AdDDoSDN: Adversarial DDoS Attacks Dataset for Software-Defined Networks

The AdDDoSDN dataset is a comprehensive network traffic corpus built for defensive SDN research, capturing coordinated DDoS attacks and benign enterprise activity through controlled Mininet experiments driven by a remote Ryu L3 controller to deliver high-quality labeled data for real-time detection development. The environment emulates a segmented four-subnet enterprise: h1 (192.168.10.10/24) acts as the external attacker, h2–h5 (192.168.20.10–13/24) form the corporate client subnet with h2 handling ICMP exchanges and h3/h5 generating rich TCP and UDP application sessions, h6 (192.168.30.10/24) resides in the server/DMZ subnet as the primary victim, and controller services operate on 192.168.0.0/24, providing realistic inter-subnet attack paths while preserving centralized SDN visibility. The dataset follows a structured, configurable timeline sourced from config.json, with the default cycle spanning roughly 35 minutes per run: a 5-second initialization period, 1,600 seconds of benign traffic mixing ICMP, Telnet, SSH, FTP, HTTP/S, and DNS exchanges, enhanced traditional attacks from h1 including an 88-second SYN flood and 176-second UDP flood against h6, plus an 88-second ICMP flood toward h4, and adversarial attacks from h1 to h6 comprising a 72-second TCP state-exhaustion phase with human-like timing patterns, a 24-second application-layer mimicry burst combining heavy HTTP range/post requests with legitimate queries, and a 72-second slow-read phase sustaining long-lived connections. Traditional phases operate around 20–30 packets per second with protocol-compliant options, while adversarial scripts emphasize mimicry and timing jitter. The dataset provides three synchronized data products derived from each capture cycle: 1. Packet-level data (adddosdn_packet_dataset.csvv): 30 header fields + 2 labels extracted directly from PCAP phases. 2. SDN flow-level data (adddosdn_flow_dataset.csv): Controller statistics with derived rates and labels collected via the Ryu REST API. 3. CICFlow aggregated data (adddosdn_cicflow_dataset.csv): 85 bidirectional behavioral features generated with CICFlowMeter. The dataset demonstrates exceptional quality containing 3.5 million total records across dataset instances, each representing different temporal scenarios. Labels span normal, syn_flood, udp_flood, icmp_flood, ad_syn, ad_udp, and ad_slow, with Label_binary collapsing them into benign (0) versus malicious (1) classes to maintain consistency across packet, controller-flow, and behavioral representations.AdDDoSDN数据集是专为软件定义网络（Software Defined Network, SDN）防御研究构建的综合性网络流量语料库，通过由远程Ryu三层控制器驱动的受控Mininet实验，采集协同分布式拒绝服务（Distributed Denial of Service, DDoS）攻击与正常企业网络活动数据，为实时检测技术开发提供高质量的带标签数据集。 该实验环境仿真了一个划分了四个子网的企业网络：h1（192.168.10.10/24）作为外部攻击者节点，h2~h5（192.168.20.10~13/24）组成企业客户端子网，其中h2负责互联网控制报文协议（Internet Control Message Protocol, ICMP）流量交互，h3与h5生成丰富的传输控制协议（Transmission Control Protocol, TCP）与用户数据报协议（User Datagram Protocol, UDP）应用会话流量；h6（192.168.30.10/24）位于服务器/隔离区（Demilitarized Zone, DMZ）子网中，作为主要受攻击目标；控制器服务部署于192.168.0.0/24网段，既提供了贴合实际的跨子网攻击路径，又保留了集中式SDN的全局可视性。 该数据集遵循由config.json定义的结构化、可配置时间线，默认单次运行周期约为35分钟：包含5秒的初始化阶段，1600秒的正常流量阶段（混合ICMP、Telnet、SSH、FTP、超文本传输协议/安全超文本传输协议（HTTP/S）与域名系统（DNS）流量交互），由h1发起的增强型传统攻击（包括针对h6的88秒SYN洪泛攻击与176秒UDP洪泛攻击，以及针对h4的88秒ICMP洪泛攻击），以及由h1针对h6发起的对抗性攻击：包含72秒的类人定时模式TCP状态耗尽阶段、24秒的应用层模仿流量爆发阶段（结合大量HTTP范围请求/POST请求与合法查询流量），以及72秒的慢速读取阶段（维持长连接）。传统攻击阶段的数据包速率约为20~30包/秒，且符合协议规范；对抗性脚本则着重于流量模仿与定时抖动效果。 该数据集为每次捕获周期提供三种同步生成的数据产物： 1. 数据包级数据（adddosdn_packet_dataset.csvv）：从数据包捕获（Packet Capture, PCAP）阶段直接提取的30个报文头字段与2个标签。 2. SDN流级数据（adddosdn_flow_dataset.csv）：通过Ryu表述性状态转移应用程序编程接口（Representational State Transfer Application Programming Interface, REST API）采集的控制器统计信息、衍生速率与标签。 3. CICFlow聚合数据（adddosdn_cicflow_dataset.csv）：由CICFlowMeter工具生成的85个双向行为特征。 该数据集整体质量优异，各数据集实例总计包含350万条记录，每个实例对应不同的时间场景。标签类型涵盖normal、syn_flood、udp_flood、icmp_flood、ad_syn、ad_udp和ad_slow；同时提供二分类标签Label_binary，将所有样本划分为benign（0）与malicious（1）两类，以确保数据包级、控制器流级与行为级数据表示的一致性。