APEX-IDS2026: A Real-World Network Perimeter Threat Dataset

APEX-IDS2026 acts as a modern, large-scale, real-world benchmark for evaluating machine learning models in network intrusion detection. Historically, research in this field relies on synthetic datasets or outdated captures. APEX-IDS2026 solves this by supplying traffic captured from a live, internet-facing /24 IPv4 honeynet over a 44-day period in early 2026. This exposes models to actual threats rather than simulated lab environments.

The repository includes the data in two formats:

1. The Full Dataset (Partitioned): Contains 141.6 million records divided into three categories (Attacks, Suspicious, Normal). It includes traffic from 13,638 distinct attacking IP addresses targeting 64,084 unique ports and actual services (Redis, MongoDB, Elasticsearch, VoIP).

2. The High-Confidence Subset: A strictly filtered 69.1 million record subset containing only verified attacks (Tier 1) and verified benign flows (Tier 3). We created this subset exclusively for machine learning model training and evaluation. Real-world 'Normal' traffic often contains unclassified background noise or zero-day threats that compromise label integrity. The High-Confidence Subset guarantees a 0% false-positive ground truth on the attack class, and removes ambiguous/unverified background traffic entirely. This allows researchers to train binary classification models on verified malicious and verified benign traffic with absolute certainty regarding the labels.

Features include: