IoT-Zoo Network Traffic

This dataset consists of 690,780 network packet samples extracted from the IoT-Zoo testbed. It represents a 600-second execution of a heterogeneous IoT environment, featuring 43 distinct device profiles spanning Urban Observatory, Industrial, e-Health, and Smart Farming domains. Technical Specifications The dataset is the result of a synchronized fusion between two network analysis engines (Scapy and Tshark), providing a high-dimensional view of each packet. Unlike flow-based datasets, this is a packet-level collection, where each row represents an individual network frame. Dataset Characteristics Total Samples: 690,780 packets. Total Features: 17 columns (L3 to L7). Trace Duration: 600 seconds. Device Heterogeneity: Covers telemetry from multiple domains with preserved temporal dynamics. Application Semantics: Includes structured payloads (JSON/XML) replayed from real-world datasets. Column Definitions (Schema) pkt_index: Unique sequential identifier for each packet. time_epoch: High-precision Unix timestamp of arrival. frame_len: The total length of the Ethernet frame in bytes. ip_src / ip_dst: Source and Destination IPv4 addresses. ip_proto: Layer 3 protocol identifier (e.g., 6 for TCP). ip_ttl: Time to Live (useful for hop-count and spoofing analysis). src_port / dst_port: Layer 4 source and destination ports. app_protocol: Application layer protocol identified via Tshark's deep packet inspection (e.g., MQTT, NTP, DNS, RTSP). tcp_flags_hex: Raw TCP flags in hexadecimal format (0x00000000), optimized for numerical Machine Learning input. tcp_flags_str: Human-readable TCP flag mnemonics (e.g., PA, S, A) extracted via Scapy. tcp_seq: TCP sequence number for session tracking. mqtt_topic: The specific MQTT topic (e.g., hospital/patients, city/air/co). mqtt_msgtype: MQTT message type (e.g., 3 for Publish, 1 for Connect). mqtt_qos: Quality of Service level of the MQTT message. mqtt_len: Length of the MQTT application payload. Intended Use This CSV is ready for downstream Machine Learning tasks such as: Anomaly Detection: Using frame_len and time_epoch (IAT) to identify volumetric or timing-based attacks. Protocol Classification: Leveraging app_protocol and tcp_flags_hex for identifying IoT-specific behaviors. Security Research: Serving as a baseline for legitimate IoT traffic patterns in heterogeneous environments.