Published August 6, 2025 | Version v1
Dataset Open

CESNET-CC25: Long-term capture of C&C communication of botnets in the PCAP format

Creators

  • 1. ROR icon Czech Technical University in Prague
  • 2. ROR icon Czech Education and Scientific Network
  • 3. ROR icon Czech University of Life Sciences Prague
  • 4. ROR icon Brno University of Technology

Description

We introduce a novel dataset, CESNET-CC25, specifically designed to capture up-to-date botnet C&C traffic patterns to address these shortcomings. This dataset provides a richer and more representative collection of contemporary threats, enabling more reliable evaluation of detection methods against modern botnet behaviors, including decentralized architectures and encrypted communications.

Directory Structure

- botnet - contains extracted botnet network packets

Botnet directory metadata

+--------------------------------------------------+
| Folder     | Family  | C&C IP           | Port   |
|------------|---------|------------------|--------|
| 1-u4       | Gafgyt  | 38.134.189.10    | 12345  |
| 2-u5       | Mirai   | 107.172.51.228   | 3778   |
| 3-u6       | Mirai   | 83.222.191.90    | 13566  |
| 4-u7       | Mirai   | 141.98.10.115    | 60195  |
| 5-u8       | Mirai   | 83.222.191.90    | 13566  |
| 6-u8_2     | Kaiji   | 158.178.235.53   | 888    |
| 7-u6_3     | Mirai   | 160.191.245.5    | 56999  |
| 8-u8_3     | Mirai   | 160.191.245.5    | 56999  |
| 9-u0_0     | Miori   | 79.124.40.48     | 3277   |
| 10-u5_4    | Hailbot | 146.103.38.7     | 4338*  |
| 11-u6_4    | Gafgyt  | 103.130.214.198  | 23     |
| 12-u7_4    | Mirai   | 193.143.1.166    | 1908   |
| 13-u8_4    | Hailbot | 146.103.38.7     | 17526  |
| 14-u9      | Hailbot | 185.198.58.166   | 18581* |
| 15-u10     | Mirai   | 156.244.6.20     | 64715* |
| 16-u11     | Gafgyt  | 45.135.194.61    | 6606   |
| 17-u10_3   | Hailbot | 172.86.73.60     | 3130*  |
| 18-u11_2   | Mirai   | 193.143.1.32*    | 1440   |
| 19-u11_3   | Mirai   | 172.86.73.60     | 9823*  |
| 20-u9_4    | Gafgyt  | 185.74.222.38    | 8080   |
| 21-u10_4   | Mirai   | 96.62.214.212    | 3778   |
| 22-u11_5   | Gafgyt  | 87.251.79.180    | 12345  |
| 23-u12_5   | Gafgyt  | 37.44.238.66     | 666    |
| 24-u12_6   | Mirai   | 84.200.24.112    | 9931   |
| 25-u9_7    | Xorbot  | 37.44.238.92     | 443    |
| 26-u10_7   | Gafgyt  | 162.0.214.70     | 1111   |
| 27-u12_7   | Hailbot | 217.105.153.175  | 11950  |
| 28-u9_8    | Gafgyt  | 209.141.35.180   | 23     |
| 29-u10_8   | Mirai   | 159.89.101.70    | 1440   |
| 30-u11_8   | Gafgyt  | 196.251.80.231   | 839    |
| 31-u9_9    | Gafgyt  | 37.44.238.66     | 666    |
| 32-u12_9   | Mirai   | 209.141.59.9     | 3778   |
+--------------------------------------------------+

Files
- <sample>.pcapng - original pcapng with captured communication
- <sample>-train.pcapng - train split pcapng
- <sample>-test.pcapng - test split pcapng

Files

Files (43.4 MB)

Name Size Download all
md5:f66a6410bc1e35881f2de2077788847f
43.4 MB Download