NF-ToN-IoT v2: IoT Intrusion Detection Dataset

• NF-ToN-IoT v2 is a NetFlow-based intrusion detection dataset characterized by refined labels and an expanded feature set for both binary and multi-class classification.
• It originates from the ToN-IoT testbed, integrating network traffic, IoT telemetry, and software-defined networking to support diverse research paradigms.
• The dataset is benchmarked using standardized preprocessing, detailed flow analysis, and rigorous evaluation of class imbalances, enhancing its practical value for security research.

NF-ToN-IoT v2 is a NetFlow-based intrusion-detection dataset derived from the network-traffic component of the ToN-IoT testbed and used as a benchmark for machine-learning, graph-learning, adversarial-robustness, federated, and LLM-based network intrusion detection research. In the literature, it is presented as a later development of the original NF-ToN-IoT release introduced by Sarhan et al., which converted ToN-IoT packet captures into NetFlow records and aligned them with attack labels; later papers describe a v2 form with more precise labeling and additional features, but the published descriptions are not uniform in schema size, exporter lineage, or total record count (Sarhan et al., 2020, Raskovalov et al., 2022, Gurung et al., 26 Jul 2025).

1. Lineage within the ToN-IoT family

The dataset belongs to the broader ToN-IoT family, a heterogeneous corpus collected from an IoT–fog–cloud testbed that includes telemetry data of IoT services, operating-system traces, and network traffic. The underlying environment was programmatically controlled using Software-Defined Network and Network-Function Virtualization through VMware NSX and vCloud NFV, with edge devices, fog-layer virtual machines and gateways, and cloud services participating in coordinated benign and attack scenarios (Moustafa et al., 2020, Moustafa et al., 2020).

The original NF-ToN-IoT release emerged from a specific methodological goal: creating a common NetFlow-based feature space across heterogeneous NIDS benchmarks such as UNSW-NB15, BoT-IoT, ToN-IoT, and CSE-CIC-IDS2018. Sarhan et al. argued that the original datasets used incompatible feature sets, different extraction tools, and sometimes dataset-specific artefacts, making cross-dataset evaluation difficult. NetFlow was positioned as widely deployed, relatively lightweight, and easier to collect in operational networks because it is primarily header-based (Sarhan et al., 2020).

Within that lineage, NF-ToN-IoT is the NetFlow representation of the ToN-IoT network traffic subset. Later papers then use the designation NF-ToN-IoT v2, or use “NF-ToN-IoT” in a way that is described as implicitly v2, for an expanded or rectified benchmark with refined labels and additional features (Islam et al., 7 Apr 2026, Gurung et al., 26 Jul 2025). This suggests that the v2 name denotes a later, more elaborate release family rather than a single universally fixed tabular schema.

2. Published descriptions and schema evolution

The literature does not present a single canonical description of NF-ToN-IoT v2. Instead, multiple papers describe related versions or operational views of the dataset, with different feature counts, record counts, and preprocessing conventions (Sarhan et al., 2020, Raskovalov et al., 2022, Islam et al., 7 Apr 2026, Gurung et al., 26 Jul 2025).

Source	Dataset portrayal	Salient details
(Sarhan et al., 2020)	NF-ToN-IoT	12 NetFlow fields, 1,379,274 flows, nProbe extraction from ToN-IoT PCAPs
(Raskovalov et al., 2022)	NF-ToN-IoT-v2	45 features, 16,940,496 flows, extended feature set with derived statistics and encoded flags
(Islam et al., 7 Apr 2026)	NF-ToN-IoT (implicitly v2)	53 attributes, 27.5 million flows, NetFlow v3 source, 14 selected features for MA-IDS
(Gurung et al., 26 Jul 2025)	NF-ToN-IoT-v2	More than 13 million records, more precise labeling and additional features, 10-class IDS use

The earliest NetFlow release described by Sarhan et al. was generated directly from publicly available ToN-IoT PCAPs using nProbe in offline mode with NetFlow v9 output. That release used 12 fields: source and destination IPv4 addresses, source and destination ports, protocol, TCP flags, layer-7 protocol, bytes and packets in each direction, and flow duration in milliseconds (Sarhan et al., 2020).

A later feature-analysis paper operationalized NF-ToN-IoT as an eight-feature NetFlow-based dataset, namely IN_BYTES, OUT_BYTES, IN_PKTS, OUT_PKTS, PROTOCOL, TCP_FLAGS, FLOW_DURATION, and L7_PROTO. In that framing, NF-ToN-IoT was already the compact NetFlow variant of the original 44-feature Zeek/Bro ToN-IoT network dataset (Sarhan et al., 2021).

