CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection

Josef Koumar; Karel Hynek; Kamil Jerabek; Pavel Siska

cs.AIOct 10, 2026

CESNET-TimeSeries26: A Multi-Year Network Traffic Time Series Dataset for Annual Seasonality, Concept Drift, and Long-Term Anomaly Detection

Authors: Josef Koumar, Karel Hynek, Kamil Jerabek, Pavel Siska

Organizations: Czech Technical University in Prague, Thákurova 9, 160 00 Prague 6, Czech Republic · CESNET a.l.e., Generála Píky 430/26, 160 00 Prague 6, Czech Republic

Abstract

Forecast-based models are fundamental to network traffic management and anomaly detection. However, it is essential to evaluate these forecasting models over extended periods of time in order to assess their adaptability to unexpected phenomena and shifts in underlying patterns. This kind of long-term evaluation requires multi-year data to account for yearly seasonality and behavioral drift. Existing public datasets are too short to support such long-horizon forecasting tasks. We introduce CESNET-TimeSeries26, comprising 995 days of continuous traffic time series from the CESNET3 network, together with a single subnet spanning approximately 4.5 years. The dataset captures 278,466 IP addresses, 285 institutions, and 566 institutional subnets at three aggregation intervals. The dataset provides a definitive longitudinal benchmark for evaluating forecasting models in both operational management and security monitoring. We demonstrate that annual seasonality is the dominant periodic component. Moreover, we show that a forecasting model can exploit the annual component only when its training window covers at least one complete annual cycle, which no sub-year dataset provides.

Figures & tables

Figure 1: Analyses unlocked by a length of dataset. Columns are eleven network-traffic datasets ordered by span: MAWI [ 15 ] ; SDN [ 31 ] ; Network Operator KPIs [ 32 ] ; the Telecom Italia [ 33 ] ; CESNET-AGG23 [ 34 ] ; GEANT [ 35 ] ; Abilene [ 36 ] ; the 40-week CESNET-TimeSeries24 [ 16 ] (TS24); BRAIN [ 37 ] ; CESNET-TimeSeries26 [ 38 ] main part (TS26 main); and CESNET-TimeSeries26 [ 38 ] longitudinal subnet part (TS26 subnet). A MAWI archive of 15-minute daily snapshots is included separately: although it spans calendar years (2007–2024), each captured day is only 15 m inutes long, so it never accumulates a single continuous cycle. A full annual cycle is required for annual seasonality. Two cycles for cross-cycle reproducibility, year-over-year drift, and leave-one-cycle-out anomaly separation. Three cycles for a full-year-ahead forecast validated on a held-out complete cycle. Cells marked demonstrated are validated in this article. The feasible cells are supported by the data length but were not separately run. The limited cells denote partial capability. And finally, the infeasible cells state the limiting reason.

Figure 2: Topology of the CESNET3 network, which interconnects academic institutions in the Czech Republic.

Figure 3: Architecture of dataset collection from the CESNET3 network.

Date	Transition	Local clock change	Offset change
2022-03-27	spring forward	02:00 CET $\rightarrow$ 03:00 CEST	$+1$ h
2022-10-30	fall back	03:00 CEST $\rightarrow$ 02:00 CET	$-1$ h
2023-03-26	spring forward	02:00 CET $\rightarrow$ 03:00 CEST	$+1$ h
2023-10-29	fall back	03:00 CEST $\rightarrow$ 02:00 CET	$-1$ h
2024-03-31	spring forward	02:00 CET $\rightarrow$ 03:00 CEST	$+1$ h
2024-10-27	fall back	03:00 CEST $\rightarrow$ 02:00 CET	$-1$ h

Table 1: Daylight-saving transitions within the CESNET-TimeSeries26 observation window (Europe/Prague). Spring-forward events skip a local hour and are transparent on the absolute (UTC) time grid; fall-back events repeat a local hour and are identified by the

-1

h offset change.

