casscloud/CIC-IoT-2023

CIC-IoT-2023 IoT Intrusion Detection Dataset

The CICIoT2023 dataset from the Canadian Institute for Cybersecurity, subsampled and preprocessed for machine learning evaluation.

Configurations

random_3way (default) — 80/10/10 Three-Way Split

Stratified random split with fully separated train/test/validation sets:

• —Train (80%): Model training and architecture search
• —Test (10%): Threshold calibration (held out from training)
• —Validation (10%): Final reported metrics (never touched during training or calibration)

from datasets import load_dataset
ds = load_dataset("lacg030175/CIC-IoT-2023", "random_3way")
# ds["train"]:      1,073,851 rows
# ds["test"]:       134,231 rows
# ds["validation"]: 134,232 rows

random (legacy) — 80/20 Split

Original 80/20 split for backward compatibility with existing runs.

ds = load_dataset("lacg030175/CIC-IoT-2023", "random")
# ds["train"]: 1,073,851 rows
# ds["test"]:  268,463 rows

Subsampling Strategy

The original dataset has 46.7M rows (97.6% attack traffic). To create a manageable benchmark:

• —Benign: up to 200,000 rows
• —Each attack type: up to 50,000 rows
• —Total: 1,342,314 rows (199,988 benign, 1,142,326 attack)

This preserves all 33 attack types while balancing the dataset for binary classification.

Top-20 RF Features

1. 1.HTTPS
2. 2.Number
3. 3.TimeToLive
4. 4.Max
5. 5.ackflagnumber
6. 6.Rate
7. 7.IAT
8. 8.ack_count
9. 9.Header_Length
10. 10.Min
11. 11.Variance
12. 12.pshflagnumber
13. 13.Tot sum
14. 14.Std
15. 15.Tot size
16. 16.syn_count
17. 17.AVG
18. 18.rstflagnumber
19. 19.DNS
20. 20.rst_count

Attack Types (7 classes, 33 sub-types)

Labels

• —Binary (label): 0 = Benign, 1 = Attack
• —Multi-class (Label): 34 categories (fine-grained attack types)
• —Grouped (attack_class): 8 classes (7 attack groups + Benign)

Features

39 numeric flow-level features.

Note on Temporal Split

Unlike UNSW-NB15 and CICIDS2017, CIC-IoT-2023 does not have a natural temporal ordering (data is organized by attack type, not capture time). Only a random split is provided.

Citation

@article{neto2023ciciot,
  title={CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment},
  author={Neto, Euclides Carlos Pinto and others},
  journal={Sensors},
  volume={23},
  number={13},
  year={2023},
  publisher={MDPI}
}

License

CC BY 4.0 — original dataset by the Canadian Institute for Cybersecurity, University of New Brunswick.