Kyoto 2006+: Network Intrusion Detection Data from Honeypots, 2006-2009

The Kyoto 2006+ dataset provides real network traffic data collected from various honeypots between November 2006 and August 2009. Jungsuk Song from the National Institute of Information and Communications Technology created this dataset to address the outdated KDD Cup 99' dataset. It is intended to help researchers evaluate Network Intrusion Detection Systems (NIDSs) with data reflecting contemporary attack trends.

Use Cases

• Evaluating NIDS performance based on real traffic data spanning three years.
• Analyzing trends in modern cyber attacks like DDoS and spam based on honeypot-collected data.
• Training machine learning models for intrusion detection using data that reflects current network situations.
• Comparing new NIDS algorithms against a baseline using a dataset designed to replace KDD Cup 99'.

Strengths

• Data is derived from three years of real network traffic (Nov 2006 - Aug 2009).
• Source data was collected from diverse types of honeypots, likely capturing varied attack patterns.
• Explicitly created to reflect current network situations and latest attack trends, unlike the older KDD Cup 99' dataset.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Last update date is unknown; freshness unverified.
• Row count is unknown, which may limit suitability assessment.

Provenance

Source

National Institute of Information and Communications Technology

Collection Method

Collected from diverse types of honeypots.

Time Range

November 2006 to August 2009