{"id":"https://openalex.org/W7204007740","doi":"https://doi.org/10.5281/zenodo.22055638","title":"IoT-SFC : An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments","display_name":"IoT-SFC : An Extended and Verified Labeled Network Traffic Dataset for Cyberattack Detection in IoT/IIoT Environments","publication_year":2026,"publication_date":"2026-08-22","ids":{"openalex":"https://openalex.org/W7204007740","doi":"https://doi.org/10.5281/zenodo.22055638"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.22055638","doi":"https://doi.org/10.5281/zenodo.22055638","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22055638","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"volume":null,"type":"dataset","is_traditional":false,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.22055638","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5002914631","display_name":"Abdelwahid Oubaalla","orcid":"https://orcid.org/0009-0008-4663-2501","observed_orcids":["https://orcid.org/0009-0008-4663-2501"]},"institutions":[{"id":"https://openalex.org/I4210142658","display_name":"Naif Arab University for Security Sciences","ror":"https://ror.org/049c46160","country_code":"SA","type":"education","lineage":["https://openalex.org/I4210142658"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"OUBAALLA, Abdelwahid","raw_affiliation_strings":["Naif Arab University for Security Sciences"],"raw_orcid":"https://orcid.org/0009-0008-4663-2501","affiliations":[{"raw_affiliation_string":"Naif Arab University for Security Sciences","institution_ids":["https://openalex.org/I4210142658"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5147846600","display_name":"Naif Arab University for Security Sciences","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Naif Arab University for Security Sciences","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9976000189781189,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13038","display_name":"Internet of Things and AI","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/industrial-internet-of-things","display_name":"Industrial Internet of Things","score":0.7519999742507935},{"id":"https://openalex.org/keywords/network-traffic-datasets","display_name":"network traffic datasets","score":0.9509999752044678},{"id":"https://openalex.org/keywords/network-scanning","display_name":"network scanning","score":0.5429999828338623},{"id":"https://openalex.org/keywords/syn-flood","display_name":"SYN flood","score":0.7940000295639038},{"id":"https://openalex.org/keywords/udp-flood","display_name":"UDP flood","score":0.8949999809265137},{"id":"https://openalex.org/keywords/slowloris","display_name":"Slowloris","score":0.949999988079071},{"id":"https://openalex.org/keywords/arp-spoofing","display_name":"ARP spoofing","score":0.9850000143051147},{"id":"https://openalex.org/keywords/modbus","display_name":"Modbus","score":0.6859999895095825},{"id":"https://openalex.org/keywords/constrained-application-protocol","display_name":"CoAP","score":0.7310000061988831},{"id":"https://openalex.org/keywords/smart-agriculture","display_name":"smart agriculture","score":0.7699999809265137},{"id":"https://openalex.org/keywords/smart-manufacturing","display_name":"smart manufacturing","score":0.9649999737739563},{"id":"https://openalex.org/keywords/video-surveillance","display_name":"video surveillance","score":0.9120000004768372}],"concepts":[{"id":"https://openalex.org/C132868160","wikidata":"https://www.wikidata.org/wiki/Q10322548","display_name":"MQTT","level":3,"score":0.9161999821662903},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7616999745368958},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.612500011920929},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5009999871253967},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.48989999294281006},{"id":"https://openalex.org/C167900197","wikidata":"https://www.wikidata.org/wiki/Q11081100","display_name":"Spoofing attack","level":2,"score":0.4668000042438507},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.46059998869895935},{"id":"https://openalex.org/C26324664","wikidata":"https://www.wikidata.org/wiki/Q1065525","display_name":"Message queue","level":2,"score":0.45590001344680786},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4253000020980835},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.4140999913215637},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4050000011920929},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3476000130176544},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.29339998960494995},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.29319998621940613},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.29100000858306885},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2903999984264374},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2888000011444092},{"id":"https://openalex.org/C69527307","wikidata":"https://www.wikidata.org/wiki/Q184230","display_name":"Simple