IoT-SFC v2 — 49.9M-Record IoT/IIoT Attack Dataset
Catalog Summary
"Publisher-reported 49,902,287 labeled IoT/IIoT records with 88 columns; the inspected attack log contains 302 sessions across 14 attack types."
Catalog Notes
Overview
IoT-SFC v2 is the dataset name; this record cites Mendeley release 5. The source describes traffic from an Edge–Fog–Cloud IoT/IIoT testbed collected on 3–17 April 2025. Records combine multiple Zeek log types and should not all be called network flows.
Structure and verification
The publisher reports 49,902,287 records: 40,642,071 normal and 9,260,216 attack records, with 88 columns. The CSV header and first 100 records were inspected and have 88 fields; the full row total was not independently recounted. The supplied all_attacks_logs.json contains 302 sessions and 14 attack labels after removing its leading comment lines. Those comments make the supplied file invalid strict JSON until removed.
Use and limitations
Suitable research includes multi-protocol intrusion detection and temporal attack analysis. Protocol-specific fields can be sparse. The download includes compressed dataset and Zeek-backup archives. The release is licensed CC BY-NC 3.0, which must be retained in any reuse assessment.
Source and provenance
Dataset DOI: https://doi.org/10.17632/j9xffc2psb.5.
View Data Structure
To explore column names, data types, and sample rows, visit the official dataset page on Mendeley Data.
Preview on Mendeley DataCite This Dataset
Oubaalla, A. (2026). IoT-SFC v2: An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments (Version 5) [Data set]. Mendeley Data. https://doi.org/10.17632/j9xffc2psb.5
Source metadata: Mendeley Data (2026) · DOI: 10.17632/j9xffc2psb.5
Indexed by IoTDataset.com on Sep 14, 2026
Review the Source Record
Confirm the licence, version, access conditions, file format, and provenance at the source before use.