CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting

TL;DR

This paper introduces CESNET-TimeSeries24, a comprehensive real-world network traffic dataset designed to improve the evaluation of forecasting-based anomaly detection methods, addressing the lack of such datasets in the field.

Contribution

It provides a large, authentic dataset from 40 weeks of network traffic, enabling better benchmarking and development of anomaly detection algorithms.

Findings

Dataset includes 40 weeks of network data from 275,000 IPs.

High variability in network behavior challenges forecasting models.

Facilitates practical evaluation of anomaly detection techniques.

Abstract

Anomaly detection in network traffic is crucial for maintaining the security of computer networks and identifying malicious activities. One of the primary approaches to anomaly detection are methods based on forecasting. Nevertheless, extensive real-world network datasets for forecasting and anomaly detection techniques are missing, potentially causing performance overestimation of anomaly detection algorithms. This manuscript addresses this gap by introducing a dataset comprising time series data of network entities' behavior, collected from the CESNET3 network. The dataset was created from 40 weeks of network traffic of 275 thousand active IP addresses. The ISP origin of the presented data ensures a high level of variability among network entities, which forms a unique and authentic challenge for forecasting and anomaly detection models. It provides valuable insights into the practical deployment of forecast-based anomaly detection approaches.