lacg030175/CIC-IoT-2023-canonical-neto

CIC-IoT-2023 — Canonical (Neto et al.) Variant

This is the canonical CIC-IoT-2023 dataset, sourced from bencorn/CIC-IoT-2023's CSV/MERGED_CSV/ folder, which contains Neto et al.'s authentic merged CSVs WITH embedded labels (vs. bencorn's other CSV/CSV/<attack>/ re-organization which lost ~6.5M rows during the folder-restructure).

Why this exists: prior lacg030175/CIC-IoT-2023-full and -full-raw were built from CSV/CSV/ and contained only 38.5M rows. This one contains ~45,019,243 rows (the actual canonical Neto count).

NaN/Inf preservation: rows with NaN or ±Inf are kept (no dropna). Use the paired ThermometerEncoder(invalid_encoding="single_bit") to encode those states as a learnable per-feature is_invalid flag bit instead of silently collapsing them to zero.

Provenance

• —Original CSV format from Neto et al. (2023): "CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment", Sensors 2023.
• —HF mirror: bencorn/CIC-IoT-2023, CSV/MERGED_CSV/Merged{01..63}.csv.
• —This dataset preserves Neto's original labels in Label_orig (UPPERCASE) and provides our normalized Label + attack_class + label (binary 0/1).

Splits

• —random_3way: 80% train / 10% test / 10% validation (stratified on binary label, seed=42).
• —random: 80% train / 20% test (test = test ∪ validation from random_3way).

Class distribution

• —Benign: 1,051,373 (2.34%)
• —BruteForce: 12,522 (0.03%)
• —DDoS: 32,536,197 (72.27%)
• —DoS: 7,746,554 (17.21%)
• —Mirai: 2,521,731 (5.60%)
• —Recon: 661,121 (1.47%)
• —Spoofing: 465,937 (1.03%)
• —Unknown: 9 (0.00%)
• —Web-based: 23,799 (0.05%)