FW-Flow: A curated multi-class firewall flow dataset with engineered flow-based and statistical features

The original data were collected from internet traffic records on a university firewall and comprise 65,532 multi-class labeled flow records. - FW-Flow provides a curated and feature-engineered version of the data, including the original 12 raw firewall attributes (ports, NAT mappings, bytes, packets, elapsed time) together with 30 additional flow-based, behavioral, and statistical derived features, resulting in 42 structured attributes. - The dataset supports multi-class classification (allow, deny, drop, reset-both), anomaly detection, and traffic behavior modeling research. - Approximately 43% of flows exhibit zero-second duration due to logging granularity in the original records.

A small epsilon value (1e-6) was applied during rate-based feature computation to ensure numerical stability. All preprocessing and feature engineering procedures are fully reproducible via the accompanying scripts. [1] Internet Firewall Data [Dataset], UCI Machine Learning Repository, 2019.