TUC-RedTeam30: A Dataset for Evaluating ML-Based Network Intrusion Detection Systems

TUC-RedTeam30 Dataset for NIDS Benchmarking The Technical University of Chemnitz Red Team 30 (TUC-RedTeam30) dataset was collected during 30 distinct red teaming exercises conducted in a controlled and isolated environment. It is part of the artifact accompanying our USENIX WOOT'25 paper, "DeepRed: A Deep Learning–Powered Command and Control Framework for Multi-Stage Red Teaming Against ML-based Network Intrusion Detection Systems." Each scenario in the dataset represents a unique red team engagement and benign traffic (Web, Email, DNS, Streaming etc.), specifically designed to evaluate and challenge both signature-based and machine learning–based Network Intrusion Detection Systems (NIDS). Detailed descriptions of the 30 scenarios mapped to MITRE ATT&ck framework are provided in Appendix A of the main paper. Data FormatsThe dataset is provided in two formats, both compressed using tar.gz (no password protection): CSV Format: Contains labeled traffic flow features extracted from all PCAP files for 30 scenarios using the NFStream tool. The features across all scenarios have been combined into a single file for streamlined analysis. Each flow record is annotated with labels and metadata (scenario number). Label "0" denotes benign (normal) activity, while label "1" indicates malicious activity. PCAP Format: Due to the large size of the raw PCAP files, only a representative subset is included in this release. These PCAPs correspond to selected scenarios and are suitable for deeper packet-level analysis and feature extraction. Additional Information For detailed information on malicious IP addresses, ports, attack labeling, attack stages, tools used, and targets, please refer to Appendix A in the main paper.