CVE-Stream: A Chronologically Ordered Vulnerability Stream for Online Learning under Concept Drift and Class Imbalance

CVE-Stream is a benchmark dataset for evaluating online / streaming learning methods under the joint challenge of continuous concept drift and extreme class imbalance. It is constructed from real Common Vulnerabilities and Exposures (CVE) records published in the U.S. National Vulnerability Database (NVD), ordered chronologically by publication date so that the natural temporal evolution of vulnerability disclosures is preserved. Unlike benchmarks that synthesize distribution shift by concatenating unrelated datasets, CVE-Stream exhibits genuine, time-evolving drift arising from the real-world evolution of software vulnerabilities, together with severe and dynamically fluctuating class imbalance that is characteristic of cyber threat intelligence.