IoT-DH Dataset: IoT DDoS Honeypot for Classification, Identification, and Detection of DDoS Attacks in IoT

Overview

IoT-DH Dataset is a dataset of distributed denial-of-service (DDoS) attacks targeting IoT environments, introduced in a 2024 Data in Brief article and released via Mendeley Data. The data is captured from a honeypot designed to attract attackers and record their behavior against IoT devices.

Data Collection and Honeypot Design

• An IoT honeypot environment was deployed to monitor DDoS attacks against IoT devices under realistic network conditions.
• Traffic was captured in PCAP format and then converted into structured CSV files for analysis and machine learning.
• The dataset focuses on multiple DDoS attack scenarios with diverse configurations and intensities.

Features and Structure

• The CSV files expose traffic features such as timestamps, durations, packet rates, protocol, port, and bandwidth metrics, along with a label column.
• Features capture timing and rate characteristics of each record, together with ground-truth labels indicating benign or DDoS traffic.

Use Cases

• Training and evaluating machine learning and deep learning models for DDoS detection in IoT ecosystems.
• Studying traffic patterns of different DDoS vectors and benchmarking detection algorithms.

Access and License

The dataset is hosted on Mendeley Data under DOI 10.17632/8dns3xbckv.1. The Data in Brief article provides a detailed data description; the Mendeley page lists license and reuse terms.