Labelled IoT Flow-Based Network Traffic Dataset for Cyberattack Detection [Dataset]

Abstract

This study presents a labelled flow-based network traffic dataset collected from a controlled Internet of Things (IoT) laboratory environment. The dataset captures network communication generated by hardware-based IoT devices during normal operation, including MQTT messaging, database synchronization, and web-based monitoring, as well as during the execution of predefined cyber-attack scenarios within an isolated experimental network. Network traffic was recorded at the packet level using passive network monitoring and stored in PCAP format. The packet captures were subsequently processed into bidirectional network flows using a flow-based traffic extraction pipeline, producing flow records with statistical and temporal attributes derived from the observed packet exchanges. Cyberattack-related flows were identified based on predefined attack execution time intervals obtained from experimental metadata. Network flows observed outside these intervals were labelled as benign and correspond to regular device communication. The dataset is distributed through a structured repository that includes raw packet captures, processed flow-level datasets in tabular format, and metadata files describing the experimental setup, attack scenarios, and labelling criteria. The data support flow-based analysis of IoT network traffic and the evaluation of cyberattack detection methods.This publication is part of the AI4SECIoT project (“Artificial Intelligence for Securing IoT Devices”), funded by the National Cybersecurity Institute (INCIBE), derived from a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of Burgos. This initiative was carried out within the framework of the Recovery, Transformation, and Resilience Plan funds, financed by the European Union (Next Generation)