lacg030175/UNSW-NB15

UNSW-NB15 Network Intrusion Detection Dataset

The UNSW-NB15 dataset for network intrusion detection, provided with two evaluation protocols to enable fair comparison across the literature.

Why This Dataset Exists

Published results on UNSW-NB15 range from 85% to 99% accuracy — but the gap is almost entirely due to evaluation protocol differences, not model quality:

The random split achieves higher accuracy because:

1. 1.30% of records are duplicates — random splitting leaks near-identical flows into both train and test
2. 2.No temporal shift — the standard split has temporal separation between training and testing periods

Both protocols are valid for different purposes:

• —Standard split: Realistic deployment scenario (train on past, test on future)
• —Random split: Maximum model comparison (controls for temporal shift)

Configurations

temporal (default) — Original Temporal Split

Note: standard is an alias for temporal — both load the same data.

The official train/test CSV files from UNSW-NB15, containing 44 features (all features except id).

from datasets import load_dataset

ds = load_dataset("lacg030175/UNSW-NB15", "temporal")  # or "standard" (alias)
# ds["train"]: 175,341 rows
# ds["test"]:   82,332 rows

• —Source: UNSW_NB15_training-set.csv and UNSW_NB15_testing-set.csv
• —Used by most published papers for benchmarking
• —Temporal separation between train and test periods

random — Deduplicated Random Split

Full dataset (2.28M records) with duplicates removed, split 80/20 with random_state=0 and stratified by label. Contains 49 features including IP addresses and ports.

from datasets import load_dataset

ds = load_dataset("lacg030175/UNSW-NB15", "random")
# ds["train"]: 1,425,833 rows
# ds["test"]:    158,426 rows

• —Source: All four raw UNSW-NB15 CSV files via Mouwiya/UNSW-NB15
• —Preprocessing: drop_duplicates() reduces 2,280,090 → 1,584,259 records
• —Split: train_test_split(test_size=0.1, random_state=0, stratify=label)
• —Comparable to FWIW evaluation protocol (Susskind et al., 2023)

Baseline Results

Labels

• —Binary (label): 0 = Normal, 1 = Attack
• —Multi-class (attack_cat): Normal, Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, Worms

Class Distribution

Standard split (train):

• —Normal: 56,000 (32%) | Attack: 119,341 (68%)

Random split (after dedup):

• —Normal: 1,523,904 (96%) | Attack: 60,355 (4%)

Features

Both configs include flow-level network features:

The random config additionally includes: srcip, dstip, sport, dsport, Stime, Ltime.

Citation

If you use this dataset, please cite the original UNSW-NB15 paper:

@inproceedings{moustafa2015unswnb15,
  title={UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems},
  author={Moustafa, Nour and Slay, Jill},
  booktitle={Military Communications and Information Systems Conference (MilCIS)},
  year={2015},
  organization={IEEE}
}

License

The original UNSW-NB15 dataset is provided under CC BY 4.0 by the University of New South Wales. This reformatted version preserves the original license.