Security Datasets for Intrusion Detection and Prevention: A Structured Review and Dataset-Selection Framework

Abstract

Security datasets are central to the evaluation of intrusion detection and prevention systems, but their suitability differs substantially across domains, data sources, attack scenarios, labeling practices, and reproducibility conditions. This study presents a structured evidence-mapping review of security datasets reported in intrusion detection and prevention research between 2018 and 2025. The final evidence map includes 42 primary dataset-use publication records, 82 dataset or evidence-source mentions, and 69 unique datasets, corpora, or evidence sources after duplicate, retracted, and irrelevant records were removed. The review organizes datasets across network-based IDS, IPS, firewall, VPN, WAF, endpoint, email filtering, IAM, DDoS, Windows, Linux-Apache, NetFlow, cloud, and IoT/IIoT security settings. In addition to adoption-frequency analysis, the study assesses representative dataset families in terms of documentation, labeling information, feature representation, class balance, public availability, reproducibility, and practical usability limitations. The findings show that established benchmarks remain widely reused, but recent studies increasingly rely on domain-specific datasets for IoT/IIoT, DDoS, cloud, edge, host, and cyber-physical environments. The review also proposes and illustrates a dataset-selection framework that links dataset choice to security objectives, operational context, telemetry requirements, attack coverage, and evaluation protocol. The results support more transparent, context-aware, and reproducible dataset selection for intrusion detection and prevention research.