Labeled data sets are necessary to train and evaluate anomaly-based network
intrusion detection systems. This work provides a focused literature survey of
data sets for network-based intrusion detection and describes the underlying
packet- and flow-based network data in detail. The paper identifies 15
different properties to assess the suitability of individual data sets for
specific evaluation scenarios. These properties cover a wide range of criteria
and are grouped into five categories such as data volume or recording
environment for offering a structured search. Based on these properties, a
comprehensive overview of existing data sets is given. This overview also
highlights the peculiarities of each data set. Furthermore, this work briefly
touches upon other sources for network-based data such as traffic generators
and traffic repositories. Finally, we discuss our observations and provide some
recommendations for the use and creation of network-based data sets.

本文对网络入侵检测数据集进行了文献综述，详细描述了基于数据包和基于流的网络数据，并使用 15 个不同的属性，覆盖了数据量、录制环境等五个类别，提供了现有数据集的全面概述及其特点，并讨论了关于网络数据的其他来源，并为网络数据集的使用和创建提供了建议。