireless network SSID

WTP_MAC_ADDRESS
Wireless access point MAC

13. Fingerprinting

Field
Description

CLIENT_FINGERPRINT
Client fingerprint (e.g. TLS fingerprint)

Notes

Not all fields are populated for every flow.

NAT fields are populated only when translation is detected.

JSON fields (PROTOCOL_INFO_JSON, ALERT_JSON) can contain nested structures.

The Netflow probe IP has been anonymized and hardcoded to 10.10.10.10.

Only RFC1918 (private IP) traffic is available.