Gotham Dataset 2025: A Reproducible Large-Scale IoT Network Dataset for Intrusion Detection

Overview

The Gotham Dataset 2025 is a comprehensive, reproducible IoT network security dataset designed to advance intrusion detection and security research in large-scale heterogeneous IoT environments.

Data Collection

• Network traffic captured from a testbed containing over 100 diverse IoT devices spanning smart home (cameras, thermostats, lights), wearables (fitness trackers), industrial sensors, and smart appliances.
• Collected in a distributed manner with traffic captured separately for each device at the IoT gateway interface, enabling device-level analysis.
• The dataset includes both normal operational behavior across multiple days and various attack scenarios injected into the network.

Attack Scenarios

• Botnet attacks: Mirai and other IoT botnets performing DDoS, scanning, and propagation.
• Reconnaissance: Network scanning and device fingerprinting attacks.
• Man-in-the-Middle: Traffic interception and manipulation between IoT devices and cloud services.
• Data exfiltration: Unauthorized data transmission from compromised devices.

Dataset Structure

• Over 23.8 GB of network traffic data in PCAP and processed CSV formats.
• Per-device traffic captures enabling fine-grained analysis of individual IoT device behavior.
• Rich flow-based features including packet sizes, inter-arrival times, protocol distributions, and behavioral statistics.
• Labeled data with attack types, timestamps, and device identifiers.

Use Cases

• Developing and benchmarking IoT-specific intrusion detection systems at scale.
• Research on device fingerprinting, behavioral profiling, and anomaly detection in heterogeneous IoT networks.
• Evaluating machine learning models for IoT security in realistic multi-device environments.