Improving Intrusion Detection Accuracy in Campus Networks: A Dataset Driven by Real-Time Traffic and Honeypot Simulations

Abstract

This article describes the creation of a domain-specific Intrusion 
Detection System (IDS) dataset customised for campus networks to 
overcome the constraints of out-of-date public datasets such as 
KDD'99 and NSL-KDD. The dataset depicts the various user 
behaviours, traffic patterns, and device interactions that are unique to 
educational contexts because it captures network traffic straight from a 
university. Real-time logs from firewalls, routers, and switches are used 
as data sources, as is the simulated attack traffic collected by 
honeypots, which are false open network ports meant to entice 
malicious behaviour. This technique ensures a balanced mix of normal 
and attacking actions. Machine learning models trained on this dataset 
have a 99% detection rate, exceeding models trained on public datasets 
(95%), while also lowering false positives. The dataset is continually 
updated to reflect changes in user behaviour, software, and threats, 
maintaining its long-term usefulness. This work establishes a realistic, 
adaptive, and effective framework for developing scalable IDS models 
designed for campus network protection.