DOI: 10.5281/zenodo.18228606
title: UAV Communication Malware Dataset

description: This repository provides a multiyear UAV communication malware dataset designed to support reproducible research on intrusion and malware detection in UAV-enabled IoT networks. The dataset contains time-indexed communication and telemetry records sampled at a fixed 10-minute interval from 17 October 2021 to 31 October 2025 (inclusive). Each record summarizes network-flow behavior, command-and-control dynamics, telemetry stability indicators, session/protocol context, temporal trend descriptors, and interaction/coordination patterns derived from UAV communication activity among aerial nodes, ground control stations, and relay components.

The dataset is intended for supervised multi-class classification, with a target label y_label capturing seven security states: (0) benign traffic, (1) botnet-controlled UAV traffic, (2) GPS spoofing, (3) command injection, (4) firmware-level malware, (5) distributed denial-of-service/flooding, and (6) data exfiltration behavior. Class occurrence is strongly imbalanced, reflecting realistic operational conditions where benign traffic dominates and attack events are comparatively rare. Feature values are also deliberately non-uniform and heavy-tailed, exhibiting skewness, burstiness, zero-inflation, and long-tail behavior commonly observed in telemetry and network traffic, which makes the dataset suitable for evaluating robustness under imbalance and distribution shifts.

All records are anonymized and do not contain personal identifiers or sensitive operational metadata. The dataset is released for research use and secondary analysis. It is provided as a single CSV file with a timestamp column and 40+ traffic- and telemetry-derived features, enabling straightforward use in machine learning pipelines.

File: uav_malware_traffic_10min_2021_2025.csvFormat: CSV, UTF-8Time column: timestamp (10-minute resolution)

 

eature overview (grouped)

The dataset includes the following feature families.

1) Flow-level communication statistics





protocol_type, flow_duration_s, total_packets, total_bytes




packet_rate_pps, byte_rate_Bps, avg_packet_size_B, packet_size_std_B




interarrival_mean_s, interarrival_std_s, burstiness_index



2) Control and command dynamics





command_frequency_hz, command_interval_var, command_entropy




unauthorized_cmd_ratio, command_repetition_rate, command_response_delay_s



3) Telemetry consistency and stability





gps_update_rate_hz, gps_position_drift_m, altitude_variance, velocity_variance




heading_variation_deg, telemetry_loss_ratio, sensor_sync_error



4) Payload statistical characteristics





payload_entropy, encrypted_payload_ratio, payload_size_skewness




payload_repetition_score, abnormal_payload_ratio



5) Protocol and session context





session_count, session_duration_avg_s, session_reset_rate




auth_failure_count, connection_attempt_rate



6) Temporal trend descriptors





traffic_trend_slope, latency_trend, packet_rate_variance_windowed




command_drift_index, temporal_entropy_change



7) Interaction and coordination patterns





peer_count, peer_switch_rate, broadcast_ratio




uplink_downlink_ratio, coordinated_activity_score



Target label





y_label ∈ {0,…,6} representing benign and six malware/attack categories