Keystroke-Protect: Network Traffic Dataset for Keylogger Detection via Flow-Level Feature Analysis
Description
This dataset contains 1,487 flow-level network traffic samples (743 keylogger, 744 benign/normal) collected to support the study "Keystroke-Protect: A Machine Learning Approach to Keylogger Detection via Network Traffic Analysis." Keylogger traffic was generated using five custom-built client-server keylogger implementations, covering four distinct exfiltration strategies: periodic, buffered, event-driven, and hybrid transmission of captured keystroke data to a remote listener. Benign traffic was captured from ordinary background network activity on the same hosts during comparable time windows. Each row represents a single network flow, summarized by volumetric and timing statistics (packet counts, byte counts, packet rates, mean and standard deviation of packet size, and coefficient of variation in both directions) along with network-identifier fields (source/destination IP, source/destination port, and transport protocol). All IP addresses in this dataset are private/internal lab addresses and do not correspond to real external hosts, individuals, or organizations. This dataset was specifically constructed to support a feature-ablation analysis testing whether classifier accuracy in ML-based keylogger detection reflects genuine behavioral signal (packet-volume and timing statistics) or is partly driven by network-identifier artifacts (IP, port, protocol) specific to the lab environment in which the data was collected — a question not addressed by prior published datasets in this area
Files
Steps to reproduce
Keylogger traffic was generated using five custom client-server keylogger implementations, each following one of four exfiltration patterns (periodic, buffered, event-driven, hybrid). Traffic was captured using packet capture tools during controlled sessions on lab hosts, alongside benign background traffic captured on the same hosts. Captured packets were aggregated into per-flow records and summarized into the volumetric, timing, and identifier features listed in the accompanying README, producing the balanced_data.csv file.
Institutions
- University of KashmirJammu and Kashmir, Srinagar