MedibotDDoS Dataset (2025)

The MedibotDDoS dataset captures 200K+ traffic records with 13 features, representing benign and attack traffic against a medical syringe pump control system. It demonstrates how botnet-induced DDoS traffic disrupts healthcare devices, making it valuable for intrusion detection, anomaly detection, and medical device security research. Context The MedibotDDoS dataset was generated during an experimental evaluation of a botnet attack against a medical syringe pump control system. The attack demonstrated how a DDoS (Distributed Denial of Service) could delay or halt the responsiveness of the control GUI, creating serious patient safety risks (e.g., multiple unintended “run” button presses leading to triple dosing). Dataset Composition Number of samples: 225,498 instances Features: 13 network traffic features describing flow-level behavior Feature Descriptions SrcBytes – Number of bytes from source → destination SrcLoad – Source → destination bits per second DstBytes – Number of bytes from destination → source DstLoad – Destination → source bits per second DstPkts – Number of packets from destination → source SrcRate – Packets per second from source → destination DstRate – Packets per second from destination → source Dur – Transaction duration (seconds) TotPkts – Total transaction packets TotBytes – Total transaction bytes Load – Total transaction bits per second Rate – Overall packets per second Descriptive Statistics (Selected Highlights) SrcBytes: mean 286.3, max 435,324 SrcPkts: mean 2.4, max 4,890 DstPkts: mean 0.94, max 2,411 DstBytes: mean 1052.6, max 12,858,140 Dur: mean 0.44 sec, max 5 sec TotPkts: mean 3.38, max 5,979 TotBytes: mean 1,339, max 13,230,630 Load: mean 4,778,348 bps, max 15,168,000,000 bps Rate: mean 2,535 pps, max 4,000,000 pps