CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection

CESNET-TimeSeries26 is a large-scale network-traffic time-series dataset collected on the CESNET3 national research and education network. It contains per-entity time series for 278,466 IP addresses, 285 institutions and 566 institution subnets, each provided at three aggregation levels (10 minutes, 1 hour, 1 day), spanning 2023-10-09 to 2026-06-30 (996 days, ~2.7 years). A separate longitudinal part follows 135 IP addresses of a single subnet over 4.5 years (2021-12-31 to 2026-07-09).

The dataset is intended for research on network-traffic forecasting, anomaly and outage detection, seasonality and concept-drift analysis, and for benchmarking time-series methods on real, irregular, heavily gapped operational data. It extends the 40-week CESNET-TimeSeries24 collection to a multi-year span, enabling studies of annual seasonality, year-over-year drift, and model longevity.

Citation

Please cite the usage of our dataset as (final citation of the article will be added shortly):

Koumar, J., Hynek, K., Jeřábek, K., Šiška, P. CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection

@Article{cesnettimeseries24,
    author={Koumar, Josef and Hynek, Karel and Je{\v{r}}{\'a}bek, Kamil and {\v{S}}i{\v{s}}ka, Pavel},
    title={CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection},
    year={2026},
}

Ethical statement

Since the dataset originates from a production network used by real users, privacy was a fundamental concern throughout our work. We used exclusively automated data processing with immediate anonymization. Therefore, we did not analyze or manually process non-anonymized data at any point, nor did we perform any procedure that would allow us to track users or reveal their identities.

The publication of the dataset has been approved by the Committee for Ethics in Research of the Scientific Council of the Czech Technical University in Prague under reference number 0000-11/26/51902/EKČVUT. The approval includes a waiver of explicit user consent for publishing the dataset. Moreover, all users of the CESNET3 network agreed to terms and conditions that define a monitoring process for the optimization and improvement of services (including related research) and allow sharing of the data with third parties after anonymization https://www.cesnet.cz/en/gdpr.

Collection and aggregation

• Source: IP-flow monitoring of the CESNET3 network.
• Entities: individual IP addresses, plus aggregates per institution and per institution subnet.
• Aggregation levels: 10 minutes, 1 hour, 1 day.
• Time grid: shared per part and per level, given explicitly in times/times_<level>.csv as id_time,time. Series files reference id_time only; the mapping to wall-clock time is always the times table. The main grid has 140,636 ten-minute slots, 23,902 hourly slots and 996 daily slots.
• Sparsity: only slots in which the entity was actually observed are present. Files are therefore of very different lengths and most series are sparse — see Known properties.

File structure

See the included figure dataset_file_structure.png for the full directory layout. Each part is also provided as a .tar.gz archive; SHA-256 checksums for all archives are in SHA256SUMS.txt.

• ip_addresses_full/ — all 278,466 IP series. Because of the file count, the per-level directories are split into 12 numbered shards (agg_10_minutes/<1..12>/<id_ip>.csv). The shard for a given id_ip is listed in identifiers.csv.
• ip_addresses_sample/ — a uniform random sample of 1,000 IP series (flat directories, no shards).
• ip_addresses_sample_gaps_20_00/ … _100_80/ — five gap-stratified samples of 1,000 series each; see Sample subsets.
• institutions/, institution_subnets/ — aggregated series per institution (285) and per institution subnet (566).
• subnet_longitudinal/ — 135 IP series of a single subnet over 4.5 years, on its own longer time grid.

The size of the dataset

• ip_addresses_full.tar.gz — 435G (compressed 130G)
• ip_addresses_sample.tar.gz — 1.7G (compressed 507M)
• ip_addresses_sample_gaps_100_80.tar.gz — 683M (compressed 205M)
• ip_addresses_sample_gaps_80_60.tar.gz — 3.2G (compressed 945M)
• ip_addresses_sample_gaps_60_40.tar.gz — 5.2G (compressed 1.5G)
• ip_addresses_sample_gaps_40_20.tar.gz — 7.1G (compressed 2.0G)
• ip_addresses_sample_gaps_20_00.tar.gz — 9.6G (compressed 3.2G)
• institutions.tar.gz — 4.3G (compressed 1.6G)
• institution_subnets.tar.gz — 7.6G (compressed 2.7G)
• subnet_longitudinal.tar.gz — 722M (compressed 249M)

Columns

IP-level 10-minute files (ip_addresses_*):

id_time, n_flows, n_packets, n_bytes, n_dest_asn, n_dest_ports, n_dest_ip,
tcp_udp_ratio_packets, tcp_udp_ratio_bytes, dir_ratio_packets, dir_ratio_bytes,
avg_duration, avg_ttl

