ASEADOS-SDN-IoT: A novel SDN-IoT network intrusion detection dataset and framework

Abstract

The convergence of Software-Defined Networking (SDN) and the Internet of Things (IoT) offers a transformative architecture for intelligent, programmable, and scalable network management. However, this integration also exposes new attack surfaces and security challenges that require robust Intrusion Detection Systems (IDS). Progress in IDS research for SDN-IoT environments has been limited by the absence of realistic datasets that capture both IoT traffic diversity and SDN control-plane dynamics. To address this gap, this paper presents ASEADOS-SDN-IoT, a novel, publicly available intrusion detection dataset supported by a fully documented hybrid testbed framework. The proposed framework integrates physical IoT devices and virtual IoT nodes within an ONOS-controlled OpenFlow infrastructure, enabling synchronised collection of packet-flow data and SDN controller telemetry under benign and adversarial conditions. The dataset covers four representative attack categories-Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), Probe, and Botnet-and captures genuine control-data plane interactions observed during live network operation. ASEADOS-SDN-IoT comprises 457,044 labelled flow instances with 83 statistical features and is publicly released to support reproducible research. The experimental evaluation using machine learning (ML) and deep learning (DL) models demonstrates clear separability between benign and malicious traffic. It confirms the dataset’s suitability for training and benchmarking intrusion detection systems. By combining realistic traffic generation, cross-layer visibility, and reproducible design, ASEADOS-SDN-IoT provides a robust benchmark for advancing secure and adaptive SDN-IoT infrastructures.