Pre-processed Public IDS Datasets in a Unified Packet-Flow Representation

Public intrusion detection datasets are often difficult to use directly for machine learning on raw network traffic at the packet or flow level because raw packet captures (PCAP files) and flow-level statistics or labels (CSV files) are typically distributed separately. As a result, researchers must typically reconstruct flows by aligning packets with labels. This document describes a derived release of four public IDS datasets, namely CICIDS2017, MQTT_IDS_2020, MQTTset, and USTC-TFC2016, converted into a unified packet-flow representation for downstream research. The release provides pre-processed versions of existing datasets where each sample is a labeled flow represented as an ordered sequence of packets. By reducing preprocessing effort and standardizing data representation, we aim to improve reproducibility and support research on early intrusion detection.