Overview
The CESNET-TimeSeries24 dataset [1] captures comprehensive network traffic data from the ISP network CESNET3. The dataset offers multivariate time series created through traffic aggregation at three distinct temporal intervals, providing a robust foundation for network traffic forecasting, anomaly detection, and deep learning model evaluation.
Dataset Metadata
| Property | Value |
|---|---|
| Type | Original dataset |
| Category | Time Series |
| Source Network | CESNET3 ISP |
| Time Span | 40 weeks (October 2023 – July 2024) |
| Aggregation Intervals | 10 minutes, 1 hour, 1 day |
| Hierarchical Levels | Overall network, 283 institutions, 548 subnets, 270,000+ IP addresses |
Supported Tasks
- Network Traffic Forecasting
- Anomaly Detection
- Representation Learning
- Device Type Classification
Dataset Structure
Temporal Granularity
The dataset provides multivariate time series at three aggregation levels:
| Interval | Original Capture | Adapted Metrics | Use Cases |
|---|---|---|---|
| 10 minutes | Yes | Direct metrics | Fine-grained analysis, short-term forecasting |
| 1 hour | Derived | Sum, average, std dev | Medium-term patterns, hourly trends |
| 1 day | Derived | Sum, average, std dev | Long-term trends, daily patterns |
Note: The original capture interval was 10 minutes. For the 1-hour and 1-day series, metrics representing unique values were adapted using sum, average, and standard deviation statistics to enhance temporal granularity.
Hierarchical Coverage
The dataset’s extensive hierarchical structure enables multi-level analysis:
| Level | Count | Research Applications |
|---|---|---|
| Overall Network | 1 | Network-wide trend analysis |
| Institutions | 283 | Institutional behavior patterns |
| Institutional Subnets | 548 | Subnet-level traffic analysis |
| Individual IP Addresses | 270,000+ | Device-level behavior classification |
This hierarchical organization provides a robust basis for comparative analysis of deep learning models, enabling researchers to benchmark forecasting performance across multiple network levels.
Device Type Labels
The CESNET-TimeSeries24 dataset includes Device Type labels for a subset of time series, enabling device classification based on time-series behavior.
Label Hierarchy
Labels are organized in two levels:
| Level | Description | Classes |
|---|---|---|
| Group | Coarse-grained categorization | server, net-device, end-device |
| Group Class | Fine-grained categorization | Web server, DNS server, router, switch, etc. |
Example: The group server contains more specific classes such as web-server and dns-server.
Research Applications
The 40-week temporal span and hierarchical structure make CESNET-TimeSeries24 ideal for:
- Model Scalability Testing: Evaluate how models perform across different network scales
- Adaptability Assessment: Test model performance across diverse traffic patterns
- Long-term Trend Analysis: Study seasonal patterns and temporal evolution
- Fine-grained Behavior Analysis: Examine fluctuations at multiple time scales
- Hierarchical Forecasting: Compare performance across network hierarchy levels
How to Cite
@article{koumar2025cesnet,
title={CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting},
author={Koumar, Josef and Hynek, Karel and {\v{C}}ejka, Tom{\'a}{\v{s}} and {\v{S}}i{\v{s}}ka, Pavel},
journal={Scientific Data},
volume={12},
number={1},
pages={338},
year={2025},
publisher={Nature Publishing Group UK London}
}
Download
[1] Koumar, J., Hynek, K., Čejka, T., & Šiška, P. (2024). CESNET-TimeSeries24: Time Series Dataset for Network Traffic Anomaly Detection and Forecasting [Data set]. Zenodo.
DOI: 10.5281/zenodo.13382427