MedBIoT — Medium-Sized IoT Botnet IDS Dataset [83 devices]
Catalog Summary
"IoT botnet IDS dataset using 83 real and emulated devices with Mirai, BashLite, and Torii traffic. Raw PCAP files support botnet and anomaly detection research."
Catalog Notes
Overview
MedBIoT is a medium-sized IoT botnet dataset built to address the shortage of labelled data for IoT botnet detection. It combines real and emulated IoT devices in a network of 83 devices.
The dataset contains legitimate traffic and real malware network data. Three botnet malware families were deployed: Mirai, BashLite, and Torii. The traffic focuses on early botnet stages, including spreading and command-and-control communication.
The dataset is provided as raw PCAP files in bulk and fine-grained formats. Files are labelled according to traffic source, malware family, botnet phase, and device type, enabling feature extraction for supervised and unsupervised IDS experiments.
Column Schema
| Column | Description |
|---|---|
| pcap_file | Raw packet-capture filename indicating source, phase, and device type. |
| traffic_source | Legitimate or malware traffic source. |
| botnet_family | Mirai, BashLite, Torii, or none for legitimate traffic. |
| botnet_phase | Botnet phase such as spreading or command-and-control. |
| device_type | Real or emulated IoT device type such as switch, light bulb, lock, fan, or light. |
| label | Benign or malicious label derived from the PCAP file grouping. |
Key Statistics
- Total Records: Raw PCAP traffic files; packet count not stated on the primary dataset page
- Features: Extractable packet and flow features from PCAP files
- File Format: PCAP
- File Size: Not specified on the primary dataset page
- Time Period: Public release date February 27, 2020
- Devices: 83 real and emulated IoT devices
- Malware Families: Mirai, BashLite, Torii
Use Cases
- IoT botnet intrusion detection
- Malware family classification
- Early-stage botnet propagation and C&C detection
- Anomaly and outlier detection in IoT networks
Source & Attribution
Created by Alejandro Guerra Manzanares, Jorge Alberto Medina Galindo, Hayretdin Bahsi, and Sven Nõmm at Tallinn University of Technology. The dataset page requests citation of the ICISSP 2020 paper with DOI 10.5220/0009187802070218.
View Data Structure
To explore column names, data types, and sample rows, visit the official dataset page on University.
Preview on UniversityCite This Dataset
Guerra-Manzanares, A., Medina-Galindo, J. A., Bahsi, H., & Nõmm, S. (2020). MedBIoT: Generation of an IoT Botnet Dataset in a Medium-sized IoT Network. [Dataset]. SciTePress. https://doi.org/10.5220/0009187802070218
Source metadata: SciTePress (2020) · DOI: 10.5220/0009187802070218
Indexed by IoTDataset.com on Jun 02, 2026
Review the Source Record
Confirm the licence, version, access conditions, file format, and provenance at the source before use.