This paper presents a comprehensive survey of datasets used for intrusion detection in communication networks, examining 124 datasets and characterizing each across 20 key dimensions, such as attack diversity, temporal coverage, data formats, and availability. We systematically analyze how these datasets support research on intrusion detection systems (IDS) in networking environments by reviewing detection approaches, machine and deep learning models, feature selection techniques, traffic analysis tools, and performance metrics. Beyond descriptive comparison, the survey analyzes datasets according to their application domains, readiness for modern AI-driven IDS architectures, realism, quality and benchmarking risks, and sustainability and reproducibility. Our in-depth comparative analysis reveals critical gaps—such as limited real-world traffic representation, inconsistent documentation, dataset bias, evaluation risks, and underrepresentation of emerging attack vectors—and provides actionable recommendations for dataset standardization, high-fidelity data collection, improved labeling, quantitative dataset assessment, and privacy-preserving sharing. Furthermore, we introduce SHIELD, a continuously evolving online repository that supports centralized dataset discovery, comparison, and selection. This survey aims to guide researchers in selecting appropriate datasets for evaluating IDS in communication networks and to inform future efforts toward more realistic, scalable, reliable, and reproducible intrusion detection research.
Wasia Ashraf, F. Masoodi· Discover Computing· 0 citations
The Internet of Things (IoT) devices have grown at a very fast rate, which has led to escalated security threats. Most of the current IoT oriented lightweight intrusion detection systems do not maintain a high rate of detection performance with heterogeneous and imbalanced traffic, or the expense of increased computation and memory occurs with high detection rate. To resolve this problem, this paper presents a resource efficient IoT attack detection framework called BGL-RID (Boruta-Greedy LightGBM Resource-Efficient IoT Detection). The framework applies a hybrid feature selection pipeline that integrates both Boruta and Greedy Forward Selection (GFS) to remove unnecessary features and only include the most useful features in the pipeline. The Synthetic Minority Oversampling Technique (SMOTE) is used to deal with the issue of class imbalance. Performance is measured based on accuracy and efficiency ratio, which indicates efficiency between quality of detection and resource consumption. The performance of the proposed BGL-RID model has been tested on benchmark, edge collected and IoT specific datasets namely TONIoT, proxy-labeled Raspberry Pi, CICIDS2018, and CICIoT2023. Experimental results demonstrate strong performance across these datasets. For binary and multiclass classifications, BGL-RID attained 99.72% and 98.94% accuracy on TONIoT dataset respectively. It also attained 99.91%, 99.94%, and 98.88% accuracy on the Raspberry Pi, CICIDS2018, and the IoT-specific CICIoT2023 datasets respectively. Besides having high detection rates, the model also achieves the highest efficiency ratio across different datasets, showing that it is robust and scalable, with minimal computation and memory requirements, suggesting its potential suitability for resource-constrained IoT applications.
Mohd Zain Khan, Mahfooz Alam, Irfan Alam et al.· Scientific Reports· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
