Evaluating Flow-Based NAT Detection Models Beyond Controlled Environments
Authors/Creators
-
1.
Czech Technical University in Prague
- 2. CESNET
-
3.
CESNET, zájmové sdružení právnických osob
Description
Dataset asociated wtih the reserach paper "Evaluating Flow-Based NAT Detection Models Beyond Controlled Environments", presented at the 2026 International Conference on Smart and Sustainable Technologies (SpliTech 2026)
This dataset contains network flow records collected from traffic observed on the CESNET3 academic network. The data were captured in November 2025 and annotated to support research on Network Address Translation (NAT) detection from flow-level statistics.
Two datasets are included. The first dataset (D2) was annotated manually using prior knowledge of devices present in the monitored network. In total, 236,976 devices were identified, including 106,586 NAT devices and 159,169 regular servers or end devices.
The second dataset (Dp) was extracted from broader monitoring data captured by CESNET3 probes and annotated using the DAF framework, a tool designed for operating system and device-type identification that can also detect NAT devices using multiple information sources (e.g., DNS, TLS, QUIC, HTTP). This dataset contains 902 devices positively identified as NAT devices, providing additional samples for experiments involving heterogeneous network traffic.
The datasets are intended for research on flow-based NAT detection, feature engineering, and machine learning model evaluation across different network environments.
Data Anonymization Statement:
Both datasets were anonymized before publication. Source and destination IP addresses were replaced with consistent placeholder identifiers to preserve flow relationships while preventing re-identification. The datasets do not contain personally identifiable information (PII) or sensitive user data.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
If you will be so kind, please cite our paper, instead of the repository itself:
F. Chodura, M. Hulák and T. Čejka, "Evaluating Flow-Based NAT Detection Models Beyond Controlled Environments." 2026 11th International Conference on Smart and Sustainable Technologies (SpliTech), Split and Bol, Croatia, 2026, doi: 10.23919/SpliTech70133.2026.11685456.
@INPROCEEDINGS{11685456,
author={Chodura, Filip and Hulák, Matej and Čejka, Tomáš},
booktitle={2026 11th International Conference on Smart and Sustainable Technologies (SpliTech)},
title={Evaluating Flow-Based NAT Detection Models Beyond Controlled Environments},
year={2026},
doi={10.23919/SpliTech70133.2026.11685456}}
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
If you have any question, feel free to contact us: matej.hulak@fit.cvut.cz
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Files contents:
D2.csv - 39,217,026 bidirectional flows captured from real traffic in CESNET 3 DST_IP -- Anonymized Destination IP address SRC_IP -- Anonymized Source IP address BYTES -- Bytes sent in forward direction BYTES_REV -- Bytes sent in reverse direction TCP_OPT -- TCP options field in forward direction TCP_OPT_REV -- TCP options field in reverse direction LINK_BIT_FIELD -- Link-layer bit field flags TIME_FIRST -- Timestamp of first packet in flow TIME_LAST -- Timestamp of last packet in flow TCP_MSS -- TCP Maximum Segment Size (forward) TCP_MSS_REV -- TCP Maximum Segment Size (reverse) NTS_AVERAGE_DISPERSION -- Network Time Series: average dispersion of inter-arrival times NTS_KURTOSIS -- Network Time Series: kurtosis of packet timing distribution NTS_MAX_DIFFTIMES -- Network Time Series: maximum inter-packet time difference NTS_MEAN -- Network Time Series: mean value of time