---
title: NSL-KDD Dataset Benchmark
url: https://www.emergentmind.com/topics/nsl-kdd-dataset
type: topic
---

# NSL-KDD Dataset Benchmark

NSL-KDD is a benchmark dataset for network intrusion detection that was introduced as a cleaned, de-biased successor to KDD’99. It preserves the KDD connection-level feature design and attack taxonomy while removing duplicate records and re-sampling examples to reduce the performance inflation caused by frequent repetitions. In the literature it is used for both binary intrusion detection and multiclass attack classification, typically on the canonical KDDTrain+ and KDDTest+ partitions and, in many studies, the harder KDDTest-21 subset [1509.08239][1912.13204][2209.05579].

## 1. Origin, rationale, and relation to KDD’99

NSL-KDD is consistently described as a refined version of the KDD’99 intrusion-detection benchmark. The underlying lineage traces to the DARPA 1998 evaluation program: nine weeks of raw TCP-dump data from a simulated Air Force LAN were labeled as “normal” or “attack,” and the resulting corpus was later used to construct KDD’99. NSL-KDD was introduced by Tavallaee et al. in 2009 to correct biases in KDD’99, remove duplicate records, and provide a more balanced and representative training and testing set for intrusion-detection research [1509.08239].

The redesign addressed a specific pathology of KDD’99: exact duplicates and very frequent records made memorization unduly effective. One study summarizes KDD’99 as containing roughly 4.9 million training records with about 78% redundancy, whereas NSL-KDD removes duplicate and redundant records so that classifiers are neither over-fit nor over-tested on repeated examples [2003.08585]. Another quantifies the reduction on the KDDCup99 10% training subset: 494,021 records in the original subset versus 125,973 in NSL-KDD, implying removal of 368,048 duplicate and “easy-to-classify” records, or approximately 74% of that subset [1912.13204].

This redesign had methodological consequences. A comparative study reports that classifiers trained on NSL-KDD were on average 20.18% less accurate than classifiers trained on KDDCup99, attributing the gap to KDDCup99’s redundancy bias [1912.13204]. That result is often interpreted as evidence that NSL-KDD is not “easier,” but more stringent.

## 2. Dataset partitions, labels, and attack inventories

The standard NSL-KDD organization revolves around KDDTrain+ and KDDTest+, with KDDTest-21 used in many studies as a difficult subset stressing generalization to harder or novel attacks. The stable split sizes reported across the supplied literature are summarized below.

| Split | Records | Characterization |
|---|---:|---|
| KDDTrain+ | 125,973 | Standard training split |
| KDDTest+ | 22,544 | Standard test split |
| KDDTest-21 | 11,850 | Hard test subset |

In binary form, KDDTrain+ contains 67,343 normal and 58,630 attack records, while one summary of KDDTest+ reports 9,711 normal and 12,833 attack records; KDDTest-21 is reported as 2,152 normal and 9,698 attack records, with 32.8% novel attacks [1909.02352]. In the five-class formulation, the high-level labels are Normal, DoS, Probe, R2L, and U2R. A commonly reported training distribution is Normal 67,343, DoS 45,927, Probe 11,656, R2L 995, and U2R 52 [1912.13204][2512.03200].

NSL-KDD is also used to study generalization beyond the attack types present in training. One transfer-learning study states that KDDTrain+ contains 22 distinct attack categories, while KDDTest+ contains all of those plus 17 additional categories; those extra 17 are treated as the novel attacks emphasized by KDDTest-21 [1909.02352]. A later multiclass study instead describes the five macro-classes as grouping 40 subtypes of attack [2512.03200]. Across these descriptions, the stable point is the same: NSL-KDD preserves a coarse five-class taxonomy while supporting finer-grained attack inventories whose train/test overlap is intentionally imperfect.

## 3. Feature schema and preprocessing conventions

Across the cited studies, NSL-KDD is described either as 41 traffic features plus a label or as 42 attributes when the class field or a meta field is counted [2003.08585][2509.09564]. The predictors are usually grouped into basic connection features, content features, and traffic-based features. One common enumeration is 9 basic, 10 content, and 22 traffic-based attributes [1509.08239]. Another describes 9 basic, 19 traffic, and 13 content features [2108.08394]. The three categorical fields that appear consistently are `protocol_type`, `service`, and `flag`; the remaining fields are treated as numeric or Boolean depending on the preprocessing scheme [1509.08239][2602.19785].

