BADTFD-IoTN: Botnet Anomaly Detection Traffic Flow Dataset for IoT Networks

BADTFD-IoTN: Botnet Anomaly Detection Traffic Flow Dataset for IoT Networks BADTFD-IoTN (Botnet Anomaly Detection Traffic Flow Dataset for IoT Networks) is a hybrid IoT cybersecurity dataset developed to support research in intrusion detection systems (IDS), anomaly detection, botnet detection, network traffic classification, and cybersecurity analytics in Internet of Things (IoT) environments. The dataset combines both simulated and real-time IoT traffic to facilitate robust evaluation of machine learning and deep learning models under controlled and realistic network conditions. The dataset consists of two complementary components: D1 – Simulated Dataset (CSTFD)A controlled IoT traffic dataset generated using the NetSim simulation platform containing benign and malicious traffic under predefined attack scenarios for controlled experimentation and reproducible benchmarking. D2 – Real-Time Testbed DatasetA large-scale IoT traffic dataset generated using an 11-device physical IoT testbed over 10 consecutive days (Oct 21–30, 2024). The dataset captures realistic IoT device interactions along with controlled cyberattack execution in laboratory settings. Dataset Highlights Hybrid Dataset Design: Simulated + Real-Time IoT Traffic Traffic Type: Benign and Malicious Network Traffic D1 Records: 102,734 D2 Records: 162,748,433 D2 Collection Period: 10 Days Real-Time Testbed: 11 Physical IoT Devices Attack Categories Covered: Fingerprinting & Probing (Port Scanning, OS Fingerprinting) DoS Attacks (TCP, UDP, HTTP) DDoS Attacks (TCP, UDP, HTTP) Information Theft (ARP Spoofing) Sleep Deprivation Attacks Multivector IoT Attack Scenarios The repository includes: D1_Simulated_Dataset – Controlled simulation-based IoT traffic D2_Real_Time_Testbed_Dataset – Scenario-based real-world IoT traffic collected over 10 days BADTFD_IoTN_Sample_Dataset – Lightweight sample datasets for rapid experimentation Scripts – Preprocessing, feature extraction, and dataset preparation utilities Dataset_Description.pdf – Complete documentation of dataset organization, metadata, attack coverage, structure, and usage guidelines. Important Note:Each D2 scenario traffic file contains both benign IoT communication and malicious activity corresponding to the specific scenario. Therefore, files should be interpreted as scenario-specific mixed traffic captures rather than attack-only traces. Detailed information regarding dataset generation methodology, experimental setup, attack orchestration, feature extraction, labeling strategy, and evaluation workflow is provided in the accompanying Dataset_Description.pdf and the associated research article. License: CC BY 4.0