Locked Shields Partners Run 25 (LSPR25)

The LSPR25 dataset is the third annual release in the Locked Shields Partners Run series, derived from the NATO CCDCOE Locked Shields live-fire cyber defence exercise. It provides network flow data for reproducible evaluation of intrusion detection systems under realistic temporal distribution shift. Key characteristics: Over 30 million network flows with binary (benign/malicious) labels Severe class imbalance: approximately 2.2% positive-class prevalence 80+ CICFlowMeter-derived features per flow Covers heterogeneous IT/OT infrastructure including enterprise services, SCADA/ICS, 5G, and military systems Labels derived from official exercise role metadata and red-team infrastructure identifiers LSPR25 is released as a companion dataset to the paper “Sequence Construction as a Primary Design Factor in Flow-Based Intrusion Detection: A Cross-Year Evaluation on the Locked Shields Datasets” (Computer Networks). The dataset supports cross-year evaluation together with LSPR23 and LSPR24. Please cite our research article when using this dataset.