IoT-SFC v2: An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments

IoT-SFC is a large-scale labeled network traffic dataset collected from a realistic multi-protocol IoT/IIoT testbed. Unlike many existing datasets focused on a single domain, IoT-SFC covers smart agriculture, smart manufacturing, and video surveillance. The testbed primarily uses physical devices: an ESP32-based smart farm with sensors and actuators, a serial temperature sensor, a Tapo C200 IP camera, and a Modbus-based smart factory simulation. It follows an Edge–Fog–Cloud model and supports MQTT, HTTP, CoAP, Modbus, TCP, UDP, and Wi-Fi. The dataset contains benign and malicious traffic. Fourteen attack types were executed sequentially, one at a time, in an isolated laboratory: network scanning, SSH brute-force (Hydra), HTTP flood, SYN flood, UDP flood, Slowloris, simulated botnet DDoS, ARP spoofing (MITM), MQTT DoS, MQTT spoofing, MQTT brute-force, MQTT sniffing, MQTT malformed packets, and a combined Tapo C200 camera attack. Following verification and recovery of all attack session logs, a comprehensive set of fields was extracted from Zeek. The final dataset contains 49,902,287 records and 88 columns (13.85 GB uncompressed). Key statistics: * Normal traffic: 81.44% (40,642,071 records) * Attack traffic: 18.56% (9,260,216 records) * Most frequent attacks: scanning (8.06%), SYN flood (3.09%), MQTT DoS (2.63%), camera attack (1.84%) * Dominant protocols: UDP (76.23%) and TCP (18.55%) * Main Zeek logs: dns.log (65.40%), conn.log (29.54%), weird.log (2.34%), mqtt_publish.log (0.89%) Records are merged from multiple Zeek log types (conn.log, dns.log, http.log, ssl.log, ssh.log, mqtt_*.log, weird.log, notice.log, files.log, etc.). Consequently, many protocol-specific columns are sparsely populated. Core fields such as timestamps, addresses, ports, attack labels, and log metadata are generally available, while DNS, connection, HTTP, MQTT, SSL/TLS, and SSH attributes occur only in records from their corresponding logs. This structure should be considered during feature selection and preprocessing. The dataset provides connection-, protocol-, and application-level features, including addresses, ports, protocols, services, duration, byte and packet counts, connection states, DNS, HTTP, SSH, SSL/TLS, MQTT, file hashes, and Zeek notices. No preprocessing, balancing, normalization, or encoding has been applied. The dataset is released in raw labeled form, allowing researchers to apply their own preparation pipelines. IoT-SFC supports IoT/IIoT intrusion detection, binary and multiclass classification, anomaly detection, ML/DL evaluation, and protocol-specific studies, particularly MQTT. Data collection period: 3–17 April 2025. Attacks were executed one at a time. Released files: * iot_dataset_complete.zip — labeled dataset (iot_dataset_complete.csv, 13.85 GB) * zeek_backups.zip — raw Zeek logs * all_attacks_logs.csv — complete attack sessions with precise start/end timestamps All data were generated in an isolated laboratory testbed.