Keystroke-Protect: Network Traffic Dataset for Keylogger Detection via Flow-Level Feature Analysis

This dataset contains 1,487 flow-level network traffic samples (743 keylogger, 744 benign/normal) collected to support the study "Keystroke-Protect: A Machine Learning Approach to Keylogger Detection via Network Traffic Analysis." Keylogger traffic was generated using five custom-built client-server keylogger implementations, covering four distinct exfiltration strategies: periodic, buffered, event-driven, and hybrid transmission of captured keystroke data to a remote listener. Benign traffic was captured from ordinary background network activity on the same hosts during comparable time windows. Each row represents a single network flow, summarized by volumetric and timing statistics (packet counts, byte counts, packet rates, mean and standard deviation of packet size, and coefficient of variation in both directions) along with network-identifier fields (source/destination IP, source/destination port, and transport protocol). All IP addresses in this dataset are private/internal lab addresses and do not correspond to real external hosts, individuals, or organizations. This dataset was specifically constructed to support a feature-ablation analysis testing whether classifier accuracy in ML-based keylogger detection reflects genuine behavioral signal (packet-volume and timing statistics) or is partly driven by network-identifier artifacts (IP, port, protocol) specific to the lab environment in which the data was collected — a question not addressed by prior published datasets in this area