Descriptor: 5G Open Radio Access Network Multi-Modal Intrusion Detection Dataset (NetsLab-5GORAN-IDD)

The rise of Open Radio Access Networks (O-RAN) in 5G introduces unprecedented flexibility and interoperability, but also expands the attack surface due to its cloud-native, multi-vendor architecture. To support the development of robust intrusion detection systems in this complex environment, we present NetsLab’s 5G Open Radio Access Networks Intrusion Detection Dataset (NetsLab-5GORAN-IDD), a comprehensive dataset collected from a live 5G O-RAN testbed at Network Softwarization and Security Labs (NetsLab), University College Dublin, Ireland. Unlike prior datasets that focus solely on higher-layer traffic or simulated environments, 5G-ORAN-IDD integrates both network packet-level data and radio telemetry collected in parallel, capturing detailed insights from real-time device interactions. Packet-level data was gathered at the Central Unit (CU), while lower-layer radio metrics were collected from Distributed Unit (DU) running on the RAN Intelligent Controller (RIC). The dataset includes benign and attack traffic targeting the O-Cloud Edge Server, encompassing various threat vectors such as SYN, UDP, TCP, ICMP floods, and port scans. This dataset addresses a critical gap in the field by offering a realistic, multi-layered resource for advancing 5G O-RAN security research for observing the radio-level behaviour variations with the attack scenarios in comparison with the insights from the upper level network information.