Internet of Medical Things IDS dataset with BLE, IP packet, and IP flow captures. CSV and pickle formats, 2.7 GB, for ML-based healthcare IoT intrusion detection.
Free CC0 synthetic dataset: 4,000 rows of Modbus, OPC UA and DNP3 flows labelled for SCADA intrusion detection. 21% Attacks. Reproducible from its seed.
Real IoT botnet traffic dataset from 9 commercial devices (webcams, routers, thermostats) authentically infected by Mirai and BASHLITE. Over 7M records, 115 statistical features. CSV format. Benchmark for deep-learning-based IoT anomaly and botnet detection.
Large-scale distributed IoT IDS benchmark with traffic captured at individual device interfaces across 78 heterogeneous smart city IoT devices using the Gotham testbed. PCAP and CSV. Published January 2026 on Zenodo. Designed for federated learning and decentralised IDS research.
First open Zigbee IoT dataset with fully decrypted payloads, captured from a real smart home with 15 Zigbee devices over 20 days. Distributed as a single archive (dataset.tar.gz, 663.4 MB) of pcap captures with the network key included. Published October 2024 on Zenodo under CC BY 4.0.
Free CC0 synthetic dataset: 10,000 rows of Modbus, OPC UA and DNP3 flows labelled for SCADA intrusion detection. 29% Attacks. Reproducible from its seed.
Large-scale IoT cybersecurity dataset with 47M+ labeled network flows from 105 real IoT devices across 33 attack types in 7 categories. PCAP and CSV formats. Built for IDS/IPS development and ML-based IoT traffic classification research.
Heterogeneous IoT/IIoT dataset from UNSW Canberra Cyber Range with network traffic, Windows/Linux OS traces, and IoT sensor telemetry. Labeled for 9 attack types including DoS, DDoS, ransomware, and XSS. CSV and PCAP formats. Benchmark for AI-based IDS evaluation.
Real IoT malware traffic dataset with 325M labeled network flows from 20 malware and 3 benign device captures over 500+ hours. PCAP and Zeek conn.log formats. Used for IoT botnet detection, malware traffic classification, and ML security research.
Real-time IoT network security dataset from a live IoT infrastructure with 41 bidirectional flow features. Includes ThingSpeak-LED, Wipro-Bulb, and MQTT-Temp devices with SSH brute force, DDoS (Hping/Slowloris), and Nmap attack scenarios. CSV format. Used for adaptive IDS development.