IoT-23: Labeled Malware and Benign IoT Network Traffic from 2018-2019

20 malware captures and 3 benign traffic captures from Internet of Things devices, collected between 2018 and 2019. The dataset was published in January 2020 by researchers at the Stratosphere Laboratory, AIC group, CTU University in the Czech Republic. Its goal is to provide real, labeled IoT traffic for developing machine learning algorithms, with funding from Avast Software.

Use Cases

• Train malware detection classifiers based on labeled network traffic.
• Develop anomaly detection models for IoT networks based on benign traffic patterns.
• Benchmark ML algorithms for cybersecurity using real IoT infection data.
• Study the behavior of IoT malware based on its allowed internet connections.

Strengths

• Contains 20 distinct malware captures, providing multiple attack scenarios.
• Includes 3 separate benign traffic captures for baseline comparison.
• Traffic is real and labeled, captured in a controlled laboratory environment.
• Covers a defined time range from 2018 to 2019.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Row count and dataset size are unknown, which may limit suitability assessment.
• Last update date is unknown; freshness unverified.

Provenance

Source

Stratosphere Laboratory, AIC group, FEL, CTU University, Czech Republic.

Collection Method

Network traffic captured from IoT devices, with malware allowed to connect to the internet.

Time Range

2018 to 2019

Freshness

Published January 2020; last update unknown.

Geography

Czech Republic