AirGuard-6LoWPAN Experimental Dataset: Cross-Layer RPL/6LoWPAN Cyberattack and Benign Radio-Impairment Simulation Data

This dataset accompanies the study “AirGuard-6LoWPAN: A Cause-Aware Cross-Layer Framework for Distinguishing Cyberattacks from Benign Radio Impairments in RPL-Based IoT Networks”. The dataset was generated using controlled Contiki-NG/Cooja simulations of a 16-mote IPv6/6LoWPAN network running RPL. It contains 70 final simulation runs covering seven operational scenarios, with ten independent simulation seeds (1001–1010) for each scenario. The evaluated conditions comprise four benign network states (Clean, RX90, RX75, and RX60) and three cyberattack scenarios (UDP Flood, DIS Flood, and DIO Flood). RX90, RX75, and RX60 represent progressively degraded receive-success simulator settings and should not be interpreted as deterministic packet-loss percentages. Each simulation run lasts 600 s. For attack scenarios, the experimental timeline consists of a 0–120 s warm-up period, a 120–180 s pre-attack period, an active attack interval from 180–540 s, and a 540–600 s recovery period. Mote 8 acts as the attacker in all attack scenarios. The archive contains the raw Contiki-NG/Cooja logs and run-level metadata for all 70 final simulations, together with the processed machine-learning datasets derived from these experiments. The processed data include 3,360 network-level 10-s windows, 53,760 node-level 10-s windows, and a primary modelling core containing 2,380 observations. A total of 43 predictive cross-layer features were derived from four protocol and operational domains: application/QoS, routing, MAC, and radio activity. Ground-truth variables, scenario identifiers, simulation seeds, run identifiers, time variables, attack-state indicators, simulator receive-success settings, and other leakage-prone variables were excluded from predictive model inputs. The dataset supports five diagnostic tasks: binary attack detection, cause-family classification, seven-class diagnosis, attack-subtype classification, and benign radio-impairment severity classification. The accompanying AirGuard-6LoWPAN software repository provides the Contiki-NG/Cooja configurations, firmware, preprocessing pipeline, machine-learning workflows, seed-separated evaluation procedure, statistical analyses, early-detection analysis, and SHAP-based explainability workflow required to reproduce the reported results. Associated software archive:DOI: 10.5281/zenodo.21977952 GitHub repository:https://github.com/trashboxtr/AirGuard-6LoWPAN All 70 final runs included in this dataset passed the project validation checks. SHA-256 checksums and a consolidated run-level manifest are provided to support integrity verification and reproducibility.