Edge-IIoTset: Comprehensive IoT & IIoT Cyber Security Dataset [~12 GB, 15 Attack Types]
Catalog Summary
"Realistic IoT/IIoT cybersecurity dataset supporting centralized and federated learning with 15 attack types across network, application, and protocol layers. CSV and PCAP formats (~12 GB). Available via IEEE Dataport and Kaggle. Designed for edge computing IDS research."
Catalog Notes
Overview
Edge-IIoTset is a comprehensive, realistic cybersecurity dataset for Internet of Things (IoT) and Industrial IoT (IIoT) applications, proposed to support both centralized and federated learning approaches. It was designed specifically to address the unique security challenges of edge computing environments, where heterogeneous IoT devices generate distributed traffic that must be secured with constrained resources.
The dataset captures 15 distinct attack types spanning multiple threat layers including network-level attacks (DoS/DDoS), application-layer attacks (MQTT/CoAP protocol abuse, web attacks), and reconnaissance and injection attacks. Traffic was collected from a diverse IoT testbed incorporating temperature sensors, soil moisture sensors, pH sensors, water level detection sensors, ultrasonic sensors, flame sensors, heart rate sensors, IR sensors, pressure sensors, and Raspberry Pi devices.
The raw PCAP files were pre-processed and converted to CSV format. The compressed archive is approximately 1.5 GB, expanding to ~12 GB uncompressed. The dataset is downloadable from IEEE Dataport and mirrored on Kaggle for convenience.
Column Schema
| Column | Description |
|---|---|
| frame.time | Packet capture timestamp. |
| ip.src / ip.dst | Source and destination IP addresses. |
| tcp.srcport / tcp.dstport | Source and destination TCP port numbers. |
| http.request.method | HTTP request method where applicable. |
| mqtt.topic | MQTT topic string where applicable. |
| Attack_label | Binary attack label (0 = normal, 1 = attack). |
| Attack_type | Specific attack type label (15 categories). |
Key Statistics
- Attack Types: 15 categories across network, application, and protocol layers
- IoT Device Types: 12+ sensor types including temperature, pH, soil moisture, heart rate, and Raspberry Pi
- File Format: CSV (pre-processed from PCAP)
- Compressed Size: ~1.5 GB; Uncompressed: ~12 GB
- Supported Tasks: Centralized ML and federated learning IDS
- Published: 2022
Use Cases
- Edge-computing-aware IoT intrusion detection and anomaly detection
- Federated learning model benchmarking for distributed IoT security
- Multi-layer attack classification across MQTT, CoAP, HTTP, and network protocols
- IIoT sensor data anomaly and injection attack detection
Source & Attribution
Edge-IIoTset was proposed by Mohamed Amine Ferrag and colleagues and published in IEEE Access (2022). The dataset is officially hosted on IEEE Dataport and is also available via Kaggle. It is one of the most cited recent IoT/IIoT cybersecurity datasets for edge and federated learning research.
Data Preview
| ip.src | ip.dst | mqtt.topic | Attack_type | Attack_label |
|---|---|---|---|---|
| 192.168.0.24 | 192.168.0.1 | home/temp | Normal | 0 |
| 192.168.0.24 | 198.51.100.5 | - | DDoS_HTTP | 1 |
| 192.168.0.31 | 10.0.0.2 | - | DoS_TCP | 1 |
| 192.168.0.28 | 10.0.0.9 | sensor/ph | MQTT_Publish | 1 |
| 192.168.0.24 | 192.168.0.1 | home/humidity | Normal | 0 |
Showing first few rows for preview
Cite This Dataset
Ferrag, Mohamed Amine, Friha, Othmane, Hamouda, Djallel, Maglaras, Leandros, & Janicke, Helge (2022). Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning. IEEE Access. [Dataset]. IEEE. https://www.kaggle.com/datasets/mohamedamineferrag/edgeiiotset-cyber-security-dataset-of-iot-iiot
Source metadata: IEEE (2022)
Indexed by IoTDataset.com on Apr 13, 2026
Review the Source Record
Confirm the licence, version, access conditions, file format, and provenance at the source before use.