Comparison of the NSL-KDD dataset and its predecessor the KDD Cup ’99 dataset

Abstract

This study examines three datasets, notably the KDD Cup '99 and the NSL-KDD datasets, which are commonly used in intrusion detection research in computer networks. The KDD Cup '99 dataset contains five million records, each with 41 attributes that may be used to categorize malicious assaults into four categories: Probe, DoS, U2R, and R2L. Because it was developed by simulation over a virtual computer network, the KDD Cup '99 dataset cannot reflect real traffic statistics. Duplicate and redundant records from the KDD Cup '99 dataset are eliminated from the training and test sets, respectively, in the NSL-KDD dataset.