CICIoT2023 - Large-Scale IoT Intrusion Detection Dataset

Dataset Overview

The CICIoT2023 dataset is a flagship large-scale intrusion detection resource developed by the Canadian Institute for Cybersecurity (CIC) at the University of New Brunswick. This dataset represents one of the most comprehensive IoT security benchmarks available, capturing realistic attack scenarios across a diverse testbed of 105 real IoT devices.

Testbed Infrastructure

The dataset was collected from a sophisticated IoT laboratory featuring 105 real devices from multiple manufacturers, including smart home devices (cameras, lights, thermostats, smart speakers), industrial equipment (sensors, controllers), and network infrastructure. The complex network topology emulates real-world conditions with proper segmentation, gateways, and cloud connectivity.

Attack Coverage - 33 Distinct Types

The dataset captures seven major attack categories with 33 specific attack implementations:

DDoS Attacks (12 variants)

ACK Fragmentation, HTTP Flood, ICMP Flood, ICMP Fragmentation, PSHACK Flood, RSTFIN Flood, SYN Flood, SlowLoris, Synonymous IP Flood, TCP Flood, UDP Flood, UDP Fragmentation

DoS Attacks (4 variants)

HTTP Flood, SYN Flood, TCP Flood, UDP Flood

Mirai Botnet (3 variants)

greeth_flood, greip_flood, udpplain attacks simulating real Mirai malware behavior

Reconnaissance (4 types)

Host Discovery, OS Scan, Ping Sweep, Port Scan

Web-Based Attacks (3 types)

Browser Hijacking, Command Injection, SQL Injection

MITM Attacks

ARP Spoofing, DNS Spoofing

Others

Backdoor Malware, Dictionary Brute Force attacks

Dataset Statistics

• Total Size: 8.94 GB compressed
• Files: 310 CSV files organized by attack category
• Features: 12,100+ columns including flow-based features, packet statistics, protocol information, timing metrics, and behavioral patterns
• Records: Millions of labeled network flows
• Format: CSV with both raw PCAP and extracted features available

Feature Set Excellence

Features extracted using CICFlowMeter include bidirectional flow statistics, packet length distributions, inter-arrival times, flag counts, protocol headers, TCP/UDP specific metrics, and advanced statistical features (mean, std, min, max, variance) for comprehensive traffic characterization.

Research Applications

• Training next-generation intrusion detection systems for IoT environments
• Benchmarking machine learning and deep learning algorithms
• Developing anomaly detection models for diverse IoT device types
• Testing zero-day attack detection capabilities
• Network forensics and incident response research
• Federated learning for distributed IoT security

Academic Recognition

Published and maintained by UNB CIC with continuous updates. Widely cited in academic research and used as benchmark in numerous IEEE and ACM publications. Supports both traditional ML (Random Forest, SVM, XGBoost) and deep learning approaches (CNN, LSTM, Transformers).