Outage	Part	Last data before	Data resumed	Duration
1	subnet	2022-01-11 12:43	2022-01-12 12:43	23.8 h
2	subnet	2022-03-14 22:53	2022-03-15 13:33	14.5 h
3	subnet	2022-05-18 21:53	2022-05-19 21:43	23.7 h
4	subnet	2022-12-11 17:13	2022-12-14 10:23	2 d 17.0 h
5	subnet	2022-12-28 09:53	2023-01-02 14:33	5 d 4.5 h
6	subnet	2023-04-12 01:33	2023-04-14 05:43	2 d 4.0 h

Table 2: Monitoring outages in CESNET-TimeSeries26. Times are Europe/Prague local. The Part column states which dataset part the outage affects. Shorter gaps and daylight-saving transition artifacts are omitted. The 2024 probe outage was a partial capacity loss (total never reached zero) and is discussed in the text rather than listed here.

Figure 4: The aggregation process for capturing time series of length

m

from network traffic. For each packet

Packet_{i,j}

, there exists a

Flow_{i,k}

to which the packet belongs. It always holds that

a\geq g

(and similarly

b\geq h

), and in most cases

a

is much larger than

g

; commonly, a single IP flow contains all packets of one connection (

g=0

), e.g., for a user visiting a web page. A time series datapoint is likewise a combination of one or more IP flows.

Figure 5: The file structure of the CESNET-TimeSeries26 dataset.

Figure 6: Daily count of active IP addresses over the 995-day collection, with known infrastructure events annotated. The November 2023 Eduroam architecture change produces a permanent level shift; the recurring Christmas and summer minima recur in every observed year.

Figure 7: Daily total transmitted data over the collection. The academic calendar is directly visible, superimposed on a slow year-over-year growth trend.

Panel of Figure 8 — Figure 8: Distribution of the fraction of present datapoints per series over the 995 days: (a) boxplot by aggregation, (b) kernel density estimate.

Panel of Figure 9 — Figure 9: Distribution of Wang–Smith–Hyndman weekly and annual seasonal strengths across institutions, institutional subnets, and dense IP series (using metric n_bytes ). Annual strength (median 0.83) exceeds weekly strength (medians 0.34–0.49) for 96.8 % of institutions, 98.2 % of institutional subnets, and 99.8 % of dense IP series.

Panel of Figure 10 — Figure 10: Calendar structure of the network load, measured directly by conditioning on the academic calendar.

Figure 11: Distribution across entities of the year-1-versus-year-2 KS statistic for four metrics. Significant distributional drift is the norm rather than the exception (63.8–82.6 % of entities depending on the metric).

Figure 12: Leave-one-cycle-out annual baseline. Recurring calendar effects (Christmas, summer) are absorbed (median $|z|\approx 0.5$ – $1.2$ ), while non-recurring events remain detectable (2024 probe outage $|z|\approx 3.0$ in byte volume. November 2023 Eduroam step $|z|\approx 5.6$ in the active-IP count).

Figure 13: Daily total transmitted data and flow count of the longitudinal subnet over its 4.5-year span (7-day medians). The elevated flow count between April and July 2023 is driven by a single short-lived address (IP identifier 1590672), which appears in the dataset only from 2023-04-09 to 2023-07-17 and accounts for 99.5 % of the excess flows during that period.

Figure 14: Per-band comparison of the n_present distribution of the drawn 1,000 entities against the full band candidate pool. Distributions coincide across all bands (KS $p=0.12$ –0.93), confirming that each subset is a representative draw from its band.

Entity set	Institutions	Institution subnets	IP addresses
CESNET-TimeSeries24 entities	283	548	275,124
CESNET-TimeSeries26 entities	285	566	278,466
Shared (qualify in both)	283	548	253,543
Added (qualify now, absent before)	2	18	24,923
Dropped (in TS24, no longer qualify)	0	0	21,581

Table 3: Relationship of the CESNET-TimeSeries26 IP-address entity set to CESNET-TimeSeries24, under the recomputed relative filtering threshold (

>99.75\%

empty, i.e.,

\leq 358

non-empty 10-minute datapoints).

