IoT-SFC v2: An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments
Description
IoT-SFC is a large-scale labeled network traffic dataset collected from a realistic multi-protocol IoT/IIoT testbed. Unlike many existing datasets focused on a single domain, IoT-SFC covers smart agriculture, smart manufacturing, and video surveillance. The testbed primarily uses physical devices: an ESP32-based smart farm with sensors and actuators, a serial temperature sensor, a Tapo C200 IP camera, and a Modbus-based smart factory simulation. It follows an Edge–Fog–Cloud model and supports MQTT, HTTP, CoAP, Modbus, TCP, UDP, and Wi-Fi. The dataset contains benign and malicious traffic. Fourteen attack types were executed sequentially, one at a time, in an isolated laboratory: network scanning, SSH brute-force (Hydra), HTTP flood, SYN flood, UDP flood, Slowloris, simulated botnet DDoS, ARP spoofing (MITM), MQTT DoS, MQTT spoofing, MQTT brute-force, MQTT sniffing, MQTT malformed packets, and a combined Tapo C200 camera attack. Following verification and recovery of all attack session logs, a comprehensive set of fields was extracted from Zeek. The final dataset contains 49,902,287 records and 88 columns (13.85 GB uncompressed). Key statistics: * Normal traffic: 81.44% (40,642,071 records) * Attack traffic: 18.56% (9,260,216 records) * Most frequent attacks: scanning (8.06%), SYN flood (3.09%), MQTT DoS (2.63%), camera attack (1.84%) * Dominant protocols: UDP (76.23%) and TCP (18.55%) * Main Zeek logs: dns.log (65.40%), conn.log (29.54%), weird.log (2.34%), mqtt_publish.log (0.89%) Records are merged from multiple Zeek log types (conn.log, dns.log, http.log, ssl.log, ssh.log, mqtt_*.log, weird.log, notice.log, files.log, etc.). Consequently, many protocol-specific columns are sparsely populated. Core fields such as timestamps, addresses, ports, attack labels, and log metadata are generally available, while DNS, connection, HTTP, MQTT, SSL/TLS, and SSH attributes occur only in records from their corresponding logs. This structure should be considered during feature selection and preprocessing. The dataset provides connection-, protocol-, and application-level features, including addresses, ports, protocols, services, duration, byte and packet counts, connection states, DNS, HTTP, SSH, SSL/TLS, MQTT, file hashes, and Zeek notices. No preprocessing, balancing, normalization, or encoding has been applied. The dataset is released in raw labeled form, allowing researchers to apply their own preparation pipelines. IoT-SFC supports IoT/IIoT intrusion detection, binary and multiclass classification, anomaly detection, ML/DL evaluation, and protocol-specific studies, particularly MQTT. Data collection period: 3–17 April 2025. Attacks were executed one at a time. Released files: * iot_dataset_complete.zip — labeled dataset (iot_dataset_complete.csv, 13.85 GB) * zeek_backups.zip — raw Zeek logs * all_attacks_logs.csv — complete attack sessions with precise start/end timestamps All data were generated in an isolated laboratory testbed.
Files
Steps to reproduce
1- Set up the IoT/IIoT testbed using the Edge–Fog–Cloud architecture, including the ESP32-based smart farm, temperature sensors, Modbus-based factory simulation, and Tapo C200 network camera. 2- Configure the monitoring infrastructure using Zeek, Suricata, and Wazuh to continuously collect network traffic, protocol information, and security alerts. Generate normal IoT traffic under normal operating conditions across the different devices and communication protocols. 3- Launch the attack scenarios from the isolated Kali Linux attacker machine. The dataset includes 13 attack categories, including scanning, SSH brute force, HTTP flood, SYN/UDP flood, MQTT attacks, ARP-spoofing MITM, simulated botnet DDoS, and Slowloris. 4- Monitor and collect the generated traffic and logs during the attack sessions using Zeek, Suricata, and Wazuh. The attacks were conducted during several sessions in April 2025. 5- Extract and merge relevant Zeek log information, including connection, protocol, service, duration, exchanged bytes, and protocol-specific information from sources such as conn.log, http.log, dns.log, and MQTT logs. 6- Associate network records with the corresponding attack windows to generate the binary attack label (0 = normal, 1 = attack) and the type_of_attack label. 7- Export the consolidated records into the final iot_dataset.csv file. The dataset is released in raw, unprocessed form without balancing, scaling, or encoding.
Institutions
- Naif Arab University for Security SciencesRiyadh Region, Riyadh