N-BaIoT: Real IoT Botnet Traffic from 9 Infected Devices [7M Records, Mirai & BASHLITE]

Overview

N-BaIoT (Network-Based Detection of IoT Botnet Attacks) was created to address a critical gap in the field: the absence of real, device-level IoT botnet traffic in publicly available datasets. This dataset collects authentic traffic from nine commercial IoT devices genuinely infected by two of the most destructive botnet families ever observed — Mirai and BASHLITE.

The nine devices include a Danmini doorbell, Ecobee thermostat, Ennio doorbell, Philips B120N baby monitor, Provision PT-737E and PT-838 security cameras, Samsung SNH 1011 N webcam, and SimpleHome XCS7 1002 WHT and XCS7 1003 WHT webcams.

The dataset captures 115 statistical features engineered from raw network traffic including packet stream statistics (weight, mean, std, radius, magnitude, covariance, Pearson correlation) computed over multiple time windows. Mirai attack types: Scan, Ack flood, Syn flood, UDP flood, UDP-plain. BASHLITE attack types: Scan, Junk, UDP flood, TCP flood, COMBO.

Column Schema

Key Statistics

• Total Records: 7,062,606 across all 9 device sub-datasets
• IoT Devices: 9 commercial devices
• Botnet Families: Mirai (5 attack types) and BASHLITE (5 attack types)
• Features: 115 statistical network flow features
• File Format: CSV (one sub-dataset per device)
• Donated to UCI: March 2018

Use Cases

• Deep autoencoder-based IoT botnet detection
• Anomaly detection benchmarking using real per-device IoT traffic
• Transfer learning across device types for generalized IoT security models
• Multi-class attack classification: Mirai vs BASHLITE vs Benign

Source and Attribution

Created by Yair Meidan et al. at Ben-Gurion University of the Negev. Published in IEEE Pervasive Computing (2018) and hosted on UCI Machine Learning Repository.