CESNET-CC25: Dataset for detection of C&C communication of botnets in the periodic behavior features from multiflow time series format

We introduce a novel dataset, CESNET-CC25, specifically designed to capture up-to-date botnet C&C traffic patterns to address these shortcomings. This dataset provides a richer and more representative collection of contemporary threats, enabling more reliable evaluation of detection methods against modern botnet behaviors, including decentralized architectures and encrypted communications. The IP addresses of benign traffic from the CESNET network were anonymized. The PCAP of botnet communication are available here: https://zenodo.org/records/16752462 The IP flow format of the dataset is available here: https://zenodo.org/uploads/16753890 Directory Structure - benign - contains extracted benign periodic features of multiflows time series- botnet - contains extracted botnet periodic features of multiflows time series - <botnet|benign>/<sample_folder>/<aggregation_interval>/ - this represents directory structure Botnet directory metadata +----------------------+| Folder | Family ||------------|---------|| 1-u4 | Gafgyt || 2-u5 | Mirai || 3-u6 | Mirai || 4-u7 | Mirai || 5-u8 | Mirai || 6-u8_2 | Kaiji || 7-u6_3 | Mirai || 8-u8_3 | Mirai || 9-u0_0 | Miori || 10-u5_4 | Hailbot || 11-u6_4 | Gafgyt || 12-u7_4 | Mirai || 13-u8_4 | Hailbot || 14-u9 | Hailbot || 15-u10 | Mirai || 16-u11 | Gafgyt || 17-u10_3 | Hailbot || 18-u11_2 | Mirai || 19-u11_3 | Mirai || 20-u9_4 | Gafgyt || 21-u10_4 | Mirai || 22-u11_5 | Gafgyt || 23-u12_5 | Gafgyt || 24-u12_6 | Mirai || 25-u9_7 | Xorbot || 26-u10_7 | Gafgyt || 27-u12_7 | Hailbot || 28-u9_8 | Gafgyt || 29-u10_8 | Mirai || 30-u11_8 | Gafgyt || 31-u9_9 | Gafgyt || 32-u12_9 | Mirai |+----------------------+ combined - directory that contains all separated botnets together