UAV Communication Malware Dataset

This repository provides a multiyear UAV communication malware dataset designed to support reproducible research on intrusion and malware detection in UAV-enabled IoT networks. The dataset contains time-indexed communication and telemetry records sampled at a fixed 10-minute interval from 17 October 2021 to 31 October 2025 (inclusive). Each record summarizes network-flow behavior, command-and-control dynamics, telemetry stability indicators, session/protocol context, temporal trend descriptors, and interaction/coordination patterns derived from UAV communication activity among aerial nodes, ground control stations, and relay components. The dataset is intended for supervised multi-class classification, with a target label y_label capturing seven security states: (0) benign traffic, (1) botnet-controlled UAV traffic, (2) GPS spoofing, (3) command injection, (4) firmware-level malware, (5) distributed denial-of-service/flooding, and (6) data exfiltration behavior. Class occurrence is strongly imbalanced, reflecting realistic operational conditions where benign traffic dominates and attack events are comparatively rare. Feature values are also deliberately non-uniform and heavy-tailed, exhibiting skewness, burstiness, zero-inflation, and long-tail behavior commonly observed in telemetry and network traffic, which makes the dataset suitable for evaluating robustness under imbalance and distribution shifts. All records are anonymized and do not contain personal identifiers or sensitive operational metadata. The dataset is released for research use and secondary analysis. It is provided as a single CSV file with a timestamp column and 40+ traffic- and telemetry-derived features, enabling straightforward use in machine learning pipelines. File: uav_malware_traffic_10min_2021_2025.csvFormat: CSV, UTF-8Time column: timestamp (10-minute resolution) eature overview (grouped) The dataset includes the following feature families. 1) Flow-level communication statistics protocol_type, flow_duration_s, total_packets, total_bytes packet_rate_pps, byte_rate_Bps, avg_packet_size_B, packet_size_std_B interarrival_mean_s, interarrival_std_s, burstiness_index 2) Control and command dynamics command_frequency_hz, command_interval_var, command_entropy unauthorized_cmd_ratio, command_repetition_rate, command_response_delay_s 3) Telemetry consistency and stability gps_update_rate_hz, gps_position_drift_m, altitude_variance, velocity_variance heading_variation_deg, telemetry_loss_ratio, sensor_sync_error 4) Payload statistical characteristics payload_entropy, encrypted_payload_ratio, payload_size_skewness payload_repetition_score, abnormal_payload_ratio 5) Protocol and session context session_count, session_duration_avg_s, session_reset_rate auth_failure_count, connection_attempt_rate 6) Temporal trend descriptors traffic_trend_slope, latency_trend, packet_rate_variance_windowed command_drift_index, temporal_entropy_change 7) Interaction and coordination patterns peer_count, peer_switch_rate, broadcast_ratio uplink_downlink_ratio, coordinated_activity_score Target label y_label ∈ {0,…,6} representing benign and six malware/attack categories