IoTID20 — IoT Network Intrusion Dataset [625K Flows, 4 Attack Types, 83 Features]
Abstract
"Smart-home-derived IoT botnet dataset with 625,783 labeled flow records and 83 network features. Covers DoS, Mirai, MITM, and Scan attacks from EZVIZ and SKT NGU Wi-Fi cameras. CSV format. Supports binary, category, and sub-category IDS classification tasks."
Description
Overview
IoTID20 was created by Ullah and Mahmoud using a realistic smart-home test environment integrating real IoT devices and interconnected computing systems. The experimental topology included Wi-Fi cameras from EZVIZ and SKT NGU acting as vulnerable IoT endpoints connected through a home router, with tablets, smartphones, and laptops serving as attack-launching devices.
Four attack families were simulated — Mirai (HTTP flooding, brute force, UDP flooding), DoS (SYN flooding), Scan (OS scan, host and port scan), and MITM (ARP spoofing) — representing the most prevalent classes of real-world IoT network threats. Network traffic was captured in PCAP format and features were extracted using CICFlowMeter, producing a comprehensive 83-feature tabular dataset.
Uniquely, IoTID20 provides three labeling columns: a binary label (normal vs. attack), a category label (attack family), and a sub-category label (specific attack variant), enabling flexible model development across different classification granularities. The single-file CSV weighs 308 MB and contains 625,783 instances with no missing values.
Column Schema
| Column | Description |
|---|---|
| Flow ID | Unique identifier for each network flow. |
| Src IP / Dst IP | Source and destination IP addresses. |
| Src Port / Dst Port | Source and destination port numbers. |
| Protocol | Network protocol code. |
| Flow Duration | Duration of the flow in microseconds. |
| Tot Fwd Pkts / Tot Bwd Pkts | Total forward and backward packet counts. |
| Flow Byts/s / Flow Pkts/s | Flow byte and packet rates. |
| Label | Binary label: Normal or Attack. |
| Cat | Category label: DoS, Mirai, Scan, MITM, Normal. |
| Sub_Cat | Sub-category label: specific attack variant (e.g., Mirai-UDPflooding). |
Key Statistics
- Total Records: 625,783
- Features: 83 network flow columns
- Label Columns: 3 (binary, category, sub-category)
- Attack Families: DoS, Mirai, MITM, Scan
- File Format: CSV (308 MB)
- Feature Extraction Tool: CICFlowMeter
- Published: 2020
Use Cases
- Binary and multi-class IoT intrusion detection using flow-based features
- Mirai botnet detection and DoS/MITM attack classification
- Flow-based IDS algorithm evaluation for smart-home IoT networks
- Hierarchical classification across binary, category, and sub-category labels
Source & Attribution
IoTID20 was created by Iram Ullah and Qusay H. Mahmoud and is hosted on Kaggle. Additional dataset information is available at the official IoT Network Intrusion Dataset project page on Google Sites. It has been cited over 300 times in cybersecurity and IoT research publications.
Data Preview
| Src IP | Protocol | Flow Duration | Label | Cat |
|---|---|---|---|---|
| 192.168.0.105 | 6 | 120400 | Normal | Normal |
| 192.168.0.105 | 17 | 840 | Attack | Mirai |
| 192.168.0.103 | 6 | 210 | Attack | DoS |
| 192.168.0.104 | 6 | 550200 | Attack | MITM |
| 192.168.0.102 | 6 | 3100 | Attack | Scan |
Showing first few rows for preview
Cite This Dataset
Ullah, Iram, & Mahmoud, Qusay H. (2020). IoTID20 — IoT Network Intrusion Dataset [625K Flows, 4 Attack Types, 83 Features]. Advances in Artificial Intelligence. [Dataset]. Springer. https://www.kaggle.com/datasets/rohulaminlabid/iotid20-dataset
Source: Springer (2020)
Indexed by IoTDataset.com on Apr 13, 2026
Ready to Start Your Research?
Download this dataset directly from the official repository and start building your next breakthrough project.