casscloud/CIC-IoT-2023

CIC-IoT-2023物联网入侵检测数据集是由加拿大网络安全研究所（CIC）提供的原始数据集的子采样和预处理版本，专为机器学习评估设计。该数据集用于物联网（IoT）环境中的网络入侵检测，支持二元分类（良性 vs 攻击）和多元分类（34个细粒度攻击类型或8个攻击类别）。数据集包含1,342,314行数据，其中良性流量199,988行，攻击流量1,142,326行，覆盖33种攻击子类型，分为7个主要攻击类别（如BruteForce、DDoS、DoS、Mirai、Recon、Spoofing、Web-based）和1个良性类别。数据特征包括39个数值型流级别特征，如HTTPS、Time_To_Live、ack_flag_number等，并提供了基于随机森林的前20个重要特征列表。数据集提供两种配置：默认的random_3way配置采用80/10/10的分层随机分割，分别用于训练、测试和验证；random配置为80/20分割，用于向后兼容。由于数据按攻击类型组织而非捕获时间，因此没有自然的时间顺序，仅提供随机分割。该数据集适用于网络安全研究和机器学习模型开发，许可证为CC BY 4.0。

The CIC-IoT-2023 IoT Intrusion Detection Dataset is a subsampled and preprocessed version of the original dataset from the Canadian Institute for Cybersecurity (CIC), designed for machine learning evaluation. It is used for network intrusion detection in IoT environments, supporting binary classification (benign vs. attack) and multi-class classification (34 fine-grained attack types or 8 attack classes). The dataset contains 1,342,314 rows, with 199,988 benign and 1,142,326 attack rows, covering 33 attack subtypes categorized into 7 main attack classes (e.g., BruteForce, DDoS, DoS, Mirai, Recon, Spoofing, Web-based) and one benign class. Features include 39 numeric flow-level features, such as HTTPS, Time_To_Live, ack_flag_number, etc., with a provided list of top-20 important features based on random forest. Two configurations are available: the default random_3way uses an 80/10/10 stratified random split for training, testing, and validation; the random configuration uses an 80/20 split for backward compatibility. As the data is organized by attack type rather than capture time, there is no natural temporal ordering, and only random splits are provided. This dataset is suitable for cybersecurity research and machine learning model development, licensed under CC BY 4.0.