The 2022 rectification study describes NF-ToN-IoT-v2 differently: as a 45-feature dataset derived from ToN-IoT PCAPs, extended with derivatives of NF-ToN-IoT features such as numbers of packets with specific size, average values for certain categories, and enumerated connection flags, including TCP and DNS-related fields (Raskovalov et al., 2022). By contrast, the MA-IDS paper describes NF-ToN-IoT, implicitly v2, as an IoT NetFlow dataset curated by the University of Queensland, derived from NetFlow v3 traffic logs, with 53 original attributes from which 14 are selected for the proposed method (Islam et al., 7 Apr 2026).

The adversarial-training study adds another description, stating that NF-ToN-IoT-v2 is based on the NF-ToN-IoT dataset but has more precise labeling and additional features, making it appropriate for multi-class classification tasks (Gurung et al., 26 Jul 2025). A plausible implication is that “NF-ToN-IoT v2” has circulated in the literature both as a concrete dataset release and as a broader reference to later, corrected, or expanded NetFlow-based ToN-IoT derivatives.

3. Labels, attack taxonomy, and class imbalance

The attack taxonomy associated with the NF-ToN-IoT lineage is inherited from the ToN-IoT network subset. The original NetFlow conversion labels flows by matching the five flow identifiers—source IP, destination IP, source port, destination port, and protocol—to ground-truth attack events, producing both a binary label and an attack-type label (Sarhan et al., 2020).

Across the literature, the full multi-class label space is usually given as ten classes: Benign, Backdoor, DDoS, DoS, Injection, MITM, Password, Ransomware, Scanning, and XSS. The 2022 rectification paper reports the following counts for NF-ToN-IoT-v2: 6,099,469 benign flows, 16,809 backdoor, 2,026,234 DDoS, 712,609 DoS, 684,465 injection, 7,723 MITM, 3,425 ransomware, 1,153,323 password, 3,781,419 scanning, and 2,455,020 XSS, for a total of 16,940,496 flows (Raskovalov et al., 2022).

Later application papers sometimes use task-specific subsets rather than the full taxonomy. The MA-IDS study formulates NF-ToN-IoT as a 9-class benchmark using Benign, Scanning, DDoS, Backdoor, DoS, Injection, Password, XSS, and MITM, with no additional merging or relabeling described (Islam et al., 7 Apr 2026). The adversarial-training paper, by contrast, uses the 10-class label space explicitly, including ransomware, and its reported test-set counts again show strong skew, with mitm and ransomware remaining rare relative to scanning, xss, ddos, and benign (Gurung et al., 26 Jul 2025).

Class imbalance is therefore a recurrent structural property. In the earlier NF-ToN-IoT release, attack flows dominated benign flows, and rare classes such as Ransomware and MITM were already highlighted as difficult to learn (Sarhan et al., 2020). The 2022 and 2025 papers continue to show that rare classes persist in later variants, while the 2026 MA-IDS paper explicitly neutralizes this skew by constructing balanced 50,000-sample and 20,000-sample subsets with equal class quotas for library building and evaluation (Islam et al., 7 Apr 2026). This makes the dataset simultaneously a benchmark for real-world skewed intrusion detection and, under balanced subsampling, a benchmark for macro-averaged multi-class reasoning.

4. Feature sets and preprocessing conventions

The central technical characteristic of the NF-ToN-IoT line is its flow-based representation. In its earliest form, the dataset used 12 NetFlow fields extracted with nProbe; in ML experiments, identifiers such as IP addresses and ports were dropped before training to avoid bias toward attacking or victim nodes, leaving an 8-dimensional numeric vector consisting of PROTOCOL, TCP_FLAGS, L7_PROTO, IN_BYTES, OUT_BYTES, IN_PKTS, OUT_PKTS, and FLOW_DURATION_MILLISECONDS (Sarhan et al., 2020).

Feature-analysis work confirmed the importance of this compact representation. For NF-ToN-IoT, three filter methods—chi-square, information gain, and correlation—ranked TCP_FLAGS, traffic-volume features, FLOW_DURATION, L7_PROTO, and PROTOCOL as the principal predictors for binary attack detection. That study reported that a relatively small fraction of 2–3 features can achieve close to maximum performance, and that Random Forest attains essentially the same near-perfect performance with 6 of 8 features as with the full 8-feature set (Sarhan et al., 2021).

