CESNET-TimeSeries26: Multi-year network traffic time series from the CESNET3 ISP network (HDF5 files, part 2 of 4)

Part 1 of 4 of the HDF5 distribution of CESNET-TimeSeries26 for the CESNET TS-Zoo library. The main record of the dataset is https://zenodo.org/records/21945629 (DOI: 10.5281/zenodo.21945629).

Files in this record (48.00 GB, 96 files + SHA256SUMS.txt)

• CESNET-TimeSeries26-ip_addresses_full-10_minutes.h5.NNN: parts 1–96 of 176 (48.00 GB)
• SHA256SUMS.txt: SHA-256 of every file above

Other parts of this distribution

• Part 2: https://zenodo.org/records/23280650
• Part 3: https://zenodo.org/records/23280754
• Part 4: https://zenodo.org/records/23283552

About the dataset

CESNET-TimeSeries26 is a multi-year collection of network traffic time series derived from long-term IP-flow monitoring of CESNET3, the Czech national research and education network. It is the successor of CESNET-TimeSeries24 and extends its 40-week collection to 996 days (9 October 2023 – 30 June 2026), which makes annual seasonality, year-over-year drift and model-longevity studies possible on real operational traffic.

The dataset has ten source types, each in three aggregations (10 minutes, 1 hour, 1 day), 30 files and 178.7 GB in total: institutions (285 series); institution_subnets (566); ip_addresses_full (278,466, every monitored IP address); ip_addresses_sample (1,000, uniform random sample); five gap-stratified samples ip_addresses_sample_gaps_20_00 … _100_80 (1,000 series each, by the share of missing 10-minute windows); and subnet_longitudinal (135 IP addresses of one institution subnet, 31 December 2021 – 9 July 2026, TCP traffic only, own time grid).

Each datapoint is multivariate: numbers of flows, packets and bytes; numbers of unique destination IP addresses, ASNs and transport-layer ports; TCP/UDP and direction ratios of packets and bytes; average flow duration and average TTL. Entity identifiers are pseudonymous integers; no IP addresses, institution names or other identifying information are published.

Usage

With the library, files and their parts are downloaded from all records, re-assembled and verified automatically:

from cesnet_tszoo.datasets import CESNET_TimeSeries26
ds = CESNET_TimeSeries26.get_dataset(data_root="...", source_type="institutions", aggregation="1_hour", dataset_type="time_based")

Without the library, download all parts of a split file (they may be spread over several parts of this distribution), concatenate them in numeric order and verify the result:

# parts 1–96 in part 1; parts 97–176 in part 2
cat CESNET-TimeSeries26-ip_addresses_full-10_minutes.h5.* > CESNET-TimeSeries26-ip_addresses_full-10_minutes.h5
# expected SHA-256: 042b2fb06fb8fb2c09fa4150d778803ae03ff2ace54f08eb80fead2cda97f987

The downloaded files of this record can be verified with shasum -a 256 -c SHA256SUMS.txt.

Citation

Please cite the dataset record: CESNET-TimeSeries26. Zenodo. https://doi.org/10.5281/zenodo.21945629. The dataset paper is in preparation; until it is published, please also cite: Koumar, J., Hynek, K., Čejka, T., Šiška, P. CESNET-TimeSeries24: Time series dataset for network traffic anomaly detection and forecasting. Scientific Data 12, 338 (2025). https://doi.org/10.1038/s41597-025-04603-x

Contact

Josef Koumar, Czech Technical University in Prague