The Orion 2026 is a novel benchmark dataset generated within a network environment utilizing a Spine-Leaf topology. Modern cybersecurity relies on Network Intrusion Detection Systems powered by Machine and Deep Learning to identify threats. The development of robust detection models is often hindered by the limitations of existing benchmark datasets, which frequently suffer from traffic class imbalance, poor documentation, and pervasive mislabeling. The Orion 2026 incorporates 120 hours of traffic that mirrors real-world diurnal volume variations and includes single-source and distributed Denial-of-Service attack scenarios with varying attacker-victim cardinalities. Using a label-free exploratory analysis over the benign captures alone, 17 mutually non-redundant features were selected and validated by five detection models spanning the supervised and semi-supervised paradigms.

• Time Period: 5 days - 120 hours total
• Data Format: PCAP and CSV
• Total Packets: ~338 million packets
• Total Flows: ~25 million flows
• Recommended Features: 17 high-importance network features
• Attack Types: DoS and DDoS variants (PSH, UDP, ICMP, SYN, URG, RST, ACK, FIN)
• Network Topology: Spine-Leaf SDN architecture

• Day 1 (2025-11-03): Benign traffic only - 55.2M packets, 1.59M flows
• Day 2 (2025-11-04): Benign traffic only - 54.3M packets, 1.57M flows
• Day 3 (2025-11-05): Benign and DoS attacks (1-1) - 68.4M packets, 5.39M flows
• Day 4 (2025-11-06): Benign and DDoS attacks (N-1) - 79.8M packets, 6.59M flows
• Day 5 (2025-11-07): Benign and DDoS attacks (N-N) - 81.0M packets, 10.48M flows

Copyright © 2026 ORION Research Group, Universidade Estadual de Londrina (UEL), Londrina, PR, Brazil. The Orion 2026 dataset is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). When using this dataset, please cite the related paper (see below). For questions, please contact the Orion Research Group.

If you use the Orion 2026 dataset in your research, please cite the following paper:

@ARTICLE{11713422,
  author={Schiavon, Vinícius Ferreira and Nakanishi, Matheus Riki and Nishikawa, Gustavo Hideyuki Kitamura and Komarchesqui, Mateus and da Silva Ruffo, Vitor Gabriel and Fernando Carvalho, Luiz and Lemes Proença, Mario},
  journal={IEEE Access}, 
  title={Orion 2026: An IP Flow Dataset for Network Traffic Analysis and DDoS Intrusion Detection},
  year={2026},
  volume={14},
  number={},
  pages={150503-150517},
  keywords={Modeling;Fluid flow;Labeling;Distributed denial-of-service attack;Intrusion detection;IP networks;TCP;Computers;Software defined networking;Telecommunication traffic;Anomaly detection;benchmark dataset;deep learning;distributed denial-of-service;intrusion detection system},
  doi={10.1109/ACCESS.2026.3738009}}

Copy to Clipboard