IP-level 1-hour and 1-day files, and all institution and institution-subnet files. The three destination-cardinality columns are expanded into sum / mean / standard deviation over the constituent 10-minute windows:

id_time, n_flows, n_packets, n_bytes,
sum_n_dest_asn, average_n_dest_asn, std_n_dest_asn,
sum_n_dest_ports, average_n_dest_ports, std_n_dest_ports,
sum_n_dest_ip, average_n_dest_ip, std_n_dest_ip,
tcp_udp_ratio_packets, tcp_udp_ratio_bytes, dir_ratio_packets, dir_ratio_bytes,
avg_duration, avg_ttl

subnet_longitudinal keeps the same column set at all three levels:

id_time, n_flows, n_packets, n_bytes, n_dest_ip, n_dest_asn, n_dest_port,
dir_ratio_packets, dir_ratio_bytes, avg_duration

Column meanings: n_flows, n_packets, n_bytes are volumetric counters; n_dest_asn, n_dest_ports, n_dest_ip are destination cardinalities; tcp_udp_ratio_* is the TCP share of TCP+UDP traffic (0–1); dir_ratio_* is the outbound share of total traffic (0–1); avg_duration is mean flow duration in seconds; avg_ttl is mean IP TTL. Numeric values are rounded to two decimal places.

Aggregation rule

The 1-hour and 1-day files are deterministic functions of the 10-minute content of the same series: volumetric counters are summed, destination cardinalities are given as sum, mean and standard deviation (sample standard deviation, ddof = 1; zero when a window contains a single 10-minute datapoint), and all ratio and average columns are unweighted means. Values are rounded to two decimals. The 10-minute files are sorted by id_time, so re-aggregating them reproduces the published coarser levels exactly, independently of row order.

Identifiers and relationships

• <part>/identifiers.csv — entity ids belonging to that part; for ip_addresses_full it also gives the shard (id_ip_folder).
• ids_relationship.csv — maps each of the 278,466 id_ip values to its id_institution and id_institution_subnet.

Entity ids are pseudonymous integers; no IP addresses, institution names or other identifying information are published.

Sample subsets

Besides the full IP set, six subsets of 1,000 series each are provided for work that does not need all 278,466 entities:

• ip_addresses_sample — uniform random sample, statistically indistinguishable from the full population with respect to data completeness.
• five gap-stratified subsets, selected by the fraction of missing 10-minute slots (gap ratio) computed against the nominal grid of 143,280 slots: gaps_20_00 = [0.00, 0.20], gaps_40_20 = (0.20, 0.40], gaps_60_40 = (0.40, 0.60], gaps_80_60 = (0.60, 0.80], gaps_100_80 = (0.80, 1.00]. Every member satisfies its band interval.

Subset files are byte-identical copies of the corresponding files in ip_addresses_full, so results obtained on a subset carry over unchanged.

Reference tables

• weekends_and_holidays.csv (515 rows) — Czech weekends and public holidays covering the collection period.
• school_terms_and_exams_periods.csv (19 rows) — approximate Czech academic terms and examination periods. Most monitored entities belong to universities, so these periods explain much of the annual structure. Summer recess is the gap between the end of the summer examination period and the start of the winter term.
• outages.csv (13 rows) — documented monitoring outages: 7 infrastructure-wide gaps in the main collection (the largest 2026-04-29 to 2026-05-15, ~15.9 days) and 6 subnet-local zero-traffic periods in the longitudinal part.
• europe_time_changes.csv (9 rows) — daylight-saving transitions in the collection period, with the direction and offset of each clock change.

Known properties and usage notes

These are properties of operational data, not defects; ignoring them leads to wrong conclusions.

• Most series are very sparse. The median series is present in roughly 5 % of 10-minute slots, 14 % of hourly slots and 58 % of daily slots. Coarser aggregation looks denser only because a window counts as present when any sub-window carries data. The aggregation level chosen for an experiment therefore determines how severe the sparsity appears.
• The time grid is not contiguous. The nominal grid would have 143,280 ten-minute slots; the published grid has 140,636, because network-wide outages (see outages.csv) are absent from the grid itself. Always resolve id_time through the times table rather than assuming a fixed step.
• Daylight saving. At each spring-forward transition, two source measurement windows fall on one grid slot; they are merged (counters summed, other columns averaged). At each autumn transition the local clock repeats an hour. Work in UTC, or use europe_time_changes.csv.
• A late-November-2023 onboarding step. About 34,700 series first appear on 2023-11-30, and network-wide active-address counts step up around 2023-11-25. This is a monitoring expansion, not a traffic change; it affects any trend fitted across that date.
• subnet_longitudinal is only partly consistent with the rest. It uses the IP id namespace (its ids overlap ip_addresses_full) but has its own, longer time grid, so its id_time values are not comparable with the main parts. Its 1-hour and 1-day files also do not correspond exactly to its own 10-minute files, and for at least one series it covers a longer period than the main tree. Use it for long-horizon analysis of that one subnet, not for cross-part comparison.

