A Topology Poisoning Attack Dataset for Machine Learning-Based Detection in Software-Defined Networks

The Topology Poisoning Attack (TPA) Dataset is a novel labeled collection of 247,346 network flow records with 86 features, created to address the scarcity of comprehensive public datasets for detecting Topology Poisoning Attacks (TPA) in Software-Defined Networks (SDN). TPA Dataset is a multi-controller, multi-variant TPA dataset generated under controlled conditions will enable effective machine-learning detection of sophisticated host-location hijacking and link-fabrication attacks that existing SDN datasets largely omit. Binary labels divide the data into normal or benign traffic, which accounts for 68,424 flows (27.7%), and attack traffic, which accounts for 178,922 flows (72.3%). Label 0 denotes normal traffic and label 1 denotes attack traffic. A finer category field further distinguishes the records: Benign traffic was drawn from the InSDN dataset while three novel attack scenarios, Persistent Ghost Host (PGH, a host-location hijacking variant), Chameleon Topography (CT, an adaptive link-fabrication attack), and a Combined Topology-Aware Host Hijacking orchestrator, were executed with Scapy scripts and captured by tcpdump; CICFlowMeter then extracted the statistical features. The resulting classes are Benign (category 0, 68424 flows), Link Fabrication plus CT (category 1, 69723 flows), Host Location Hijacking plus PGH (category, 4423 flows), and Combined (category 3, 104776 flows). Baseline evaluation with machine learning models after cleaning, feature selection, and SMOTE established indicates that ensemble methods such as LightGBM, Random Forest, and XGBoost are the strongest. Users may therefore interpret the set as a reproducible SDN-security benchmark for binary or multi-class TPA detection, model comparison and the design of defenses against multi-stage topology poisoning.