VNIDS 2026: A Synthetic Alert-Level Network Intrusion Detection Dataset

VNIDS 2026 is a large-scale synthetic alert-level network security benchmark dataset for evaluating AI-augmented Security Operations Centre (SOC) systems. Unlike prior IDS datasets that provide raw network-flow statistics, VNIDS 2026 generates realistic Suricata/Zeek/Wazuh alert-level events — the semantic output a SOC analyst or AI system actually receives. Key properties: ~2 million records across 7 days (2026-01-06 to 2026-01-12) 28 attack categories + BENIGN class 47 columns per record (semantic + numerical features) Attack ratio: ~15% (realistic enterprise IDS alert load) Label isolation: ground-truth label column NEVER embedded in feature columns; all records use event_type=alert_event Benign entities draw from all 8 IDS signature pools, including C2, DoS, malware, and integrity-check signatures with calibrated false-positive weights Fully deterministic: seed=42 → byte-identical regeneration via generator.py Benchmark results (GPT-4o-mini memory-augmented SOC agent): Cold-start: F1=68.9%, Recall=99.5%, Precision=52.7%, FPR=87.5%, n=396 Warm-start (30 background events): F1=66.7%, Recall=100.0%, FPR=99.0% (null result — warm-start did not reduce FPR; reported for scientific completeness) 27/28 attack categories at 100% F1; PortScan-SYN-Stealth at 92.3% Associated system: Memory-Augmented Agentic AI SOC — GitHub repository