Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset
Open accessThe claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Existing network intrusion datasets contain packets of two classes, but packet-level classification has drawbacks: many packets are not malicious in content, some attacks spread payload across packets, and staged attacks make packet classification ineffective.
“However, in practice, the approach of classifying the individual packages has a few significant drawbacks:many packets from the available datasets are not malicious in terms of their content.”
From Security intrusion detection using quantum machine learning techniques (2022) · cites this paper as [56]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThe BoT-IoT dataset was produced at the Cyber Range Lab at UNSW Canberra as a result of building a real-life network environment integrating a mix of normal and botnet traffic.
“The BoT-IoT dataset was produced at the Cyber Range Lab at UNSW Canberra as a result of building a real-life network environment integrating a mix of normal and botnet traffic [154], [160]- [164].”
From Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis (2021) · cites this paper as [154]
The security research community uses TON_IoT, Bot-IoT, and MQTTset for evaluating FL-based cyber security solutions in IoT networks.
“For evaluating FL-based cyber security solutions in IoT networks, the security research community uses the following three datasets: TON_IoT [149], Bot-IoT [154], and MQTTset [156].”
From Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis (2021) · cites this paper as [154]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Internet of Things (IoT): A vision, architectural elements, and future directions
Gubbi, J., Buyya, R., Marusic, S., & Palaniswami, M. (2013) · Future Generation Computer Systems · doi:10.1016/j.future.2013.01.010 · Cited by 12,293 · see citing works
Greff, K., Srivastava, R. K., Koutnik, J., Steunebrink, B. R., & Schmidhuber, J. (2017) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2016.2582924 · Cited by 6,955 · see citing works
A detailed analysis of the KDD CUP 99 data set
Tavallaee, M., Bagheri, E., Lu, W., & Ghorbani, A. A. (2009) · 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications · doi:10.1109/cisda.2009.5356528 · Cited by 5,396 · see citing works
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018) · Proceedings of the 4th International Conference on Information Systems Security and Privacy · doi:10.5220/0006639801080116 · Cited by 5,318 · cited 8× · see citing works
“Comparable to [25, 26] but more elaborate in their implementation, Sharafaldin et al. [8] crafted a testbed relying on physical machines, which were separated into two networks, the Victim-network and the Attack-network.”
BackgroundMethodInfluentialMoustafa, N., & Slay, J. (2015) · 2015 Military Communications and Information Systems Conference (MilCIS) · doi:10.1109/milcis.2015.7348942 · Cited by 4,033 · see citing works
Self-citationAnomaly-based network intrusion detection: Techniques, systems and challenges
García-Teodoro, P., Díaz-Verdejo, J., Maciá-Fernández, G., & Vázquez, E. (2009) · Computers & Security · doi:10.1016/j.cose.2008.08.003 · Cited by 2,085 · see citing works
DDoS in the IoT: Mirai and Other Botnets
Kolias, C., Kambourakis, G., Stavrou, A., & Voas, J. (2017) · Computer · doi:10.1109/mc.2017.201 · Cited by 1,892 · see citing works
A survey of techniques for internet traffic classification using machine learning
Nguyen, T. T. T., & Armitage, G. (2008) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2008.080406 · Cited by 1,664 · see citing works
A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks
Zargar, S., Joshi, J., & Tipper, D. (2013) · IEEE Communications Surveys and Tutorials · doi:10.1109/surv.2013.031413.00127 · Cited by 1,442 · see citing works
Grossberg, S. (2013) · Scholarpedia · doi:10.4249/scholarpedia.1888 · Cited by 602 · see citing works
Mining e-mail content for author identification forensics
de Vel, O., Anderson, A., Corney, M., & Mohay, G. (2001) · ACM SIGMOD Record · doi:10.1145/604264.604272 · Cited by 487 · see citing works
IoT Goes Nuclear: Creating a ZigBee Chain Reaction
Ronen, E., Adi Shamir, Z., Weingarten, A.-O., & O’Flynn, C. (2017) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2017.14 · Cited by 468 · see citing works
Advanced Persistent threats and how to monitor and deter them
