I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to Local attacks, User to root attacks, or all of them. The bigger, the better.

Something on the lines of DARPA Intrusion Detection Evaluation Data set will exactly suit my needs. (http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/index.html)

  • 2
    The IDS research community strongly discourages the use of the DARPA (and the derived KDD Cup) data set for any meaningful research. In general, it is non-trivial to generate such data sets: icir.org/vern/cs261n/papers/TISSEC-mchugh-critique.pdf. – mavam May 23 '12 at 9:38
  • Thanks a lot @MatthiasVallentin . But please do offer some alternatives to me then... – pnp May 23 '12 at 9:43
  • Unfortunately I am not aware of any reasonable public data sets precisely because they are so difficult to create in the first place. For a NIDS, you could start with traffic traces of known attacks, but be aware that this is quite an isolated setting closer to unit testing. At a broader scope, it's highly valuable to evaluate IDSs in multiple environments and understanding why does it perform as it does, as complex detection algorithms may not always give an obvious answer to this question. – mavam May 23 '12 at 15:29
  • @pnp, Hi, did you find your pcap datasets? I need some of them for my researches, thanks in advance – CDominik Oct 6 '15 at 10:16
  • @DomenicoChiarito Answers below (Yohann and pds) were helpful for me. This might also help you - mcfp.weebly.com – pnp Oct 7 '15 at 11:29

There is some repositories of pcap traces. Some have traces of malware, port scanning, etc.. You can then replay these traces with tcpreplay.

  • Thanks for the links Yohann (+1 for that). They will surely help, although i am looking for larger data sets covering a broader range of attacks. And can you tell of some other tools i can use apart from tcpreplay for this purpose? – pnp May 23 '12 at 7:20
  • If you have money, there is commercial product like Breaking Point. – Yohann May 23 '12 at 9:45
  • Thanks a ton Yohann...my guide is quite happy with my 'findings'. If you have got some more information then surely do let me know... – pnp May 26 '12 at 9:14

For a dataset to assist the evaluation of IDS / IPS systems, I recommend you the following:

  • ISCX 2012 dataset, collected in 2010 as a replacement for KDDCup99. The dataset has network packet filtering (NPF) attributes; it does not include KDDCup99's more expansive SIEM logging system data. Fortunately, it is labelled.

  • ITOC 2009 dataset has added NPF and audit logging data, but is devoid of labels. Some work exists to evaluate it using Snort IDS.

Other replacements to KDDCup99 are out there, such as NSL-KDD, see Quora answer for links.

As for Web-Pen testing dataset, as Schroeder mentions, here is one:

  • CSIC 2010 dataset is an HTTP web penetration testing dataset intended for anomaly detection and created by the ISI CSIC in 2010

Have you looked at vSploit from Metasploit? You set up a vSploit server inside your network, then a vSploit client outside. It is designed to perform the types of testing you are looking for, although I do not know if the full set of traffic is as comprehensive as you are looking for.

I'd be interested to know what you do think of their data set!

  • Thanks a lot schroeder. It will take me some time to actually understand how to use vSploit, but surely it is going to be a good help to me. If you are aware of some learning material on it apart from the Defcon video on it, i shall be glad to know about it. – pnp May 26 '12 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.