There is no single canonical preprocessing pipeline. Some studies one-hot encode the three categorical variables and rescale numeric variables to obtain 122 numerical dimensions; one 2025 multiclass study applies One-Hot Encoding to `protocol_type`, `service`, and `flag`, producing 122 dimensions, and uses min-max normalization over Train+ with the same transform applied to Test+ [2512.03200]. A transfer-learning study merges NSL-KDD with UNSW-NB15 feature conventions, one-hot encodes categorical fields, standardizes all features to zero mean and unit variance, and obtains a 113-dimensional numerical vector reshaped to `(batch_size, 113, 1)` for 1D convolution [1909.02352]. Other works use LabelCount encoding for the categorical fields with z-score standardization [2108.08394], Weka’s internal nominal handling without explicit one-hot expansion [2003.08585], or L2 normalization after one-hot encoding [1912.13204].

Some papers also drop the `difficulty` field before modeling [2512.03200][2602.19785]. Hyperdimensional-computing studies diverge further by avoiding conventional real-valued normalization and instead quantizing each feature into bins before binding it to a high-dimensional hypervector [2503.03031][2503.03037]. A plausible implication is that published NSL-KDD results are materially preprocessing-dependent, even when the nominal train/test split is identical.

## 4. Evaluation protocols and characteristic benchmark behavior

NSL-KDD supports several evaluation regimes: binary normal-versus-attack detection, direct five-class prediction, hierarchical pipelines in which binary detection precedes attack-type classification, one-class anomaly detection trained on normal traffic only, and attack-family-specific studies such as DoS-only screening [2108.08394][2210.10232][2602.19785]. The most common metrics are accuracy, precision, recall, \(F_1\), and false positive rate. In multiclass notation, one study defines
$$
\mathrm{Accuracy} = \frac{\sum_i TP_i}{N}, \qquad
\mathrm{Precision}_i = \frac{TP_i}{TP_i + FP_i}, \qquad
\mathrm{Recall}_i = \frac{TP_i}{TP_i + FN_i},
$$
and
$$
F1_i = 2 \cdot \frac{\mathrm{Precision}_i \cdot \mathrm{Recall}_i}{\mathrm{Precision}_i + \mathrm{Recall}_i},
$$
while binary studies additionally report
$$
\mathrm{FPR} = \frac{FP}{FP + TN}.
$$
These definitions recur with only notational variation across the corpus [2512.03200][2209.05579].

A characteristic property of NSL-KDD is that apparently strong detection rates can coexist with unfavorable false-positive behavior, especially on the hard split. In a two-stage transfer-learning ConvNet, the baseline ConvNet on KDDTest+ achieved DR 78.35, ACC 84.62, and FPR 7.11, whereas the transfer-learning variant achieved DR 93.86, ACC 87.30, and FPR 21.38. On KDDTest-21, the same comparison was DR 54.36, ACC 59.92, FPR 15.06 for the baseline versus DR 99.82, ACC 81.94, FPR 98.65 for the transfer-learning model [1909.02352]. The paper attributes the FPR inflation to attack-heavy test distributions and to the dataset’s skew, and explicitly warns against interpreting high detection rates in isolation.

Other studies use NSL-KDD to emphasize different methodological points. A Weka stacking model combining Decision Tree and Random Forest reported TP rate 0.852, FP rate 0.134, Precision 0.862, Recall 0.852, and F-measure 0.852 on NSL-KDD [2003.08585]. A hierarchical system found that an autoencoder outperformed several supervised baselines in the binary stage with 87.5% accuracy and \(F_1 = 0.8848\), while SVM-SMOTE raised macro-\(F_1\) in the four-class stage from 0.6089 to 0.7020 and U2R \(F_1\) from 0.2075 to 0.5741 [2108.08394]. These results illustrate why NSL-KDD is frequently used not merely as a scoreboard, but as a controlled environment for studying class imbalance, novelty, and hierarchical decision design.