series NTS_MEAN_DIFFTIMES -- Network Time Series: mean inter-packet time difference NTS_MEAN_SCALED_TIME -- Network Time Series: mean of scaled time values NTS_MIN_DIFFTIMES -- Network Time Series: minimum inter-packet time difference NTS_ROOT_MEAN_SQUARE -- Network Time Series: RMS of time series values NTS_STDEV -- Network Time Series: standard deviation of time series NTS_SWITCHING_RATIO -- Network Time Series: ratio of direction switches in traffic NTS_TIME_DISTRIBUTION -- Network Time Series: statistical distribution of packet times PACKETS -- Packet count in forward direction PACKETS_REV -- Packet count in reverse direction DST_PORT -- Destination port number TCP_SYN_SIZE -- Size of TCP SYN packet TCP_WIN -- TCP window size (forward) TCP_WIN_REV -- TCP window size (reverse) NTS_MAX -- Network Time Series: maximum value NTS_MIN -- Network Time Series: minimum value SRC_PORT -- Source port number DIR_BIT_FIELD -- Direction bit field (flow directionality flags) FLOW_END_REASON -- Reason the flow record ended IP_FLAGS -- IP header flags (forward) IP_FLAGS_REV -- IP header flags (reverse) PROTOCOL -- Transport protocol number (e.g., 6=TCP, 17=UDP) TCP_FLAGS -- TCP control flags (SYN, ACK, FIN, RST, etc.) TOS -- Type of Service field IP_TTL -- IP Time To Live (forward) IP_TTL_REV -- IP Time To Live (reverse) FLOW_INTERVAL -- Duration/interval of the flow IS_NAT -- NAT role Dp.csv - 21,105,037 bidirectional flows of NAT detected by DAF captured from real traffic in CESNET 3 DST_IP -- Anonymized Destination IP address SRC_IP -- Anonymized Source IP address BYTES -- Bytes sent in forward direction BYTES_REV -- Bytes sent in reverse direction TCP_OPT -- TCP options field in forward direction TCP_OPT_REV -- TCP options field in reverse direction LINK_BIT_FIELD -- Link-layer bit field flags TIME_FIRST -- Timestamp of first packet in flow TIME_LAST -- Timestamp of last packet in flow TCP_MSS -- TCP Maximum Segment Size (forward) TCP_MSS_REV -- TCP Maximum Segment Size (reverse) NTS_AVERAGE_DISPERSION -- Network Time Series: average dispersion of inter-arrival times NTS_KURTOSIS -- Network Time Series: kurtosis of packet timing distribution NTS_MAX_DIFFTIMES -- Network Time Series: maximum inter-packet time difference NTS_MEAN -- Network Time Series: mean value of time series NTS_MEAN_DIFFTIMES -- Network Time Series: mean inter-packet time difference NTS_MEAN_SCALED_TIME -- Network Time Series: mean of scaled time values NTS_MIN_DIFFTIMES -- Network Time Series: minimum inter-packet time difference NTS_ROOT_MEAN_SQUARE -- Network Time Series: RMS of time series values NTS_STDEV -- Network Time Series: standard deviation of time series NTS_SWITCHING_RATIO -- Network Time Series: ratio of direction switches in traffic NTS_TIME_DISTRIBUTION -- Network Time Series: statistical distribution of packet times PACKETS -- Packet count in forward direction PACKETS_REV -- Packet count in reverse direction DST_PORT -- Destination port number TCP_SYN_SIZE -- Size of TCP SYN packet TCP_WIN -- TCP window size (forward) TCP_WIN_REV -- TCP window size (reverse) NTS_MAX -- Network Time Series: maximum value NTS_MIN -- Network Time Series: minimum value SRC_PORT -- Source port number DIR_BIT_FIELD -- Direction bit field (flow directionality flags) FLOW_END_REASON -- Reason the flow record ended IP_FLAGS -- IP header flags (forward) IP_FLAGS_REV -- IP header flags (reverse) PROTOCOL -- Transport protocol number (e.g., 6=TCP, 17=UDP) TCP_FLAGS -- TCP control flags (SYN, ACK, FIN, RST, etc.) TOS -- Type of Service field IP_TTL -- IP Time To Live (forward) IP_TTL_REV -- IP Time To Live (reverse) IS_NAT -- NAT role FLOW_INTERVAL -- Duration/interval of the flow