IoT-SFC : An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments
Year: 2026
Type: dataset
Abstract: 1. Dataset Overview IoT-SFC is a large-scale, labeled network traffic dataset collected from a realistic, multi-protocol IoT/IIoT testbed. Unlike many existing datasets focused on a single domain, IoT-SFC covers smart agriculture, smart manufacturing, and video surveillance. The testbed primarily uses physical devices, including an ESP32-based smart farm with sensors and actuators, a serial temperature sensor, a Tapo C200 IP camera, and a Modbus-based smart factory simulation. It follows an Edge–Fog–Cloud architecture and supports MQTT, HTTP, CoAP, Modbus, TCP, UDP, and Wi-Fi. 2. Attack Scenarios The dataset contains both benign and malicious network traffic. Fourteen attack types were executed sequentially, one at a time, in an isolated laboratory environment: Network scanning SSH brute-force attack using Hydra HTTP flood SYN flood UDP flood Slowloris attack Simulated botnet-based DDoS attack ARP spoofing (MITM) MQTT DoS MQTT spoofing MQTT brute-force MQTT sniffing MQTT malformed-packet attack Combined Tapo C200 camera attack Following verification and recovery of all attack-session logs, a comprehensive set of fields was extracted from Zeek logs to construct the final dataset. 3. Dataset Statistics The final dataset contains 42,020,554 records and 87 columns, with an uncompressed size of approximately 12.63 GB. Key statistics: Normal traffic: 83.58% (35,122,281 records) Attack traffic: 16.42% (6,898,273 records) Most frequent attacks: network scanning (7.67%), MQTT DoS (3.09%), SYN flood (1.84%), and combined camera attack (0.96%) Modbus traffic on port 502: 3,107 records CoAP traffic: 0 records Main Zeek log sources: dns.log (66.06%), conn.log (28.01%), weird.log (2.73%), and mqtt_publish.log (1.08%) 4. Data Structure and Features The dataset combines records from multiple Zeek log types, including conn.log, dns.log, http.log, ssl.log, ssh.log, mqtt_*.log, weird.log, notice.log, and files.log, among others. It provides connection-, protocol-, and application-level features, including network addresses, ports, protocols, services, connection duration, byte and packet counts, connection states, DNS, HTTP, SSH, SSL/TLS, MQTT, file hashes, Zeek notices, attack labels, and log metadata. Because records are merged from multiple Zeek log types, many protocol-specific columns are sparsely populated. Core fields, such as timestamps, addresses, ports, attack labels, and log metadata, are generally available, while DNS, connection, HTTP, MQTT, SSL/TLS, and SSH attributes occur only in records originating from their corresponding logs. Researchers should consider this structure during feature selection and preprocessing. A missing protocol-specific value may indicate that the field is not applicable to a particular log type rather than representing conventional missing data. 5. Data Processing No additional preprocessing, class balancing, normalization, or categorical encoding has been applied. The dataset is released in raw, labeled form, allowing researchers to implement their own data preparation pipelines according to their experimental requirements. 6. Released Files The dataset includes the following files: iot_dataset_v7.zip: labeled dataset containing iot_dataset_v7.csv (12.63 GB uncompressed). zeek_backups.zip: raw Zeek logs collected during the experiments. all_attacks_logs.csv: complete attack-session logs with precise start and end timestamps. 7. Data Collection Data were collected from 3 to 17 April 2025, covering 302 collection windows. All attacks were executed sequentially, one at a time, in an isolated laboratory testbed. 8. Potential Research Applications IoT-SFC supports research on IoT/IIoT intrusion detection, binary and multiclass classification, anomaly detection, machine learning and deep learning evaluation, comparative assessment of cybersecurity detection approaches, feature selection, and protocol-specific security analysis, particularly MQTT. By combining multiple IoT/IIoT application domains, communication protocols, physical devices, and labeled attack scenarios, IoT-SFC provides a resource for evaluating network-based cyberattack detection approaches in heterogeneous IoT environments. ACKNOWLEDGEMENTS The author gratefully acknowledges Naif Arab University for Security Sciences (NAUSS) for providing the research environment and resources that supported this work. I extend my sincere gratitude to Dr. Abdulrazaq Al-Morjan, Executive Director of the Center of Cybercrime and Economic Crime, for his support, and to my supervisor, Dr. Kyounggon Kim, for his continuous guidance throughout this study. Special thanks are also extended to Mr. Ibrahim Alzahrani and Mr. Mostafa Moallim for their technical assistance in establishing the practical testbed environment.
Institution: Naif Arab University for Security Sciences
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204007740