CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection

Abstract

Forecast-based models are fundamental to network traffic management and anomaly detection. However, it is essential to evaluate these forecasting models over extended periods of time in order to assess their adaptability to unexpected phenomena and shifts in underlying patterns. This kind of long-term evaluation requires multi-year data to account for yearly seasonality and behavioral drift. Existing public datasets are too short to support such long-horizon forecasting tasks. We introduce CESNET-TimeSeries26, comprising 995 days of continuous traffic time series from the CESNET3 network, together with a single subnet spanning approximately 4.5 years. The dataset captures 278,466 IP addresses, 285 institutions, and 566 institutional subnets at three aggregation intervals. The dataset provides a definitive longitudinal benchmark for evaluating forecasting models in both operational management and security monitoring. We demonstrate that annual seasonality is the dominant periodic component. Moreover, we show that a forecasting model can exploit the annual component only when its training window covers at least one complete annual cycle, which no sub-year dataset provides.