http://nsl.cs.unb.ca/NSL-KDD/

Dear Kaushal Kumar and so am computation science professor at the Anhembi Morumbi University in Brazil and I am researching detection of intrusion with KNN and kmeans algorithms. I'm looking for NSL-KDD dataset to perform an experiment. I realized that also are searching for. Managed to find an alternative link to the dataset? If you did could send me, please? The address http://nsl.cs.unb.ca/NSL-KDD/ is no longer available.

Respected sir,

                        give me your mail ID i will mail you NSL kDD data set.

Ok. Thanks... My e-mail is [email protected]  or other [email protected], please send to two e-mail. 

Thanks...

Kaushal Kumar sir

Please sir mail me NSL KDD data set

Mail: [email protected]

Hi guys,

  I think that this link (http://www.shubhamsaini.com/datasets.html) have the dataset. But I'm not sure.

Good luck,

Daniel

Dear Kaushal Kumar,

Could you send the link for the NSL KDD dataset to my mail address: [email protected]

Regard

Dear Dr Kaushal Kumar, 

Can you please send me the NSL kdd dataset to my email? [email protected]. Your help is much appreciated.

check this link:

https://web.archive.org/web/20150205070216/http://nsl.cs.unb.ca/NSL-KDD/

Thanks Yasmen Essam. 

Thanks Yasmen Essam. 

U r welcome 

Hi 

for those who need the NSL-KDD Dataset, please check the link below:

https://github.com/defcom17/NSL_KDD

Regards

Hi,

The new website of all six datasets are ready now:

http://www.unb.ca/research/iscx/dataset/iscx-NSL-KDD-dataset.html

Regards

Great news. Thanks arash

Great!

Thanks for that.

I've been trying to get hold of this data for a little while now.

I have download NSL-KDD dataset (train + test) I apply J48 on KDD 20% data set which contain 42 attributes one of the attribute is class (normal & anomaly) when I apply j48 it not gives me attack category (Dos, U2R,R2L, prob). It only gives me anomaly and normal categories. Can you helps me on how can I get category wise output. Just like I attach another snap of paper where author get proper result with the same dataset.

How use NSL-LKDD dataset for ATTACK(R2L,Prob,U2R,DOS) using WEKA? -  

Hi Folks,

Pls find our new IDS dataset, inluded must of the up-to-dated attacks (PCAP) along with labelled flows covering more than 80 features (CSV) here:

http://www.unb.ca/cic/datasets/ids-2017.html

Also, let me know your suggestions for other datasets that can be usefule for researchers and producers in this domain.

Best,

Arash

Thanks for sharing.I will go through the data sets

Regards

Dear Arash Habibi Lashkari, i am a computation science postgraduate student at Southeast University in China and I am researching detection of intrusion. I'm looking for NSL-KDD dataset and ids-2017 dataset to perform an experiment.Could you sent this two datasets to my email, please? My email: [email protected] or [email protected]

Dear Arash Habibi Lashkari, i am doctoral student at Sriwijaya University in Indonesia. My research in the field of intruder detection system. And I want to try my model using IDS-2017. Could you Please email me ids-2017 datasheet. My email: [email protected].

NSL-KDD dataset :

Traditionally, most of the research work conducted on the field of intrusion detection utilized the popular benchmark dataset KDD99, which has a huge size and includes many duplicate and redundant records. The large size of the data set causes the classification task to be long and exhausting. Consequently, the researchers in general select a small portion of the training and testing data set for their experiments. The very high number of redundant records makes the classification task be biased toward the frequent samples. The detection for smaller classes i.e. U2R and R2L, which are more harmful attacks, will not be efficient enough. Moreover, the existence of these redundant records in the test set will also cause the evaluation results to be biased by the algorithms which have better detection rates on frequent samples. In this study, we used the NSL-KDD data set which is the refined version of KDDcup99 and has eliminated some of the drawbacks of that dataset. It has the following advantages :

1. There are no redundant records in the training set, so the bias toward more frequent records will not happen during the learning process.

2. There are no duplicate records in the new test set, so the evaluation of the learners will not be biased by the methods which have higher detection accuracy for the frequent records.

3. The number of selected records from each difficulty level group is inversely proportional to the percentage of records in the original KDD data set. As a result, the classification rates of distinct machine learning methods vary in a wider range, which makes it more efficient to have an accurate evaluation of different learning techniques.

4. The number of records in the train and test sets are reasonable, which makes it affordable to run the experiments on the complete set without the need to randomly select a small portion. Consequently, evaluation results of different research works will be consistent and comparable.

Each NSL-KDD record is related to a network connection and consists of 41 features (The feature vector consists of three categorical values; five symbolic values and the rest of them are continuous values) related to the connection characteristics of the network traffics. Also, those records are labeled as normal or one of the specific attack names. All attacks fall into four major categories: (1) DOS (Denial of Service) are attacks that aim to making a service or a resource unavailable by depleting the victim’s resources, thereby making it unable to handle legitimate requests e.g. syn flooding. (2) U2R (User to Root) where an

attacker uses a normal account to login into a victim system and tries to gain root/administrator privileges by exploiting some vulnerability in the victim e.g. buffer overflow attacks. (3) R2L (Remote to Local) where attacker attempts to gain access (account) locally on a remote machine accessible via the network by exploiting some vulnerability of the victim machine e.g. password guessing. (4) PROBE, which represents any attempt to collect information about the network, the users or the security policy in order to avoid security tools or discover known vulnerability e.g. port scanning. The NSL-KDD dataset comes essentially with two training set and one test set which contains DoS, Probe, U2R, R2L attack classes beside normal label .

Dataset of NSL-KDD University of new Brunswick:

https://www.unb.ca/cic/datasets/nsl.html