Published August 6, 2025 | Version v1
Dataset Open

CESNET-CC25: Dataset for detection of C&C communication of botnets in the periodic behavior features from multiflow time series format

Creators

  • 1. ROR icon Czech Technical University in Prague
  • 2. ROR icon Czech Education and Scientific Network
  • 3. ROR icon Czech University of Life Sciences Prague
  • 4. Brno University of Technology

Description

We introduce a novel dataset, CESNET-CC25, specifically designed to capture up-to-date botnet C&C traffic patterns to address these shortcomings. This dataset provides a richer and more representative collection of contemporary threats, enabling more reliable evaluation of detection methods against modern botnet behaviors, including decentralized architectures and encrypted communications.

 

The IP addresses of benign traffic from the CESNET network were anonymized.

 

The PCAP of botnet communication are available here: https://zenodo.org/records/16752462 

The IP flow format of the dataset is available here: https://zenodo.org/uploads/16753890

 

Directory Structure

- benign - contains extracted benign periodic features of multiflows time series
- botnet - contains extracted botnet periodic features of multiflows time series

- <botnet|benign>/<sample_folder>/<aggregation_interval>/ - this represents directory structure

Botnet directory metadata

+----------------------+
| Folder     | Family  |
|------------|---------|
| 1-u4       | Gafgyt  |
| 2-u5       | Mirai   |
| 3-u6       | Mirai   |
| 4-u7       | Mirai   |
| 5-u8       | Mirai   |
| 6-u8_2     | Kaiji   |
| 7-u6_3     | Mirai   |
| 8-u8_3     | Mirai   |
| 9-u0_0     | Miori   |
| 10-u5_4    | Hailbot |
| 11-u6_4    | Gafgyt  |
| 12-u7_4    | Mirai   |
| 13-u8_4    | Hailbot |
| 14-u9      | Hailbot |
| 15-u10     | Mirai   |
| 16-u11     | Gafgyt  |
| 17-u10_3   | Hailbot |
| 18-u11_2   | Mirai   |
| 19-u11_3   | Mirai   |
| 20-u9_4    | Gafgyt  |
| 21-u10_4   | Mirai   |
| 22-u11_5   | Gafgyt  |
| 23-u12_5   | Gafgyt  |
| 24-u12_6   | Mirai   |
| 25-u9_7    | Xorbot  |
| 26-u10_7   | Gafgyt  |
| 27-u12_7   | Hailbot |
| 28-u9_8    | Gafgyt  |
| 29-u10_8   | Mirai   |
| 30-u11_8   | Gafgyt  |
| 31-u9_9    | Gafgyt  |
| 32-u12_9   | Mirai   |
+----------------------+

combined - directory that contains all separated botnets together

Files

Files (5.6 GB)

Name Size Download all
md5:cee8654bee8a3b6623fdae490fa24b7f
5.6 GB Download
md5:7f58e6d986d44612419dc7b843203038
12.1 MB Download