Tankard, C. (2011) · Network Security · doi:10.1016/s1353-4858(11)70086-1 · Cited by 393 · see citing works
Silva, S. S. C., Silva, R. M. P., Pinto, R. C. G., & Salles, R. M. (2012) · Computer Networks · doi:10.1016/j.comnet.2012.07.021 · Cited by 364 · see citing works
Usilng Machine Learning Technliques to Identify Botnet Traffic
Livadas, C., Walsh, R., Lapsley, D., et al. (2006) · Conference on Local Computer Networks · doi:10.1109/lcn.2006.322210 · Cited by 302 · see citing works
Lesne, A. (2014) · Mathematical Structures in Computer Science · doi:10.1017/s0960129512000783 · Cited by 228 · see citing works
Network attacks: Taxonomy, tools and systems
Hoque, N., Bhuyan, M. H., Baishya, R. C., Bhattacharyya, D. K., & Kalita, J. K. (2013) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2013.08.001 · Cited by 219 · see citing works
External integrity verification for outsourced big data in cloud and IoT: A big picture
Liu, C., Yang, C., Zhang, X., & Chen, J. (2014) · Future Generation Computer Systems · doi:10.1016/j.future.2014.08.007 · Cited by 194 · see citing works
A Taxonomy of Botnet Behavior, Detection, and Defense
Khattak, S., Ramay, N. R., Khan, K. R., Syed, A. A., & Khayam, S. A. (2013) · IEEE Communications Surveys & Tutorials · doi:10.1109/surv.2013.091213.00134 · Cited by 186 · see citing works
Moustafa, N., Choo, K. R., Radwan, I., & Camtepe, S. A. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2018.2890808 · Cited by 130 · see citing works
Self-citationAvailability of datasets for digital forensics – And what is missing
Grajeda, C., Breitinger, F., & Baggili, I. (2017) · Digital Investigation · doi:10.1016/j.diin.2017.06.004 · Cited by 128 · see citing works
Du, K.-L., & Swamy, M. N. S. (2013) · Springer eBooks · doi:10.1007/978-1-4471-5571-3_16 · Cited by 106 · see citing works
Understanding passive and active service discovery
Bartlett, G., Heidemann, J., & Papadopoulos, C. (2007) · ACM SIGCOMM Internet Measurement Conference (IMC) · doi:10.1145/1298306.1298314 · Cited by 82 · see citing works
Denial-of-Service, Probing & Remote to User (R2L) Attack Detection using Genetic Algorithm
Paliwal, S., & Gupta, R. K. (2012) · International Journal of Computer Applications · Cited by 78 · see citing works
Causation and Pearson's Correlation Coefficient
Emerson, R. W. (2015) · Journal of Visual Impairment & Blindness · doi:10.1177/0145482x1510900311 · Cited by 74 · see citing works
Attack Detection and Distributed Forensics in Machine-to-Machine Networks
Wang, K., Du, M., Sun, Y., Vinel, A. V., & Zhang, Y. (2016) · IEEE Network · doi:10.1109/mnet.2016.1600113nm · Cited by 63 · see citing works
Rodrigues, G. A. P., Albuquerque, R. D. O., Deus, F., et al. (2017) · Applied Sciences · doi:10.3390/app7101082 · Cited by 55 · see citing works
Bhatia, S., Schmidt, D., Mohay, G., et al. (2013) · Computers & Security · doi:10.1016/j.cose.2013.11.005 · Cited by 50 · see citing works
Behal, S., & Kumar, K. (2017) · Computer Communications · doi:10.1016/j.comcom.2017.02.003 · Cited by 50 · see citing works
A SURVEY ON AUTHENTICATION ATTACKS AND COUNTERMEASURES IN A DISTRIBUTED ENVIRONMENT
Jesudoss, A. (2014) · Cited by 48 · see citing works
A Decision Tree Classifier for Intrusion Detection Priority Tagging
Ammar, A. (2015) · Journal of Computer and Communications · doi:10.4236/jcc.2015.34006 · Cited by 41 · see citing works
A Feature Subset Selection Method Based On High-Dimensional Mutual Information
Zheng, Y., & Kwoh, C. K. (2011) · Entropy · doi:10.3390/e13040860 · Cited by 41 · see citing works
Design, deployment and use of HTTP-based botnet (HBB) testbed
Alomari, E. S., Manickam, S., Gupta, B. B., et al. (2014) · International Conference on Advanced Communication Technology · doi:10.1109/icact.2014.6779162 · Cited by 29 · see citing works
Flagged first, then by citations
Research works printed but not linked: 7
- P. Amini, M. A. Araghizadeh, R. Azmi, A survey on botnet: classification, detection and defense, in: Electronics Symposium (IES), 2015 Interna- tional, IEEE, 2015, pp. 233-238.
- G. Palmer, A road map for digital forensic research: Report from the first digital forensic workshop, 7-8 august 2001, DFRWS Technical Report DTR-T001-01.
- E. Hodo, X. Bellekens, A. Hamilton, P.-L. Dubouilh, E. Iorkyase, C. Tach- tatzis, R. Atkinson, Threat analysis of iot networks using artificial neural network intrusion detection system, in: Networks, Computers and Com- munications (ISNCC), 2016 International Symposium on, IEEE, 2016, pp. 1-6.