Network Management Protocol","level":3,"score":0.2773999869823456},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2720000147819519},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.262800008058548}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.5281/zenodo.22055638","doi":"https://doi.org/10.5281/zenodo.22055638","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22055638","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.5281/zenodo.22055639","doi":"https://doi.org/10.5281/zenodo.22055639","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22055639","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},{"id":"doi:10.5281/zenodo.23371775","doi":"https://doi.org/10.5281/zenodo.23371775","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23371775","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"}],"best_oa_location":{"id":"doi:10.5281/zenodo.22055638","doi":"https://doi.org/10.5281/zenodo.22055638","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.22055638","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Dataset"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4404178982","https://openalex.org/W7106813109","https://openalex.org/W7169573142","https://openalex.org/W4407220666","https://openalex.org/W6947847069","https://openalex.org/W6944805084","https://openalex.org/W4382281941","https://openalex.org/W7148246279","https://openalex.org/W7159581480","https://openalex.org/W7204056247"],"abstract_inverted_index":{"1.":[0],"Dataset":[1,170],"Overview":[2],"IoT-SFC":[3,27,491,538],"is":[4,371,402],"a":[5,13,24,51,55,61,101,154,375,480,540],"large-scale,":[6],"labeled":[7,406,432,535],"network":[8,91,204,277],"traffic":[9,219],"dataset":[10,85,174,248,401,426,433],"collected":[11,443,462],"from":[12,161,251,308,348,463],"realistic,":[14],"multi-protocol":[15],"IoT/IIoT":[16,495,527],"testbed.":[17,486],"Unlike":[18],"many":[19,313],"existing":[20],"datasets":[21],"focused":[22],"on":[23,220,494],"single":[25],"domain,":[26],"covers":[28],"smart":[29,31,45,63],"agriculture,":[30],"manufacturing,":[32],"and":[33,49,60,71,79,89,148,178,213,239,245,265,273,285,301,328,340,360,454,499,506,518,534,569,591,597,620],"video":[34],"surveillance.":[35],"The":[36,84,172,247,400,425,553],"testbed":[37,632],"primarily":[38],"uses":[39],"physical":[40,532],"devices,":[41,533],"including":[42,256,276],"an":[43,68,104,182,483],"ESP32-based":[44],"farm":[46],"with":[47,181,451],"sensors":[48],"actuators,":[50],"serial":[52],"temperature":[53],"sensor,":[54],"Tapo":[56,142],"C200":[57,143],"IP":[58],"camera,":[59],"Modbus-based":[62],"factory":[64],"simulation.":[65],"It":[66,269],"follows":[67],"Edge\u2013Fog\u2013Cloud":[69],"architecture":[70],"supports":[72,492],"MQTT,":[73,294,338],"HTTP,":[74,291,337],"CoAP,":[75],"Modbus,":[76],"TCP,":[77],"UDP,":[78],"Wi-Fi.":[80],"2.":[81],"Attack":[82,196],"Scenarios":[83],"contains":[86,175],"both":[87],"benign":[88],"malicious":[90],"traffic.":[92],"Fourteen":[93],"attack":[94,112,122,126,140,145,216,299,326,536],"types":[95],"were":[96,461,475],"executed":[97,476],"sequentially,":[98,477],"one":[99,478],"at":[100,479],"time,":[102,481],"in":[103,345,404,482,548,628],"isolated":[105,484],"laboratory":[106,485],"environment:":[107],"Network":[108],"scanning":[109,205],"SSH":[110,341],"brute-force":[111,135],"using":[113],"Hydra":[114],"HTTP":[115],"flood":[116,118,120,211],"SYN":[117,210],"UDP":[119],"Slowloris":[121],"Simulated":[123],"botnet-based":[124],"DDoS":[125],"ARP":[127],"spoofing":[128,133],"(MITM)":[129],"MQTT":[130,132,134,136,138,207],"DoS":[131,208],"sniffing":[137],"malformed-packet":[139],"Combined":[141],"camera":[144,215],"Following":[146],"verification":[147],"recovery":[149],"of":[150,157,185,512,586,589],"all":[151],"attack-session":[152,449],"logs,":[153],"comprehensive":[155],"set":[156],"fields":[158],"was":[159],"extracted":[160],"Zeek":[162,230,253,297,310,441],"logs":[163,442,450],"to":[164,374,410,418,465,580,598,616],"construct":[165],"the":[166,369,428,445,566,587,630],"final":[167,173],"dataset.":[168],"3.":[169],"Statistics":[171],"42,020,554":[176],"records":[177,224,228,250,305,346],"87":[179],"columns,":[180],"uncompressed":[183],"size":[184],"approximately":[186],"12.63":[187],"GB.":[188],"Key":[189],"statistics:":[190],"Normal":[191],"traffic:":[192,197,226],"83.58%":[193],"(35,122,281":[194],"records)":[195,200],"16.42%":[198],"(6,898,273":[199],"Most":[201],"frequent":[202],"attacks:":[203],"(7.67%),":[206],"(3.09%),":[209],"(1.84%),":[212],"combined":[214],"(0.96%)":[217],"Modbus":[218],"port":[221],"502:":[222],"3,107":[223],"CoAP":[225],"0":[227],"Main":[229],"log":[231,254,302,311,329,377],"sources:":[232],"dns.log":[233],"(66.06%),":[234],"conn.log":[235],"(28.01%),":[236],"weird.log":[237],"(2.73%),":[238],"mqtt_publish.log":[240],"(1.08%)":[241],"4.":[242],"Data":[243,386,458,460],"Structure":[244],"Features":[246],"combines":[249],"multiple":[252,309,526],"types,":[255,312],"conn.log,":[257],"dns.log,":[258],"http.log,":[259],"ssl.log,":[260],"ssh.log,":[261],"mqtt_*.log,":[262],"weird.log,":[263],"notice.log,":[264],"files.log,":[266],"among":[267],"others.":[268],"provides":[270,539],"connection-,":[271],"protocol-,":[272],"application-level":[274],"features,":[275],"addresses,":[278,324],"ports,":[279,325],"protocols,":[280,531],"services,":[281],"connection":[282,288],"duration,":[283],"byte":[284],"packet":[286],"counts,":[287],"states,":[289],"DNS,":[290,335],"SSH,":[292],"SSL/TLS,":[293,339],"file":[295],"hashes,":[296],"notices,":[298],"labels,":[300,327],"metadata.":[303],"Because":[304],"are":[306,316,331,613],"merged":[307],"protocol-specific":[314,364,519],"columns":[315],"sparsely":[317],"populated.":[318],"Core":[319],"fields,":[320],"such":[321],"as":[322],"timestamps,":[323],"metadata,":[330],"generally":[332],"available,":[333],"while":[334],"connection,":[336],"attributes":[342],"occur":[343],"only":[344],"originating":[347],"their":[349,412,419,625],"corresponding":[350],"logs.":[351],"Researchers":[352],"should":[353],"consider":[354],"this":[355,573,609],"structure":[356],"during":[357,444],"feature":[358,516],"selection":[359],"preprocessing.":[361],"A":[362],"missing":[363,383],"value":[365],"may":[366],"indicate":[367],"that":[368,571],"field":[370],"not":[372],"applicable":[373],"particular":[376],"type":[378],"rather":[379],"than":[380],"representing":[381],"conventional":[382],"data.":[384],"5.":[385],"Processing":[387],"No":[388],"additional":[389],"preprocessing,":[390],"class":[391],"balancing,":[392],"normalization,":[393],"or":[394],"categorical":[395],"encoding":[396],"has":[397],"been":[398],"applied.":[399],"released":[403],"raw,":[405],"form,":[407],"allowing":[408],"researchers":[409],"implement":[411],"own":[413],"data":[414],"preparation":[415],"pipelines":[416],"according":[417],"experimental":[420],"requirements.":[421],"6.":[422],"Released":[423],"Files":[424],"includes":[427],"following":[429],"files:":[430],"iot_dataset_v7.zip:":[431],"containing":[434],"iot_dataset_v7.csv":[435],"(12.63":[436],"GB":[437],"uncompressed).":[438],"zeek_backups.zip:":[439],"raw":[440],"experiments.":[446],"all_attacks_logs.csv:":[447],"complete":[448],"precise":[452],"start":[453],"end":[455],"timestamps.":[456],"7.":[457],"Collection":[459],"3":[464],"17":[466],"April":[467],"2025,":[468],"covering":[469],"302":[470],"collection":[471],"windows.":[472],"All":[473],"attacks":[474],"8.":[487],"Potential":[488],"Research":[489],"Applications":[490],"research":[493,567],"intrusion":[496],"detection,":[497,503],"binary":[498],"multiclass":[500],"classification,":[501],"anomaly":[502],"machine":[504],"learning":[505,508],"deep":[507],"evaluation,":[509],"comparative":[510],"assessment":[511],"cybersecurity":[513],"detection":[514,546],"approaches,":[515],"selection,":[517],"security":[520],"analysis,":[521],"particularly":[522],"MQTT.":[523],"By":[524],"combining":[525],"application":[528],"domains,":[529],"communication":[530],"scenarios,":[537],"resource":[541],"for":[542,560,564,594,604,624],"evaluating":[543],"network-based":[544],"cyberattack":[545],"approaches":[547],"heterogeneous":[549],"IoT":[550],"environments.":[551],"ACKNOWLEDGEMENTS":[552],"author":[554],"gratefully":[555],"acknowledges":[556],"Naif":[557],"Arab":[558],"University":[559],"Security":[561],"Sciences":[562],"(NAUSS)":[563],"providing":[565],"environment":[568],"resources":[570],"supported":[572],"work.":[574],"I":[575],"extend":[576],"my":[577,599],"sincere":[578],"gratitude":[579],"Dr.":[581,601],"Abdulrazaq":[582],"Al-Morjan,":[583],"Executive":[584],"Director":[585],"Center":[588],"Cybercrime":[590],"Economic":[592],"Crime,":[593],"his":[595,605],"support,":[596],"supervisor,":[600],"Kyounggon":[602],"Kim,":[603],"continuous":[606],"guidance":[607],"throughout":[608],"study.":[610],"Special":[611],"thanks":[612],"also":[614],"extended":[615],"Mr.":[617,621],"Ibrahim":[618],"Alzahrani":[619],"Mostafa":[622],"Moallim":[623],"technical":[626],"assistance":[627],"establishing":[629],"practical":[631],"environment.":[633]},"counts_by_year":[],"updated_date":"2026-11-13T13:42:25.865203","created_date":"2026-08-23T00:00:00"}