Figure 15: Exploitability of the annual component in a rolling-origin backtest with a 28-day horizon. Top: median MASE as a function of training-window length, with and without the annual term. The annual model starts to win only once the window covers one full cycle. Bottom left: the MASE reduction attributable to the annual term for each window length. Below one cycle, the contribution is negative. Bottom right: only the model that includes both historical cycles and an annual term beats all baselines for the university. The office is served equally well by any weekly model.

Figure 16: Forecast error versus time since training. Without retraining, median SMAPE grows by

\sim

11.3 points per quarter (25.5 %

\rightarrow

123.9 % over 20 months); retraining every 30 days holds error near 29.5 %, implying a practical retraining interval of roughly two to three months.

No.	Recommendation
(1)	Specify which dataset part(s) are used in the analysis.
(2)	Specify the aggregation interval(s) used.
(3)	Indicate whether the approach is multivariate or univariate.
(4)	Clearly state if not all metrics are used.
(5)	Document all preprocessing steps, including filtering, normalization, and gap handling.
(6)	Ensure the training phase starts from the beginning of the relevant part’s time frame (main dataset: 2023-10-09; longitudinal subnet: its own 2022 start).

Table 4: Checklist for addressing recommended evaluation procedures.

Name	Version	Link
Ipfixprobe	4.11.0	https://github.com/CESNET/ipfixprobe
IPFIXcol2	2.2.1	https://github.com/CESNET/ipfixcol2
NEMEA Framework	0.14.0	https://github.com/CESNET/Nemea-Framework
NEMEA modules	2.20.0	https://github.com/CESNET/Nemea-Modules
NEMEA Supervisor	1.8.2	https://github.com/CESNET/Nemea-Supervisor
TimeScaleDB-14	2.15.0	https://www.timescale.com/

Table 5: Software used for creating the dataset.

Column name	Description
id_time	Unique identifier for each aggregation interval within the time series, used to segment the dataset into specific time periods for analysis.
n_flows	Total number of flows observed in the aggregation interval, indicating the volume of distinct sessions or connections for the IP address.
n_packets	Total number of packets transmitted during the aggregation interval, reflecting the packet-level traffic volume for the IP address.
n_bytes	Total number of bytes transmitted during the aggregation interval, representing the data volume for the IP address.
n_dest_ip	Number of unique destination IP addresses contacted by the IP address during the aggregation interval, showing the diversity of endpoints reached.
n_dest_asn	Number of unique destination Autonomous System Numbers (ASNs) contacted by the IP address during the aggregation interval, indicating the diversity of networks reached.

Table 6: Detailed descriptions of time series metrics for each IP address dataset. Note: in the longitudinal subnet part, all volumetric metrics reflect TCP traffic only, and tcp_udp_ratio_packets / tcp_udp_ratio_bytes are constant (

=1

); see the Longitudinal subnet collection subsection.

Column name	Description
sum_n_dest_ip	Sum of numbers of unique destination IP addresses.
avg_n_dest_ip	The average number of unique destination IP addresses.
std_n_dest_ip	Standard deviation of numbers of unique destination IP addresses.
sum_n_dest_asn	Sum of numbers of unique destination ASNs.
avg_n_dest_asn	The average number of unique destination ASNs.
std_n_dest_asn	Standard deviation of numbers of unique destination ASNs.

Table 7: Time series metrics which replace metrics n_dest_ip , n_dest_asn and n_dest_port in the 1-hour and 1-day aggregations.

Column name	Description
id_ip	ID of the IP address.
id_institution	ID of the institution which owns the IP address.
id_institution_subnet	ID of the institution subnet in which the IP address belongs.

Table 8: Content of the ids_relationship.csv file.

Column name	Description
Date	The date of the day in format “YYYY-MM-DD”.
Type	The type of the day (Weekend or Holiday).

Table 9: Content of the weekends_and_holidays.csv file.

Column name	Description
Start	The first day of the period in format “YYYY-MM-DD”.
End	The last day of the period (inclusive) in format “YYYY-MM-DD”.
Type	The type of the academic period ( WinterTerm , WinterExams , SummerTerm or SummerExams ).

Table 10: Content of the school_terms_and_exams_periods.csv file.