## 5. Strengths, limitations, and recurring misconceptions

The principal strength of NSL-KDD is methodological: by removing duplicates and reducing the dominance of very frequent records, it yields more conservative and more comparable performance estimates than KDD’99 [2003.08585][1912.13204]. Its fixed train/test split, manageable size, and stable feature schema have made it a de-facto academic benchmark for intrusion-detection research [2209.05579][2410.21873].

Its limitations are equally well documented. Multiple papers describe NSL-KDD as synthetic, unevenly distributed, and outdated. One study notes that it “lacks public network data” and does not fully capture diversified traffic patterns, encryption, and application-level subtleties; another is more specific, stating that it includes no SSL/TLS flows, no modern botnet-style command-and-control, and limited payload inspection [2003.08585]. Later work adds that it does not include modern attacks such as APTs and that its static structure cannot capture contemporary traffic variation [2512.03200][2209.05579].

Class imbalance remains a central difficulty. In the standard five-class training split, R2L and U2R are minority classes by a wide margin, with 995 and 52 examples respectively [1912.13204][2512.03200]. Several papers identify these classes as the main source of weak recall and unstable multiclass performance, motivating oversampling, cost-sensitive learning, or two-stage designs [2108.08394][2512.03200]. Another recurrent misconception concerns the benign class: it is often treated as a single homogeneous category, yet an unsupervised study clustered the 77,054 benign records into 3 stable HDBSCAN clusters, with proportions 61.2%, 31.5%, and 7.3%, plus approximately 2% noise [2509.09564]. However, splitting benign traffic into three labels did not improve a Random Forest classifier’s overall accuracy, which remained 72.1% before clustering, after clustering, and after re-joining predictions [2509.09564]. This indicates that benign heterogeneity is real, but explicit benign relabeling does not automatically translate into better intrusion classification.

## 6. Benchmark role in contemporary research

NSL-KDD remains a common substrate for comparing classical ML, deep learning, spiking models, hyperdimensional computing, and unsupervised anomaly detection. Reported uses range from information-gain feature filtering and stacked ensembles in Weka [2003.08585], to transfer learning across UNSW-NB15 and NSL-KDD [1909.02352], to hierarchical autoencoder-plus-DNN systems with SVM-SMOTE [2108.08394], to GRU-CNN hybrids, spiking neural networks, and \(\beta\)-VAEs [2410.21873][2010.07803][2602.19785].

The reported headline numbers span a wide range because the tasks differ. A hyperdimensional-computing anomaly detector reported 91.55% accuracy on KDDTrain+, 86.21% on KDDTest+, and 81.75% on KDDTest-21 [2503.03031]. A multiclass HDC classifier reported 99.54% overall accuracy [2503.03037]. A spiking neural network with resampled 312-dimensional encoding reported 0.9931 for accuracy, \(F_1\), precision, and recall on KDDTest+ [2010.07803]. SCGNet reported 99.76% binary detection accuracy and 98.92% multiclass accuracy on NSL-KDD [2410.21873]. In unsupervised form, a \(\beta\)-VAE achieved best binary AUROC of 97.90% for latent-space distance scoring and 96.78% for reconstruction-error scoring [2602.19785]. Data augmentation studies have also used NSL-KDD to investigate minority-class synthesis: one GAN-based pipeline reported XGBoost accuracy rising from 99.53% to 99.78%, with the rare `nmap` class recall increasing from 0.7480 to 0.9906 [2312.10669].

The persistence of NSL-KDD in recent work does not imply that it is sufficient as a standalone proxy for operational deployment. The recurrent recommendation across the supplied literature is to complement it with more recent datasets such as UNSW-NB15, CICIDS2017, or CSE-CIC-IDS2018, and to use class-balancing, cost-sensitive, or deep representation-learning methods when the objective is robust detection of minority or previously unseen attacks [2003.08585][2410.21873][2512.03200]. This suggests that NSL-KDD is most valuable as a controlled benchmark for methodological comparison, ablation, and reproducibility, rather than as a complete model of present-day network traffic.

Source: https://www.emergentmind.com/topics/nsl-kdd-dataset