- K. Rieck, T. Holz, C. Willems, P. Düssel, P. Laskov, Learning and classi- fication of malware behavior, in: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Springer, 2008, pp. 108-125.
- R. Doshi, N. Apthorpe, N. Feamster, Machine learning ddos detection for consumer internet of things devices, arXiv preprint arXiv:1804.04159. · arXiv
- D. Soni, A. Makwana, A survey on mqtt: a protocol of internet of things (iot), in: Proceeding of the International Conference on Telecommunica- tion, Power Analysis and Computing Techniques, Chennai: IN, 2017.
- P. Gogoi, M. H. Bhuyan, D. Bhattacharyya, J. K. Kalita, Packet and flow based network intrusion dataset, in: International Conference on Contem- porary Computing, Springer, 2012, pp. 322-334.
Cited by
Sorted by citations
Machine learning: Algorithms, real-world applications and research directions
Sarker, I. H. (2021) · SN Computer Science · doi:10.1007/s42979-021-00592-x · Cited by 5,583 · see citing works
Survey of intrusion detection systems: Techniques, datasets and challenges
Khraisat, A., Gondal, I., Vamplew, P., & Kamruzzaman, J. (2019) · Cybersecurity · doi:10.1186/s42400-019-0038-7 · Cited by 2,024 · see citing works
Cybersecurity data science: an overview from machine learning perspective
Sarker, I. H., Kayes, A. S. M., Badsha, S., Alqahtani, H., Watters, P., & Ng, A. (2020) · Journal of Big Data · doi:10.1186/s40537-020-00318-5 · Cited by 766 · see citing works
Sarker, I. H. (2021) · SN Computer Science · doi:10.1007/s42979-021-00765-8 · Cited by 570 · see citing works
Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research
Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450 · see citing works
An experimental analysis of attack classification using machine learning in IoT networks
Churcher, A., Ullah, R., Ahmad, J., ur Rehman, S., Masood, F., Gogate, M., Alqahtani, F., Nour, B., & Buchanan, W. J. (2021) · Sensors · doi:10.3390/s21020446 · Cited by 439 · see citing works
Kumar, P., Kumar, R., Srivastava, G., Gupta, G. P., Tripathi, R., Gadekallu, T. R., & Xiong, N. N. (2021) · IEEE Transactions on Network Science and Engineering · doi:10.1109/tnse.2021.3089435 · Cited by 360 · see citing works
Ferrag, M. A., Friha, O., Maglaras, L., Janicke, H., & Shu, L. (2021) · IEEE Access · doi:10.1109/access.2021.3118642 · Cited by 342 · see citing works
IoT anomaly detection methods and applications: A survey
Chatterjee, A., & Ahmed, B. S. (2022) · Internet of Things · doi:10.1016/j.iot.2022.100568 · Cited by 323 · see citing works
Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain
Rosenberg, I., Shabtai, A., Elovici, Y., & Rokach, L. (2022) · ACM Computing Surveys · doi:10.1145/3453158 · Cited by 295 · see citing works
MQTTset, a New Dataset for Machine Learning Techniques on MQTT
Vaccari, I., Chiola, G., Aiello, M., Mongelli, M., & Cambiaso, E. (2020) · Sensors · doi:10.3390/s20226578 · Cited by 292 · see citing works
Analyzing Adversarial Attacks against Deep Learning for Intrusion Detection in IoT Networks
Ibitoye, O., Shafiq, O., & Matrawy, A. (2019) · 2019 IEEE Global Communications Conference (GLOBECOM) · doi:10.1109/globecom38437.2019.9014337 · Cited by 281 · see citing works
Deep Learning-Based Intrusion Detection for IoT Networks
Ge, M., Fu, X., Syed, N., Baig, Z., Teo, G., & Robles-Kelly, A. (2019) · 2019 IEEE 24th Pacific Rim International Symposium on Dependable Computing (PRDC) · doi:10.1109/prdc47002.2019.00056 · Cited by 269 · see citing works
A Framework for Malicious Traffic Detection in IoT Healthcare Environment
Hussain, F., Abbas, S. G., Shah, G. A., Pires, I. M., Fayyaz, U. U., Shahzad, F., Garcia, N. M., & Zdravevski, E. (2021) · Sensors · doi:10.3390/s21093025 · Cited by 230 · see citing works
Le, T.-T.-H., Kim, H., Kang, H., & Kim, H. (2022) · Sensors · doi:10.3390/s22031154 · Cited by 208 · see citing works
Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach
Galeano-Brajones, J., Carmona-Murillo, J., Valenzuela-Valdés, J. F., & Luna-Valero, F. (2020) · Sensors · doi:10.3390/s20030816 · Cited by 165 · see citing works
Explainable artificial intelligence for cybersecurity: a literature survey
