CESNET-CC25: Dataset for detection of C&C communication of botnets in the IP flow format

We introduce a novel dataset, CESNET-CC25, specifically designed to capture up-to-date botnet C&C traffic patterns to address these shortcomings. This dataset provides a richer and more representative collection of contemporary threats, enabling more reliable evaluation of detection methods against modern botnet behaviors, including decentralized architectures and encrypted communications.

The IP addresses of benign traffic from the CESNET network were anonymized.

The PCAP of botnet communication are available here: https://zenodo.org/records/16752462 

Directory Structure

- benign - contains extracted benign network flows
- botnet - contains extracted botnet network flows

Botnet directory metadata

+--------------------------------------------------+
| Folder     | Family  | C&C IP           | Port   |
|------------|---------|------------------|--------|
| 1-u4       | Gafgyt  | 38.134.189.10    | 12345  |
| 2-u5       | Mirai   | 107.172.51.228   | 3778   |
| 3-u6       | Mirai   | 83.222.191.90    | 13566  |
| 4-u7       | Mirai   | 141.98.10.115    | 60195  |
| 5-u8       | Mirai   | 83.222.191.90    | 13566  |
| 6-u8_2     | Kaiji   | 158.178.235.53   | 888    |
| 7-u6_3     | Mirai   | 160.191.245.5    | 56999  |
| 8-u8_3     | Mirai   | 160.191.245.5    | 56999  |
| 9-u0_0     | Miori   | 79.124.40.48     | 3277   |
| 10-u5_4    | Hailbot | 146.103.38.7     | 4338*  |
| 11-u6_4    | Gafgyt  | 103.130.214.198  | 23     |
| 12-u7_4    | Mirai   | 193.143.1.166    | 1908   |
| 13-u8_4    | Hailbot | 146.103.38.7     | 17526  |
| 14-u9      | Hailbot | 185.198.58.166   | 18581* |
| 15-u10     | Mirai   | 156.244.6.20     | 64715* |
| 16-u11     | Gafgyt  | 45.135.194.61    | 6606   |
| 17-u10_3   | Hailbot | 172.86.73.60     | 3130*  |
| 18-u11_2   | Mirai   | 193.143.1.32*    | 1440   |
| 19-u11_3   | Mirai   | 172.86.73.60     | 9823*  |
| 20-u9_4    | Gafgyt  | 185.74.222.38    | 8080   |
| 21-u10_4   | Mirai   | 96.62.214.212    | 3778   |
| 22-u11_5   | Gafgyt  | 87.251.79.180    | 12345  |
| 23-u12_5   | Gafgyt  | 37.44.238.66     | 666    |
| 24-u12_6   | Mirai   | 84.200.24.112    | 9931   |
| 25-u9_7    | Xorbot  | 37.44.238.92     | 443    |
| 26-u10_7   | Gafgyt  | 162.0.214.70     | 1111   |
| 27-u12_7   | Hailbot | 217.105.153.175  | 11950  |
| 28-u9_8    | Gafgyt  | 209.141.35.180   | 23     |
| 29-u10_8   | Mirai   | 159.89.101.70    | 1440   |
| 30-u11_8   | Gafgyt  | 196.251.80.231   | 839    |
| 31-u9_9    | Gafgyt  | 37.44.238.66     | 666    |
| 32-u12_9   | Mirai   | 209.141.59.9     | 3778   |
+--------------------------------------------------+