A Topology Poisoning Attack Dataset for Machine Learning-Based Detection in Software-Defined Networks
Description
The Topology Poisoning Attack (TPA) Dataset is a novel labeled collection of 247,346 network flow records with 86 features, created to address the scarcity of comprehensive public datasets for detecting Topology Poisoning Attacks (TPA) in Software-Defined Networks (SDN). TPA Dataset is a multi-controller, multi-variant TPA dataset generated under controlled conditions will enable effective machine-learning detection of sophisticated host-location hijacking and link-fabrication attacks that existing SDN datasets largely omit. Binary labels divide the data into normal or benign traffic, which accounts for 68,424 flows (27.7%), and attack traffic, which accounts for 178,922 flows (72.3%). Label 0 denotes normal traffic and label 1 denotes attack traffic. A finer category field further distinguishes the records: Benign traffic was drawn from the InSDN dataset while three novel attack scenarios, Persistent Ghost Host (PGH, a host-location hijacking variant), Chameleon Topography (CT, an adaptive link-fabrication attack), and a Combined Topology-Aware Host Hijacking orchestrator, were executed with Scapy scripts and captured by tcpdump; CICFlowMeter then extracted the statistical features. The resulting classes are Benign (category 0, 68424 flows), Link Fabrication plus CT (category 1, 69723 flows), Host Location Hijacking plus PGH (category, 4423 flows), and Combined (category 3, 104776 flows). Baseline evaluation with machine learning models after cleaning, feature selection, and SMOTE established indicates that ensemble methods such as LightGBM, Random Forest, and XGBoost are the strongest. Users may therefore interpret the set as a reproducible SDN-security benchmark for binary or multi-class TPA detection, model comparison and the design of defenses against multi-stage topology poisoning.
Files
Steps to reproduce
The dataset was generated within an isolated virtualized testbed running Ubuntu 20.04 with 8GB RAM and 2 vCPUs. Network emulation was performed using Mininet 3.0 with OpenFlow 1.3 support, creating a linear topology of four Open vSwitch switches and four hosts. One host served as the attacker, another as the victim, and two as legitimate nodes, each assigned unique IP addresses. Three mainstream SDN controllers, RYU, Floodlight, and OpenDayLight, were separately deployed to manage the network. All controllers used the OpenFlow Discovery Protocol with LLDP for topology discovery, ensuring comparable TDS implementations. Benign traffic was generated following InSDN protocols, simulating HTTP/HTTPS, FTP, DNS, SSH, SMB, NFS, ICMP, multimedia streaming, and email services. Three novel attack scenarios were implemented using custom Python scripts with Scapy and Arping: Persistent Ghost Host (host location hijacking), Chameleon Topography (adaptive link fabrication), and a Combined Attack Orchestrator. Each attack was executed multiple times per controller (10-29 runs, 10 minutes each), with successful runs verified through controller logs, flow table inspection, and connectivity tests. All traffic was captured using tcpdump as .pcap files, organized by experimental type (benign, HLH_PGH, LF_CT, Combined). CICFlowMeter extracted 82 statistical features per bidirectional flow. Additional metadata (flow_id, label, _source, category) were appended for traceability, yielding 247,346 samples with 86 features. The preprocessing pipeline removed duplicates and constant columns, imputed missing values using median/mode, and engineered interaction features. Two-stage feature selection using Random Forest and XGBoost importance scores pruned features from 102 to 51. Data was split 60:20:20 using stratified sampling and standardized with StandardScaler. SMOTE was applied exclusively to training data to address class imbalance.
Institutions
- The University of DodomaDodoma, Dodoma