This readme.txt (version 3) file was generated on 2026-02-26 by the authors

GENERAL INFORMATION
1. Title of Dataset: Downsampled NF-ToN-IoT V1 Dataset
2. Authorship:

Name: Virginia Martinez-Fuentes
Institution: Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalización, Universidad de Burgos
email:vmfuentes@ubu.es 
ORCID:https://orcid.org/0009-0007-7493-4059

Name: Diego Granados López
Institution: Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalización, Universidad de Burgos
email:dgranados@ubu.es
ORCID:https://orcid.org/0000-0002-9046-7397

Name: Ángel Arroyo
Institution: Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalización, Universidad de Burgos
email:aarroyop@ubu.es 
ORCID:https://orcid.org/0000-0002-1614-9075

Name: Álvaro Herrero
Institution: Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalización, Universidad de Burgos
Email: ahcosio@ubu.es
ORCID: https://orcid.org/0000-0002-2444-5384


DESCRIPTION
-----------
1. Dataset language:
English

2. Abstract:
This dataset is a proportionally downsampled version of the NF-ToN-IoT V1 dataset [Sarhan et al., 2021; Sarhan et al., 2023].

3. Keywords:
cybersecurity, IoT, dataset, exploratory data analysis, data preprocessing, downsampling, machine learning

4. Date of dataset generation:
October 2025

5. Date of dataset publication:
October 2025

6. Funding:
Acknowledgments 
 
This publication is part of the AI4SECIoT project (‘Artificial Intelligence for Securing IoT Devices’), funded by the National Cybersecurity Institute (INCIBE), derived from a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of Burgos. This initiative is carried out within the framework of the Recovery, Transformation and Resilience Plan funds, financed by the European Union (Next Generation), the project of the Government of Spain that outlines the roadmap for the modernization of the Spanish economy, the recovery of economic growth and job creation, for solid, inclusive and resilient economic reconstruction after the COVID19 crisis, and to respond to the challenges of the next decade.

7. Geographic location/s of data collection:
The original NF-ToN-IoT V1 dataset was published by The University of Queensland (UQ), Australia.  
The proportional downsampling process to generate this derivative dataset was performed at the Universidad de Burgos, Burgos (Spain).


ACCESS INFORMATION
------------------
1. Dataset License:
Permitted reuse with attribution of the authors and with a commercial use restriction (non‑commercial research only). Any reuse must cite the original NF-ToN-IoT V1 dataset as specified by UQ (https://guides.library.uq.edu.au/research-and-teaching-staff/data-deposit-checklist/license-reuse-noncommercial)  

References:  
- Sarhan, Mohanad, Layeghy, Siamak, and Portmann, Marius (2023). NF-ToN-IoT. The University of Queensland. 
  Data Collection. https://doi.org/10.48610/2fa2ed6  
- Sarhan M., Layeghy S., Moustafa N., Portmann M. (2021). NetFlow Datasets for Machine Learning-Based Network 
  Intrusion Detection Systems. In: Big Data Technologies and Applications. BDTA 2020, WiCON 2020. Springer,   Cham. https://doi.org/10.1007/978-3-030-90624-6_9

2. Dataset DOI:
https://doi.org/10.71486/wyx0-x933  

3. Related publication:
Toward AI-driven IoT Cybersecurity: A Preprocessing Framework for Benchmark Datasets. International Journal of Information Security. Volume 25, Article 62 (2026). Published: 26 February 2026. Open Access. DOI: https://doi.org/10.1007/s10207-026-01235-z


METHODOLOGICAL INFORMATION
--------------------------
1. Description of methods used for collection-generation of data:
A proportional downsampling procedure was applied to the NF-ToN-IoT V1 dataset to reduce its size while retaining the original class distribution (relative frequencies) and overall statistical characteristics. 

The process was implemented in Python within an Anaconda environment, using Jupyter Notebook for coding.


FILE OVERVIEW
-------------
1. File List:
- Downsampled NF-ToN-IoT V1 Dataset.csv
- readme.txt


DATA-SPECIFIC INFORMATION
-------------------------
The CSV file contains 49,997 rows (excluding header) and 14 attributes:

1. IPV4_SRC_ADDR  
2. L4_SRC_PORT  
3. IPV4_DST_ADDR  
4. L4_DST_PORT  
5. PROTOCOL  
6. L7_PROTO  
7. IN_BYTES  
8. OUT_BYTES  
9. IN_PKTS  
10. OUT_PKTS  
11. TCP_FLAGS  
12. FLOW_DURATION_MILLISECONDS  
13. Label  
14. Attack

The attribute set (12 features and 2 target labels) is identical to that of the NF‑ToN‑IoT V1 dataset. 
The difference lies in the number of records: this downsampled version contains 49,997 rows, whereas the NF‑ToN‑IoT V1 dataset includes 1,379,274.