SYN-PCAP-RELEASE

Unlike existing public benchmarks, which are released only as processed flow records, this dataset provides raw packet-level access alongside a transparent, reproducible generation procedure. Traffic is organized into repeated BENIGN → TRANSITION → ATTACK episodes covering five attack families (reconnaissance, brute force, web exploitation, DoS, and IoT abuse), with benign and malicious traffic sharing targets, services, and protocols to reduce reliance on static shortcuts.

This release includes the PCAP capture, the episode label log, NFStream flow extraction and windowing code, four order-perturbation implementations (full shuffle, partial permutation, jitter-sort, block mismatch), and training/evaluation code for six sequence models (LSTM, GRU, TCN, CNN1D, Transformer, DeepSets), supporting the paper "A Synthetic PCAP Benchmark for Evaluating Temporal Learning in Sequence-Based Intrusion Detection.</p>