CryptoToN-IoT: a cryptomining-augmented IoT network-flow dataset for 6G security AI

CryptoToN-IoT is a labelled network-flow dataset that adds cryptojacking traffic (rare in IoT security benchmarks( to UNSW's ToN-IoT, with every flow feature re-generated through CICFlowMeter, so the old and new traffic share one schema. What makes this dataset valuable is the cryptomining traffic, i.e., as far as we are aware it is the first IoT/6G network-flow dataset to include cryptomining (Coinhive, Madominer, Xmrstack), which standard benchmarks such as CICIoT2023, CIC IoT-DIAD and CIC-BCCC-NRC leave out. The flows and processing are otherwise standard, yet the value is the cryptomining augmentation, the leakage-safe temporal split, and one consistent CICFlowMeter schema across the original and the added traffic. The dataset holds 16,422,866 flows across benign traffic and twelve attack categories (grouped into nine attack types), split by time into train (9,911,091), validation (3,160,179) and test (3,351,596), so models cannot look ahead. Each flow carries 82 CICFlowMeter features plus three label columns (Label, Anomaly, Attack_Type). The data is heavily imbalanced, and the cryptomining flows are labelled by capture source rather than verified packet by packet, so those labels should be treated as indicative. The companion software record (10.5281/zenodo.20795931) holds the inference code and the trained detection, mitigation and prediction models. Produced by AXON LOGIC IKE in the ROBUST-6G project (EU Smart Networks and Services JU, grant 101139068).