IoT network traffic dataset using the custom flow representation

This dataset provides Custom Flow representations derived from raw IoT network traffic traces, capturing detailed behavioral characteristics of IoT communications. Each Custom Flow encapsulates network behavior in a structured, vectorized format that includes flow-level metadata, packet sequence timing, direction, and selected payloads. Flows are uniquely identified by a five-tuple: device IP address, remote IP address, protocol, device port, and remote port, and maintain a fixed one-minute lifetime. To ensure consistent temporal granularity and computational efficiency, long-lived connections (such as persistent IoT–cloud sessions) are segmented into consecutive flow records sharing the same identifier. The dataset was generated from 60 days of packet capture (PCAP) traces obtained from the publicly available UNSW IoT Traffic Analytics platform. Two variants are included: (1) Bidirectional Custom Flows, capturing both upstream and downstream packets (~6 million flows), and (2..., , # IoT network traffic dataset using the custom flow representation

Dataset DOI: [10.5061/dryad.6q573n6c1](https://doi.org/10.5061/dryad.6q573n6c1)

## Description of the data and file structure

### Custom Flow – A Comprehensive Network Traffic Representation

#### A. Overview

Analyzing patterns in network traffic can be performed at both **micro** and **macro** levels.

At the **micro level**, inspecting byte values within packet headers and payloads provides detailed behavioral insights but is often computationally expensive and limited in capturing a broader communication context.

At the **macro level**, flow-based aggregation offers a more scalable and cost-effective alternative. A *network flow* represents a sequence of packets sharing common properties such as source/destination IP addresses, source/destination port numbers, and protocol (e.g., TCP or UDP).

While flow records are efficient for large-scale monitoring, they may lack the granularity needed for fine-grained classi...,

本数据集提供源自原始物联网（IoT）网络流量追踪的自定义流（Custom Flow）表示，旨在捕获物联网通信的详细行为特征。每条自定义流以结构化向量化格式封装网络行为，涵盖流级元数据、数据包序列时序、传输方向以及选定的载荷内容。流通过五元组唯一标识：设备IP地址、远程IP地址、协议、设备端口与远程端口，且固定采用一分钟生命周期。为保证一致的时间粒度与计算效率，长连接（如持久化物联网-云会话）会被拆分为共享同一标识符的连续流记录。
本数据集基于公开可用的UNSW物联网流量分析平台获取的60天数据包捕获（PCAP）追踪数据生成。包含两个变体：（1）双向自定义流，捕获上行与下行数据包（约600万条流），以及（2……

# 采用自定义流表示的物联网网络流量数据集
数据集DOI：[10.5061/dryad.6q573n6c1](https://doi.org/10.5061/dryad.6q573n6c1)

## 数据与文件结构说明
### 自定义流（Custom Flow）——一种全面的网络流量表示方法
#### A. 概述
对网络流量模式的分析可在**微观**与**宏观**两个层面开展。
在**微观**层面，直接解析数据包头部与载荷中的字节值可获得细致的行为洞察，但通常计算成本高昂，且难以捕获更广泛的通信上下文。
在**宏观**层面，基于流的聚合方案是更具可扩展性与成本效益的替代方案。*网络流*指共享共同属性的数据包序列，这些属性包括源/目的IP地址、源/目的端口号以及协议（如传输控制协议（TCP）或用户数据报协议（UDP））。
尽管流记录可高效支撑大规模监控，但可能缺乏细粒度分类所需的粒度……