BADTFD-IoTN: Botnet Anomaly Detection Traffic Flow Dataset for IoT Networks
Year: 2026
Type: dataset
Abstract: BADTFD-IoTN: A Dual-Source IoT Botnet Traffic Flow Dataset Generated from Simulated Environment and Physical Testbed 1. Overview BADTFD-IoTN (Botnet Anomaly Detection Traffic Flow Dataset for IoT Networks) is a hybrid IoT cybersecurity dataset developed to support research in intrusion detection systems (IDS), anomaly detection, network traffic classification, botnet detection, and cybersecurity analytics in Internet of Things (IoT) environments. The dataset combines two complementary data sources: D1 — NetSim-based IoT traffic: Simulated network traffic generated using NetSim, providing controlled benign and anomalous traffic scenarios. D2 — Physical IoT testbed traffic: Network traffic collected from an experimental IoT environment and represented as flow-level records for machine-learning-based detection. The two sources provide complementary experimental settings: D1 supports controlled evaluation, while D2 supports investigation of detection performance on traffic captured from a physical IoT testbed. BADTFD-IoTN is intended for research and experimentation. 2. Dataset at a Glance Property D1: NetSim-based traffic D2: Physical IoT traffic Data source NetSim simulation Physical IoT testbed Collection method Simulated network traffic Packet captures converted into flow records Primary representation Packet/network traffic records Network flow records Original collection context Controlled simulation Experimental IoT environment at NIT Srinagar Collection period 240-minute simulation October 21–30, 2024, as documented for the original collection Main purpose Controlled anomaly-detection experiments IoT intrusion and traffic classification experiments Model-ready feature representation Refer to D1 section 3.3 75 predictive features and 5 protected/target fields Model-ready split protocol Problem dependent such as (70:15:15) Chronological: Day_01–Day_07 train, Day_08 validation, Day_09–Day_10 test The D2 collection details describe the original collection as documented. The file counts and sizes reported later in this document refer specifically to the inspected uploaded model-ready snapshot. 3. D1 — NetSim-Based IoT Traffic Dataset 3.1 Overview D1 contains simulated IoT network traffic generated using NetSim Academic/Standard version 14.0.34 (64-bit). The simulation involved 10 network nodes, a total simulation duration of 240 minutes, and a traffic-generation interval of 2 seconds. The dataset contains 102,734 records and 23 columns, comprising 62,841 benign records and 39,893 anomalous records. It provides a controlled environment for investigating network anomaly detection and evaluating machine-learning and deep-learning methods. 3.2 Dataset characteristics Property Description Simulator NetSim Academic/Standard 14.0.34 (64-bit) Number of nodes 10 Simulation duration 240 minutes Traffic interval 2 seconds Total records 102,734 Number of columns 23 Benign records 62,841 Anomalous records 39,893 3.3 Dataset organization The logical D1 organization Schema is described below. D1_Simulated_Dataset/ │ ├── Full_Dataset/ │ └── D1_Full_Combined.csv │ ├── Raw_Attack_Traffic/ │ ├── DDoS_Attack/ │ │ └── DDoS_Attack.csv │ │ │ └── Information_Theft_Attack/ │ └── Information_Theft_Attack.csv │ └── Raw_Normal_Traffic_Unlabeled/ └── Packet_Trace_Normal_Traffic.csv 3.4 Intended use D1 is suitable for controlled experiments involving: Benign-versus-anomalous traffic classification. Evaluation of machine-learning and deep-learning IDS models. Comparison of feature representations and classification strategies. Reproducible experimentation under a simulated network setting. 4. D2 — Physical IoT Testbed Traffic Dataset 4.1 Overview and collection context D2 represents traffic collected from an 11-node physical IoT testbed at the National Institute of Technology (NIT) Srinagar. According to the original collection description, data collection took place from October 21 to October 30, 2024, with daily collection sessions running from 09:00 to 17:00. Network packets were captured using Wireshark and converted into flow records using Argus. Traffic labels were assigned according to predefined experimental scenarios. This process produces a flow-oriented representation intended for network intrusion detection, traffic classification, and anomaly-detection research. The original D2 data organization contains day-wise scenario files, combined traffic data, and a full-dataset organization. 