Suggested uses

• Forecasting on irregular, gapped operational time series (per-entity and aggregated).
• Annual and weekly seasonality, and calendar effects tied to the academic year.
• Concept drift and model longevity: how quickly a model trained on one period decays.
• Outage and anomaly detection, with documented ground-truth outages.
• Robustness studies across data completeness, using the gap-stratified subsets.

Reference tables

• weekends_and_holidays.csv (515 rows) — Czech weekends and public holidays covering the collection period.
• school_terms_and_exams_periods.csv (19 rows) — approximate Czech academic terms and examination periods. Most monitored entities belong to universities, so these periods explain much of the annual structure. Summer recess is the gap between the end of the summer examination period and the start of the winter term.
• outages.csv (13 rows) — documented monitoring outages: 7 infrastructure-wide gaps in the main collection (the largest 2026-04-29 to 2026-05-15, ~15.9 days) and 6 subnet-local zero-traffic periods in the longitudinal part.
• europe_time_changes.csv (9 rows) — daylight-saving transitions in the collection period, with the direction and offset of each clock change.

Known properties and usage notes

These are properties of operational data, not defects; ignoring them leads to wrong conclusions.

• Most series are very sparse. The median series is present in roughly 5 % of 10-minute slots, 14 % of hourly slots and 58 % of daily slots. Coarser aggregation looks denser only because a window counts as present when any sub-window carries data. The aggregation level chosen for an experiment therefore determines how severe the sparsity appears.
• Entity lifetimes are right-censored by the entity-selection procedure. Addresses were selected by activity within the collection window, so almost every series is present at the end of the collection: fewer than 40 of the 278,466 series stop anywhere in the 22 months before the final month. Lifetime variation is essentially arrival-driven, and end dates carry no information about when a device or address ceased to be used. Do not fit survival or churn models to per-entity lifetimes.
• The time grid is not contiguous. The nominal grid would have 143,280 ten-minute slots; the published grid has 140,636, because network-wide outages (see outages.csv) are absent from the grid itself. Always resolve id_time through the times table rather than assuming a fixed step.
• Daylight saving. At each spring-forward transition, two source measurement windows fall on one grid slot; they are merged (counters summed, other columns averaged). At each autumn transition the local clock repeats an hour. Work in UTC, or use europe_time_changes.csv.
• A late-November-2023 onboarding step. About 34,700 series first appear on 2023-11-30, and network-wide active-address counts step up around 2023-11-25. This is a monitoring expansion, not a traffic change; it affects any trend fitted across that date.
• subnet_longitudinal is only partly consistent with the rest. It uses the IP id namespace (its ids overlap ip_addresses_full) but has its own, longer time grid, so its id_time values are not comparable with the main parts. Its 1-hour and 1-day files also do not correspond exactly to its own 10-minute files, and for at least one series it covers a longer period than the main tree. Use it for long-horizon analysis of that one subnet, not for cross-part comparison.
• ip_addresses_full/identifiers.csv contains repeated rows. It has 901,541 rows for 278,466 unique (id_ip, id_ip_folder) pairs — the folder-12 entries are duplicated. De-duplicate before use; the on-disk tree itself is correct and contains exactly 278,466 series per aggregation level.

Suggested uses

• Forecasting on irregular, gapped operational time series (per-entity and aggregated).
• Annual and weekly seasonality, and calendar effects tied to the academic year.
• Concept drift and model longevity: how quickly a model trained on one period decays.
• Outage and anomaly detection, with documented ground-truth outages.
• Robustness studies across data completeness, using the gap-stratified subsets.

Column reference

Table 1. Time-series metrics in the 10-minute files of the IP-address parts (ip_addresses_full, ip_addresses_sample, ip_addresses_sample_gaps_*). The longitudinal subnet part has a different and smaller column set — see Table 3.

Table 2. In the 1-hour and 1-day aggregations of the IP-address parts, and in all aggregations of institutions and institution_subnets, the three destination-cardinality columns of Table 1 are replaced by sum / average / standard deviation over the constituent 10-minute windows. The standard deviation is the sample standard deviation (ddof = 1) and is 0 where a window contains a single 10-minute datapoint.

Table 3. Columns of the longitudinal subnet part (subnet_longitudinal), identical at all three aggregation levels. This part has neither the tcp_udp_ratio_* columns nor avg_ttl, and its destination-port column is singular. All volumetric metrics reflect TCP traffic only.

Table 4. Content of ids_relationship.csv (278,466 rows).

Table 5. Content of weekends_and_holidays.csv (515 rows).

Table 6. Content of school_terms_and_exams_periods.csv (19 rows).

Table 7. Content of europe_time_changes.csv (9 rows).

Table 8. Content of outages.csv (13 rows).