cupid.directory

What It Is

CUPID (Colorado University Pentesting Intrusion Dataset) is a labeled dataset for evaluating network intrusion detection. The related paper was published in the Journal of Systems Architecture. The page provides citation information, a Creative Commons Attribution-ShareAlike 4.0 license, and multiple types of data packages, including CUPID automated/manual/baseline data, CICFlowMeter outputs, CSV labels, a Processing Notebook, and raw packet captures.

Core Capabilities and Dimensions

In terms of protection category, CUPID is not a firewall, IDS/IPS, or cloud security service. It is a data resource for evaluating intrusion detection models. Its attack scenarios include Nmap scans, DNS-related activity using tools such as Dig, Dnsmap, Dnswalk, Dnstracer, and Nslookup, DVWA penetration testing, Bonesi traffic generation, the Kickthemout tool, and manual DVWA penetration testing. Deployment involves downloading PCAP/PCAPNG, CSV, or CICFlowMeter feature files locally for analysis, making it suitable for researchers working with Python, notebooks, or machine-learning pipelines. The page lists several labeling rules, such as marking malicious traffic based on source/destination IP, port, protocol, or MAC address, which provides a good level of transparency.

Pricing, Compliance, and Integration

The page clearly states that the dataset is licensed under CC BY-SA 4.0. It does not mention commercial pricing, subscriptions, payment methods, or enterprise licensing. On the compliance side, it does not provide information such as SOC 2 or ISO 27001 certification. Integration is mainly at the data layer: it can be used with CICFlowMeter, CSV analysis, PCAP traffic tools, and model training workflows. However, it does not describe API, SIEM, SOAR, EDR, or cloud platform integrations.

Pros and Cons

The main advantages are its clear dataset structure, inclusion of both benign baselines and manual/automated attack traffic, and documented labeling criteria, which make experiments easier to reproduce and algorithms easier to compare. The drawbacks are also clear: it does not provide real-time detection, a management console, alerting, response capabilities, or technical support. The data comes from a specific experimental network, so its ability to directly represent threat distributions in production environments is limited.

Who It’s For and Access from China

CUPID is suitable for universities, labs, security research teams, and engineers developing intrusion detection models. It is not something enterprises would directly purchase as a production protection system. The page does not specify access, download stability, or payment conditions from China. Since it is positioned as an open dataset, users in China may also consider public datasets such as CICIDS2017 and CTU-13 as alternatives or complements.