Using UDPFlowLyzer and QUICFlowLyzer, the dataset provides a realistic cloud-based benchmark for UDP and QUIC intrusion detection research, specifically designed to analyze volumetric and application-specific UDP DDoS attacks in enterprise environments. The dataset combines realistic, benign organizational activities with multiple UDP attack campaigns executed over a multi-tier cloud infrastructure and captured through packet-level monitoring and bidirectional flow reconstruction. A major advantage of the dataset is its integration of both UDP and QUIC traffic, UDP- and QUIC-based communications. The dataset contains more than 1.22 million flow records, including 826,953 UDP flows and 395,725 QUIC flows, with over 442 extracted features capturing temporal, statistical, directional, and protocol-aware network behaviors. It includes realistic benign, suspicious, and multi-class attack traffic generated by VSE, OVH, HULK, MULTI, RAW, GAME, and bypass variants. Additional strengths include auditable labeling pipelines, timestamp normalization, deterministic flow generation, realistic benign user profiling using BUP, support for low-FPR evaluation through diverse benign traffic, and publicly reproducible CSV generation from raw PCAP traces.
The full research paper outlining the details of the dataset and its underlying principles:
"Unveiling Hierarchical Machine Learning UDP–QUIC Intrusion Detection: Protocol-Aware Flow Analysis and a New Generated DDoS Dataset", Sepehr Jafari, Mohammad Moein Shafi, and Arash Habibi Lashkari, International Conference on Security and Cryptography (SECRYPT) 2026, Portugal.
Download Dataset:
