# Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset

arXiv: https://arxiv.org/abs/1811.00701 · HTML: https://mlsanity.com/paper/1811.00701/

## Key facts

- Cited by 99 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Nov 2018.

## Built on by (most cited first, 30 of 99)

- [E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT](https://mlsanity.com/paper/2103.16329/) (2021)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks](https://mlsanity.com/paper/2207.06819/) (2022)
- [A Survey on Large Language Models for Communication, Network, and Service Management: Application Insights, Challenges, and Future Directions](https://mlsanity.com/paper/2412.19823/) (2024)
- [Evaluating Federated Learning for Intrusion Detection in Internet of Things: Review and Challenges](https://mlsanity.com/paper/2108.00974/) (2021)
- [IoT Data Analytics in Dynamic Environments: From An Automated Machine Learning Perspective](https://mlsanity.com/paper/2209.08018/) (2022)
- [Unsupervised Deep Learning for IoT Time Series](https://mlsanity.com/paper/2302.03284/) (2023)
- [Towards Adversarial Realism and Robust Learning for IoT Intrusion Detection and Classification](https://mlsanity.com/paper/2301.13122/) (2023)
- [Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT](https://mlsanity.com/paper/2104.12426/) (2021)
- [An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks](https://mlsanity.com/paper/2101.12270/) (2021)
- [Evaluating Standard Feature Sets Towards Increased Generalisability and Explainability of ML-based Network Intrusion Detection](https://mlsanity.com/paper/2104.07183/) (2021)
- [Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review](https://mlsanity.com/paper/2112.03315/) (2021)
- [On Generalisability of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2205.04112/) (2022)
- [Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats](https://mlsanity.com/paper/2204.03433/) (2022)
- [Use of Graph Neural Networks in Aiding Defensive Cyber Operations](https://mlsanity.com/paper/2401.05680/) (2024)
- [Applying Self-supervised Learning to Network Intrusion Detection for Network Flows with Graph Neural Network](https://mlsanity.com/paper/2403.01501/) (2024)
- [IoT Security: Botnet detection in IoT using Machine learning](https://mlsanity.com/paper/2104.02231/) (2021)
- [Machine Learning for Encrypted Malicious Traffic Detection: Approaches, Datasets and Comparative Study](https://mlsanity.com/paper/2203.09332/) (2022)
- [Impact of Latent Space Dimension on IoT Botnet Detection Performance: VAE-Encoder Versus ViT-Encoder](https://mlsanity.com/paper/2504.14879/) (2025)
- [Exploring Edge TPU for Network Intrusion Detection in IoT](https://mlsanity.com/paper/2103.16295/) (2021)
- [HBFL: A Hierarchical Blockchain-based Federated Learning Framework for a Collaborative IoT Intrusion Detection](https://mlsanity.com/paper/2204.04254/) (2022)
- [Brain-on-Switch: Towards Advanced Intelligent Network Data Plane via NN-Driven Traffic Analysis at Line-Speed](https://mlsanity.com/paper/2403.11090/) (2024)
- [IoT Botnet Detection: Application of Vision Transformer to Classification of Network Flow Traffic](https://mlsanity.com/paper/2504.18781/) (2025)
- [Enhancing IoT-Botnet Detection using Variational Auto-encoder and Cost-Sensitive Learning: A Deep Learning Approach for Imbalanced Datasets](https://mlsanity.com/paper/2505.01437/) (2025)
- [A Cyber Threat Intelligence Sharing Scheme based on Federated Learning for Network Intrusion Detection](https://mlsanity.com/paper/2111.02791/) (2021)
- [Joint Semantic Transfer Network for IoT Intrusion Detection](https://mlsanity.com/paper/2210.15911/) (2022)
- [Trustworthy Federated Learning: A Survey](https://mlsanity.com/paper/2305.11537/) (2023)
- [NetTiSA: Extended IP Flow with Time-series Features for Universal Bandwidth-constrained High-speed Network Traffic Classification](https://mlsanity.com/paper/2310.05530/) (2023)
- [Survey of Graph Neural Network for Internet of Things and NextG Networks](https://mlsanity.com/paper/2405.17309/) (2024)
- [Cyber-Physical Systems Security: A Comprehensive Review of Anomaly Detection Techniques](https://mlsanity.com/paper/2502.13256/) (2025)

## Abstract (arXiv)

The proliferation of IoT systems, has seen them targeted by malicious third parties. To address this, realistic protection and investigation countermeasures need to be developed. Such countermeasures include network intrusion detection and network forensic systems. For that purpose, a well-structured and representative dataset is paramount for training and validating the credibility of the systems. Although there are several network, in most cases, not much information is given about the Botnet scenarios that were used. This paper, proposes a new dataset, Bot-IoT, which incorporates legitimate and simulated IoT network traffic, along with various types of attacks. We also present a realistic testbed environment for addressing the existing dataset drawbacks of capturing complete network information, accurate labeling, as well as recent and complex attack diversity. Finally, we evaluate the reliability of the BoT-IoT dataset using different statistical and machine learning methods for forensics purposes compared with the existing datasets. This work provides the baseline for allowing botnet identificaiton across IoT-specifc networks. The Bot-IoT dataset can be accessed at [1].