Cybersecurity dataset of water distribution plant communications under DDoS attacks

This dataset contains MQTT communication data from a water distribution control system subjected to Distributed Denial-of-Service (DDoS) attacks targeting the MQTT broker. Four types of DDoS attacks are represented: Volumetric attacks, generating high message rates Burst attacks, with intermittent high-frequency traffic from multiple clients Low-and-slow attacks, characterized by low rates and large payload sizes Amplification attacks, where each message triggers multiple responses Attack traffic is generated in parallel from multiple simulated sources and intensifies over time. In addition to valid control payloads, random data of varying sizes is injected to increase network and broker load. Due to storage constraints, some auxiliary payload data is not fully recorded in the CSV files. Attack campaigns have variable durations and are subject to strict cooldown periods, ensuring realistic alternation between normal operation and attack conditions. Acknowledgements This activity is carried out in execution of the Strategic Project "Critical infrastructures cybersecure through intelligent modeling of attacks, vulnerabilities and increased security of their IoT devices for the water supply sector" (C061/23), the result of a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of A Coruña. This initiative is carried out within the framework of the funds of the Recovery, Transformation and Resilience Plan, financed by the European Union (Next Generation), the project of the Government of Spain that outlines the roadmap for the modernization of the Spanish economy, the recovery of economic growth and job creation, for the solid, inclusive and resilient economic reconstruction after the COVID19 crisis, and to respond to the challenges of the next decade.