# Title: CyberFlowIoT-GICAP: Labelled Flow-Based Network Traffic Dataset for Cyberattack Detection --- ## GENERAL INFORMATION ### 1. Authors Branly Mart胣ez* Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalizaci贸n, Escuela Polit茅cnica Superior, Universidad de Burgos, Av. Cantabria s/n, 09006 Burgos, Spain Email: bamgonzalez@ubu.es ORCID: https://orcid.org/0009-0002-3224-7131 Carlos Cambra Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalizaci贸n, Escuela Polit茅cnica Superior, Universidad de Burgos, Av. Cantabria s/n, 09006 Burgos, Spain Email: ccbaseca@ubu.es ORCID: https://orcid.org/0000-0001-5567-9194 Daniel Urda Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalizaci贸n, Escuela Polit茅cnica Superior, Universidad de Burgos, Av. Cantabria s/n, 09006 Burgos, Spain Email: durda@ubu.es ORCID: https://orcid.org/0000-0003-2662-798X Jaime Rinc贸n Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalizaci贸n, Escuela Polit茅cnica Superior, Universidad de Burgos, Av. Cantabria s/n, 09006 Burgos, Spain Email: jarincon@ubu.es ORCID: https://orcid.org/0000-0003-1153-0616 脕lvaro Herrero Grupo de Inteligencia Computacional Aplicada (GICAP), Departamento de Digitalizaci贸n, Escuela Polit茅cnica Superior, Universidad de Burgos, Av. Cantabria s/n, 09006 Burgos, Spain Email: ahcosio@ubu.es ORCID: https://orcid.org/0000-0002-2444-5384 *Corresponding author --- ### 2. Related publications None. --- ### 3. Funding This publication is part of the AI4SECIoT project (鈥淎rtificial Intelligence for Securing IoT Devices鈥), funded by the National Cybersecurity Institute (INCIBE), derived from a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of Burgos. This initiative was carried out within the framework of the Recovery, Transformation, and Resilience Plan funds, financed by the European Union (Next Generation). --- ## DESCRIPTION ### 1. Dataset language English --- ### 2. Abstract This study presents a labelled flow-based network traffic dataset collected from a controlled Internet of Things (IoT) laboratory environment. The dataset captures network communication generated by hardware-based IoT devices during normal operation, including MQTT messaging, database synchronization, and web-based monitoring, as well as during the execution of predefined cyber-attack scenarios within an isolated experimental network. Network traffic was recorded at the packet level using passive network monitoring and stored in PCAP format. The packet captures were subsequently processed into bidirectional network flows using a flow-based traffic extraction pipeline, producing flow records with statistical and temporal attributes derived from the observed packet exchanges. Cyberattack-related flows were identified based on predefined attack execution time intervals obtained from experimental metadata. Network flows observed outside these intervals were labelled as benign and correspond to regular device communication. The dataset is distributed through a structured repository that includes raw packet captures, processed flow-level datasets in tabular format, and metadata files describing the experimental setup, attack scenarios, and labelling criteria. The data support flow-based analysis of IoT network traffic and the evaluation of cyberattack detection methods. --- ### 3. Keywords Internet of Things; Cybersecurity; Flow Features; Attack Traffic; Benign Traffic; Network; Ground Truth; Labelling --- ## ACCESS INFORMATION ### 1. License Creative Commons Attribution 4.0 International (CC BY 4.0) --- ### 2. Repository and persistent identifier Persistent identifier (DOI): https://doi.org/10.71486/DYXT-2R24 Direct URL: https://hdl.handle.net/10259/11273 --- ## METHODOLOGICAL INFORMATION ### 1. Capture environment The dataset was captured using Raspberry Pi 5 devices interconnected through a managed Ethernet switch with port mirroring and a dedicated passive sniffing infrastructure. To ensure clean and uncontaminated traffic captures: - The laboratory network was isolated from any institutional network using a dedicated router. - A managed network switch was configured with port mirroring to replicate all traffic to the capture interface. - The capture node operated in passive mode, without an assigned IP address, to avoid injecting additional traffic into the network. --- ### 2. Data processing stages 1. Raw packet captures (PCAPNG) 鈥 `01_Raw` 2. Converted packet captures (PCAP) 鈥 `02_Pcap` 3. Unlabelled flow-level data (CSV) 鈥 `03_Flows` 4. Ground-truth manifests and metadata 鈥 `04_Manifests`, `ATK_Metadata` 5. Labeled flow-level data (CSV) 鈥 `05_Labeled_Flows` 6. Consolidated datasets (Parquet, CSV summaries) 鈥 `06_Datasets` --- ### 3. Flow extraction and tools Packet-level traces were processed into bidirectional network flows using a flow-based feature extraction approach based on NFStream. The same extraction configuration and feature schema were applied consistently across all packet captures to ensure comparability of the generated flow-level data. --- ### 4. Ground-truth labelling Flow labelling was performed using predefined attack execution time intervals recorded during the experiments. A flow was labelled as malicious if its temporal boundaries overlapped with a documented attack window. Flows outside these intervals were labelled as benign. In scenarios where temporal information alone was insufficient to disambiguate concurrent activities, the attacker IP address was used as an auxiliary labelling criterion. --- ### 5. Intended use The dataset is intended for research on flow-based network traffic analysis and cyberattack detection in IoT environments, including supervised learning, statistical traffic analysis, and comparative evaluation of detection methods. --- ### 6. Limitations The data were collected in a controlled laboratory environment and may not fully reflect the diversity and scale of real-world IoT deployments. The dataset is limited to the predefined experimental activities executed during the data collection campaigns. --- ## DIRECTORY AND FILE INFORMATION ### Repository structure 01_Raw/ 02_Pcap/ 03_Flows/ 04_Manifests/ 05_Labeled_Flows/ 06_Datasets/ ATK_Metadata/ --- ### Directory descriptions **01_Raw/** Original packet capture files in PCAPNG format obtained from passive monitoring of the laboratory network. **02_Pcap/** PCAP versions of the original packet captures. Files were converted without filtering or anonymization. **03_Flows/** Unlabelled flow-level CSV files extracted from packet captures. Each row represents a bidirectional network flow. **04_Manifests/** Auxiliary metadata linking packet captures to experimental executions and labelling windows. **ATK_Metadata/** Attack-specific metadata in JSON format, including attack identifiers, timestamps, duration, and execution parameters. **05_Labeled_Flows/** Flow-level CSV files with ground-truth labels indicating benign or attack traffic and the corresponding attack type. **06_Datasets/** Contains consolidated datasets derived from labelled flows. This directory includes: - The final dataset in Parquet format. - A summarized view of the traffic categorized by attack and traffic type. --- ### Subdirectory Organization The directories 01_Raw, 02_Pcap, 03_Flows, 05_Labeled_Flows, and ATK_Metadata are further organized by traffic type. Each of these directories contains: - 01_BenignTraffic/ - 02_AttackTraffic/ The AttackTraffic directory is further subdivided by attack type, for example: - ARP_SPOOFING_MITM/ - DenialofService/ - DNS_Beacon/ - FuerzaBruta/ - MQTT_Injection/ - Nmap_Recon/ - SQL_Injection/ --- ## Dataset Version 1.0 --- ## CONTACT For further information, please contact: Branly Mart胣ez Email: bamgonzalez@ubu.es