Column name	Description
date	The date of the daylight-saving transition in format “YYYY-MM-DD”.
transition	The direction of the transition ( spring_forward or fall_back ).
measured_from	The dataset part in which the transition falls inside the collection span ( main or subnet_longitudinal ).
local_clock_change	The local wall-clock jump, e.g. 02:00 CET $\rightarrow$ 03:00 CEST .
utc_offset_before	The UTC offset of local time before the transition ( +01:00 for CET, +02:00 for CEST).
utc_offset_after	The UTC offset of local time after the transition.

Table 11: Content of the europe_time_changes.csv file.

Column name	Description
id	Sequential ID of the outage.
part	The dataset part affected by the outage ( main or subnet_longitudinal ).
scope	The extent of the outage ( infrastructure-wide or subnet-local ).
kind	How the outage manifests in the data: grid-gap for windows absent from the shared time grid, present-zero for windows present in the grid but carrying zero traffic.
last_data_before	Timestamp of the last window carrying data before the outage, with explicit UTC offset.
data_resumed	Timestamp of the first window carrying data after the outage, with explicit UTC offset.

Table 12: Content of the outages.csv file.

Forecasting Benchmarks

Forecasting Benchmarks are datasets and evaluation protocols for comparing predictions of future time-series values, events, and outcomes.

See all 224 papers

From XXLTraffic to EvoXXLTraffic: Scaling Traffic Forecasting to Sensor-Evolving Networks
May 28, 2026Du Yin, Hao Xue, Arian Prabowo +2Intelligent Transportation Systems Forecasting Benchmarks
University of New South Wales, Sydney, NSW, Australia
QuitoBench: A High-Quality Open Time Series Forecasting Benchmark
Mar 27, 2026Siqiao Xue, Zhaoyang Zhu, Wei Zhang +7Time Series Forecasting Time Series Modeling
Ant Group
Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining
Aug 6, 2026Mohammad Arafath Uddin Shariff, Byrav RamamurthyNetwork Intrusion Detection Forecasting Benchmarks
School of Computing University of Nebraska-Lincoln Lincoln, NE, USA

May 28, 2026J/K move · Enter open · S save

From XXLTraffic to EvoXXLTraffic: Scaling Traffic Forecasting to Sensor-Evolving Networks

Du Yin, Hao Xue, Arian Prabowo, Shuang Ao+1

University of New South Wales, Sydney, NSW, Australia

Intelligent Transportation Systems Forecasting Benchmarks Dynamic Graph Learning Traffic Forecasting

Open paper AskPDF arXiv

Existing traffic forecasting benchmarks assume a fixed sensor set, but real road-sensor networks grow continuously as the road network changes year by year. We introduce the XXLTraffic dataset family, which spans up to 27 years of California PeMS and Transport for NSW data. The fixed-sensor subsets of XXLTraffic support extremely long forecasting with multi-year gaps and standard hourly / daily long-horizon forecasting. We extend it to EvoXXLTraffic, a sensor-evolving reorganization that exposes per-year active sensors, yearly traffic-flow matrices, and yearly graph snapshots across nine PeMS districts, with growth ratios ranging from +305% to over +10,000%. We define a yearly streaming forecasting protocol on EvoXXLTraffic in which each calendar year is a continual task, and benchmark a wide range of representative baselines drawn from static spatio-temporal GNNs, naïve online schemes, evolving-graph continual methods, and retrieval / test-time methods. We find that our ultra-large evolutionary dataset better reflects the real world, and many state-of-the-art (SOTA) results no longer work. Our dataset complements existing benchmarks by enabling more realistic forecasting under ultra-long evolutionary road networks. Our code and baselines are available at github repo: https://github.com/cruiseresearchgroup/TSAS26-EvoXXLTraffic

Abstract

Forecasting Benchmarks

Explore similar work

From XXLTraffic to EvoXXLTraffic: Scaling Traffic Forecasting to Sensor-Evolving Networks

QuitoBench: A High-Quality Open Time Series Forecasting Benchmark

Enhancing Anomaly Resilience in Research Networks: A Large-Scale Forecasting Benchmark for Dynamic Security Baselining