Charmet, F., Tanuwidjaja, H. C., Ayoubi, S., Gimenez, P.-F., Han, Y., Jmila, H., Blanc, G., Takahashi, T., & Zhang, Z. (2022) · Annals of Telecommunications · doi:10.1007/s12243-022-00926-7 · Cited by 167 · see citing works
LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection
Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., & Smuikys, P. (2020) · Electronics · doi:10.3390/electronics9050800 · Cited by 132 · see citing works
Security intrusion detection using quantum machine learning techniques
Kalinin, M., & Krundyshev, V. (2022) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-022-00435-0 · Cited by 118 · see citing works
Cybersecurity for Industrial IoT (IIoT): Threats, countermeasures, challenges and future directions
Mekala, S. H., Baig, Z., Anwar, A., & Zeadally, S. (2023) · Computer Communications · doi:10.1016/j.comcom.2023.06.020 · Cited by 111 · see citing works
Soe, Y. N., Feng, Y., Santosa, P. I., Hartanto, R., & Sakurai, K. (2020) · Electronics · doi:10.3390/electronics9010144 · Cited by 110 · see citing works
Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
Wazzan, M., Algazzawi, D., Bamasaq, O., Albeshri, A., & Cheng, L. (2021) · Applied Sciences · doi:10.3390/app11125713 · Cited by 102 · see citing works
Kalakoti, R., Bahsi, H., & Nõmm, S. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3360626 · Cited by 93 · see citing works
MUD-based behavioral profiling security framework for software-defined IoT networks
Krishnan, P., Jain, K., Buyya, R., Vijayakumar, P., Nayyar, A., Bilal, M., & Song, H. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3113577 · Cited by 71 · see citing works
ADAM: An adaptive DDoS attack mitigation scheme in software-defined cyber-physical system
Cai, T., Jia, T., Adepu, S., Li, Y., & Yang, Z. (2023) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2023.3240586 · Cited by 73 · see citing works
GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT
Altaf, T., Wang, X., Ni, W., Yu, G., Liu, R. P., & Braun, R. (2024) · Electronics · doi:10.3390/electronics13122274 · Cited by 50 · see citing works
A Novel Lightweight IoT Intrusion Detection Model Based on Self-Knowledge Distillation
Wang, Z., Zhou, R., Yang, S., He, D., & Chan, S. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3533092 · Cited by 38 · see citing works
A Systematic Review of Data-Driven Attack Detection Trends in IoT
Haque, S., El-Moussa, F., Komninos, N., & Muttukrishnan, R. (2023) · Sensors · doi:10.3390/s23167191 · Cited by 38 · see citing works
Deep Cybersecurity: A Comprehensive Overview from Neural Network and Deep Learning Perspective
Sarker, I. H. (2021) · doi:10.20944/preprints202102.0340.v1 · Cited by 295 · see citing works
Mancy, H., & Naith, Q. H. (2025) · IEEE Access · doi:10.1109/access.2025.3551207 · Cited by 23 · see citing works
One-Class Anomaly Detection for Industrial Applications: A Comparative Survey and Experimental Study
Paolini, D., Dini, P., Soldaini, E., & Saponara, S. (2025) · Computers · doi:10.3390/computers14070281 · Cited by 21 · see citing works
A Blockchain-Based Privacy Information Security Sharing Scheme in Industrial Internet of Things
Wang, Y., Che, T., Zhao, X., Zhou, T., Zhang, K., & Hu, X. (2022) · Sensors · doi:10.3390/s22093426 · Cited by 20 · see citing works
Mohamed, A. S., Fritz, C., Saber, A. M., Ma, Y., Kaur, R., Al-Darwbi, M., Friedrich, D., & Kundur, D. (2026) · arXiv · doi:10.48550/arxiv.2609.00171
- Authors
- Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B.
- Affiliations
- UNSW Canberra (AU)
- Corresponding author
- Moustafa, Nour
- Venue
- Future Generation Computer Systems
- Publisher
- Elsevier BV
- Published
- 2019-11
- Volume
- 100
- Pages
- 779-796
- ISSN
- 0167-739X (ISSN-L)
- OpenAlex
- W2898761242
- Cited by
- 1,983
- References
- 33
- Citations by year
- 2026: 342 · 2025: 385 · 2024: 338 · 2023: 322 · 2022: 250 · 2021: 222 · 2020: 108 · 2019: 15
- FWCI
- 81.42
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- Future Generation Computer Systems (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Keywords
- botnet detection, Internet of Things, network forensics, Bot-IoT dataset, IoT traffic, network intrusion detection, dataset evaluation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
