UAV-ToN-IoT Dataset (Session-Level UAV Communication Security Dataset for Intrusion Detection and Attack Analysis)

UAV-ToN-IoT Dataset Session-Level UAV Communication Security Dataset for Intrusion Detection and Attack Modeling 1. Dataset Overview The UAV-ToN-IoT dataset is a large-scale session-level network flow dataset designed for research in UAV (Unmanned Aerial Vehicle) communication security and intrusion detection. This dataset supports research in: UAV cyber-physical system security Intrusion Detection Systems (IDS) Hybrid anomaly detection Zero-day attack modeling Privacy-preserving intrusion detection Machine learning and deep learning–based threat detection Each record represents a network flow session between UAV nodes and associated communication entities (e.g., ground station, infrastructure node, external host). 2. File Information File Name: UAV_ToN_IoT.csv Format: CSV (Comma-Separated Values) Total Records: 1,157,994 Total Features: 21 Granularity: Session-level network flows 3. Feature DescriptionFeature Name Descriptionsrc_port Source transport-layer portdst_port Destination transport-layer portl4_proto Layer-4 protocol (e.g., TCP, UDP)l7_proto Application-layer protocolin_bytes Total inbound bytesout_bytes Total outbound bytesin_pkts Number of inbound packetsout_pkts Number of outbound packetstcp_flags TCP control flag summaryflow_duration Flow durationlabel Binary class label (0 = Benign, 1 = Attack)attack_type General attack categorysrc_role Role of source entity (e.g., UAV, GS)dst_role Role of destination entitysession_id Unique session identifieruav_attack_type UAV-specific attack classificationuav_traffic_type UAV traffic behavior typeflow_intensity Traffic intensity metricbyte_asymmetry Inbound vs outbound byte imbalancesession_pressure Session-level stress indicator 4. Label Schema4.1 Binary Label (label)Value Meaning0 Benign Traffic1 Malicious Traffic 4.2 UAV-Specific Attack Taxonomy (uav_attack_type)Category DescriptionCommand_Injection Unauthorized UAV command manipulationUAV_Link_DoS Denial-of-service targeting UAV communicationStealthy_Anomaly Low-profile stealth attack behaviorReconnaissance Scanning and probing activityNormal Legitimate UAV communication 5. Intended Research Applications This dataset is suitable for: Supervised classification (binary and multi-class) Anomaly detection Hybrid ML models (e.g., Autoencoder + XGBoost) Zero-day simulation studies UAV communication resilience analysis Session-level behavioral modeling Explainable AI (XAI) evaluation