4.2 Model-ready schema The model-ready D2 representation contains 80 columns: 75 predictive features intended for model inputs. 5 protected or target-related fields: Label, Cat, Sub_Cat, Target_Binary, and Target_Multiclass. The five protected or target-related fields must not be included among the predictive inputs when they are being used as labels or derived targets. Their precise role depends on the experiment. The two main target configurations are: Binary classification: Target_Binary, representing normal traffic versus attack traffic. Multiclass classification: Target_Multiclass, representing the 11-class target taxonomy used in the model-ready dataset. The Label, Cat, and Sub_Cat fields preserve additional label or category information. Researchers should consult the accompanying schema-audit file and the target-construction protocol before deciding which field is authoritative for a particular experiment. 4.3 Chronological partitioning The model-ready D2 dataset uses a chronological split rather than a random record-level split: Partition Days Pre-exclusion records Model-ready records Training Day_01–Day_07 5,559,080 5,016,637 Validation Day_08 795,080 716,808 Test Day_09–Day_10 878,259 733,222 Total Day_01–Day_10 7,232,419 6,466,667 The model-ready totals reflect the mismatch-exclusion procedure described below. The corresponding exclusions were: Partition Excluded records Training 542,443 Validation 78,272 Test 145,037 Total 765,752 The pre-exclusion counts and model-ready counts are separate stages of the preparation pipeline. They should not be interchanged in tables. 4.4 Label-mismatch exclusion During preparation, records with an identified inconsistency in the Multivector_IoT_Scenerio scenario label field were excluded from the model-ready dataset. In particular, missing Sub_Cat values were reported for Day_01 (47,167 records) and Day_02 (87,274 records) in the relevant scenario data. The mismatch-exclusion process was used to establish a consistent model-ready dataset for the reported experiments. Excluded records were not silently assigned new labels. The final model-ready row counts therefore differ from the pre-exclusion counts. Researchers reusing this dataset should document whether they use the pre-exclusion or mismatch-excluded data and should preserve the label-integrity checks when reproducing the experiments. 4.5 Directory Structure of the BADTFD-IoTN Dataset (D2) BADTFD-IoTN/ ├── Model_Ready/ │ ├── Test/ │ │ ├── Day_09/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv │ │ │ ├── OS_Fingerprinting.csv │ │ │ ├── Port_Scanning.csv │ │ │ └── Sleep_Deprivation_Attack.csv │ │ └── Day_10/ │ │ ├── ARP_Spoofing.csv │ │ ├── DDoS_HTTP.csv │ │ ├── DDoS_TCP.csv │ │ ├── DDoS_UDP.csv │ │ ├── DoS_HTTP.csv │ │ ├── DoS_UDP.csv │ │ ├── Multivector_IoT_Scenerio.csv │ │ ├── OS_Fingerprinting.csv │ │ ├── Port_Scanning.csv │ │ └── Sleep_Deprivation_Attack.csv │ │ │ ├── Train/ │ │ ├── Day_01/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv │ │ │ ├── OS_Fingerprinting.csv │ │ │ ├── Port_Scanning.csv │ │ │ └── Sleep_Deprivation_Attack.csv │ │ ├── Day_02/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv │ │ │ ├── OS_Fingerprinting.csv │ │ │ ├── Port_Scanning.csv │ │ │ └── Sleep_Deprivation_Attack.csv │ │ ├── Day_03/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv │ │ │ ├── OS_Fingerprinting.csv │ │ │ ├── Port_Scanning.csv │ │ │ └── Sleep_Deprivation_Attack.csv │ │ ├── Day_04/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv │ │ │ ├── OS_Fingerprinting.csv │ │ │ ├── Port_Scanning.csv │ │ │ └── Sleep_Deprivation_Attack.csv │ │ ├── Day_05/ │ │ │ ├── ARP_Spoofing.csv │ │ │ ├── DDoS_HTTP.csv │ │ │ ├── DDoS_TCP.csv │ │ │ ├── DDoS_UDP.csv │ │ │ ├── DoS_HTTP.csv │ │ │ ├── DoS_TCP.csv │ │ │ ├── DoS_UDP.csv │ │ │ ├── Multivector_IoT_Scenerio.csv
Authors: Sharma, Sparsh, Sheheryar, Mir Aman
Institution: National Institute of Technology Srinagar
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7161058147