SD-IoT MQTT/CoAP DDoS Dataset

The dataset comprises Mininet simulations of Distributed Denial of Service (DDoS) and standard traffic, utilizing public-domain IP addresses. These simulations were gathered from four distinct Internet of Things (IoT) networks managed by L3 Forwarding application, where the IoT servers facilitate MQTT and CoAP services. The DDoS attacks were executed using Tcpreplay on a Packet Capture (PCAP) file, and the dataset was compiled through a single Software-Defined IoT (SD-IoT) controller (RYU) in accordance with the OpenFlow standard. This process included the extraction of PacketIn header information as well as port statistics data. The dataset encompasses 26 features and 10 labels, concentrating specifically on MQTT services (CONNECT, SUBSCRIBE, and PUBLISH) and CoAP services (GET and POST).