MQTT DoS DDoS IoT Attack Dataset

Overview

The MQTT DoS DDoS IoT Attack dataset is a publicly available collection of MQTT traffic focusing on denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks against IoT systems. It is published on Mendeley Data and provides labeled records suitable for intrusion detection and prevention research.

Data Collection Setup

• Data collected on a Raspberry Pi 3B+ running a Mosquitto MQTT broker and acting as MQTT client host for four publishers and eight subscribers.
• Traffic captured with Wireshark over 12 sessions using the Terminator terminal on Ubuntu 20.
• Normal traffic generated over 72 hours (three days), producing approximately 142,000 data entries.
• Attack traffic generated for 2–3 minutes using tools such as hping3 and LOIC, resulting in hundreds of thousands of records.
• The complete dataset contains 424,716 harvested entries exported to a single labeled CSV file.

Features and Use

• Dataset fields are chosen to reflect parameters most affected by DDoS attacks, emphasizing timing and volume-related characteristics.
• Records are labeled as normal or attack, enabling supervised learning approaches.
• Intended for research using machine learning and deep learning models for IDS and IPS in MQTT-based IoT networks.

Access and License

The dataset is hosted on Mendeley Data under DOI 10.17632/gt37rfwtb5.1. It is provided for research purposes; licensing and reuse conditions are specified on the Mendeley dataset page.