"ANF-IoT: A Unified Multi-Protocol IoT Dataset for Faulty Traffic and DDoS Attacks Detection"

"Internet of Things (IoT) networks are widely used in critical infrastructure environments such as healthcare and industrial systems, where  Intrusion Detection Systems (IDS) rely on benchmark datasets for training and evaluation. However, most existing datasets consider only normal and attack traffic, ignoring faulty traffic caused by communication errors, device malfunctions, or software anomalies. This creates a gap in current datasets, as faulty traffic is not included as a separate class despite its impact on detection performance. In many cases, faulty traffic resembles Distributed Denial of Service (DDoS) attacks, leading to misclassification. To address this gap, we present ANF-IoT (Attack, Normal, and Fault IoT), a multiprotocol dataset generated on a real testbed. The testbed consists of more than 50 physical devices, including Raspberry Pi 5,Raspberry Pi 4, Raspberry Pi 3, and PicoW. The dataset captures traffic across five protocols (UDP, TCP, MQTT, HTTP, TLS) with three explicitly labelled classes: normal, attack, and faulty, resulting in 3.25 million records. The dataset reflects realistic IoT conditions, where the attack class covers DDoS scenarios, while the faulty class captures fault-driven traffic that mimics DDoS. This behaviour is validated using the Mann\u2013Whitney U test and Cliff\u2019s delta, with a moderate similarity design between attack and faulty traffic, while normal traffic remains clearly distinguishable. A five-stage data validation pipeline is used to ensure a clean, leakage-free, and machine learning (ML)-ready dataset. Experimental evaluation using nine classical machine learning models and tabular deep learning models shows an accuracy of approximately 83.5% and 78% F1-score for the faulty class. The result with these per-flow models reflects a non-trivial characteristic of such an ANF-IoT dataset. Although these models separate normal traffic from adversarial classes with above 93% accuracy, they cannot fully resolve the close similarity between faulty and attack behaviour."