Subsequent work expanded the schema rather than preserving that minimal form. The rectification paper characterizes NF-ToN-IoT-v2 as a 45-feature dataset and criticizes the inclusion of many derived statistics and enumerated flag fields because conventional numeric normalization can scramble the semantics of those fields. In response, it proposes a standardized NetFlowv5-based feature set that separates numeric quantities from binary protocol flags and applies a dataset-agnostic normalization based on the error function only to numeric attributes such as duration, source and destination packet counts, and source and destination byte counts (Raskovalov et al., 2022).

The MA-IDS paper adopts yet another operational view. From 53 NetFlow V3 attributes, it selects 14 features on the basis of discriminative relevance, computational efficiency, and privacy preservation. These include contextual identifiers, volumetric statistics, temporal features such as flow duration and inter-arrival times, throughput measures, and TCP flag aggregates. The features are cleaned, protocol identifiers are mapped to categorical representations, and each flow is serialized into structured JSON to support LLM-based reasoning and retrieval (Islam et al., 7 Apr 2026).

The adversarial-training paper does not enumerate field names but describes a high-dimensional tabular dataset combining network attributes such as source and destination IPs, ports, and protocols with traffic statistics such as packet counts, payload sizes, and flow durations. Missing values are handled with mean imputation for numerical features and placeholder values for categorical features, numerical features are min–max normalized, and labels are integer-encoded for multi-class XGBoost training (Gurung et al., 26 Jul 2025).

5. Benchmark role across research paradigms

NF-ToN-IoT v2 and its immediate predecessors occupy a broad benchmark role. In the original NetFlow-dataset paper, a single Extra Trees classifier was evaluated across all NF datasets on a common feature space. For NF-ToN-IoT, binary intrusion detection was strong: 99.66% accuracy, 0.9965 AUC, 1.00 F1 score, 99.67% detection rate, 0.37% false alarm rate, and 6.05 microseconds prediction time per sample. Multi-class attack recognition was much weaker, with 56.34% accuracy, 0.60 weighted F1, and 21.21 microseconds prediction time, which the authors interpreted as evidence that coarse NetFlow features were sufficient for attack-versus-benign discrimination but not for fine attack-type separation (Sarhan et al., 2020).

Feature-selection work reinforced the usefulness of the compact NetFlow representation for binary IDS. On NF-ToN-IoT, Random Forest with the full 8 features achieved 99.38% accuracy, 0.9946 AUC, 1.00 F1, 99.33% detection rate, and 0.42% false alarm rate, while the top 6 correlation-ranked features preserved the same accuracy and AUC with slightly lower false alarm rate and prediction time. The same study showed that a smaller deep feed-forward network was materially weaker than Random Forest on this dataset (Sarhan et al., 2021).

Graph-learning work then positioned NF-ToN-IoT-v2 as a high-performing GNN benchmark. The 2022 rectification paper compares previously published results for NF-ToN-IoT and NF-ToN-IoT-v2 with its own cleaned ToN-IoT-R variant. In that comparison, NF-ToN-IoT-v2 with 39 edge features achieved 0.98 weighted average accuracy, while the authors’ standardized 10-feature NetFlowv5-compatible representation on ToN-IoT-R achieved 0.97 weighted average accuracy, nearly matching the larger schema with a smaller and more deployment-oriented feature set (Raskovalov et al., 2022).

The dataset has also become a testbed for reasoning-based and robustness-oriented methods. MA-IDS evaluates on balanced NF-ToN-IoT subsets and reports 84.00% accuracy, 85.56% macro precision, 85.00% macro recall, and 85.22% macro F1 in its library-only evaluation phase, compared with 4.96% macro F1 for zero-shot GPT-4o and 93.42% macro F1 for SVM on the same 9-class task (Islam et al., 7 Apr 2026). The adversarial-training paper uses NF-ToN-IoT-v2 as a large-scale multi-class benchmark for XGBoost with FGSM adversarial augmentation and reports 95.3% accuracy on clean data and 94.5% accuracy on adversarial data, whereas the undefended model falls to 39.4% accuracy and 0.3059 F1 under FGSM (Gurung et al., 26 Jul 2025). A quantum-architecture-search study employs a balanced 10,000-sample subset of NF-ToN-IoT-V2 for binary classification and reports up to 94.25% test accuracy with 12 qubits under its graph-based Bayesian optimization pipeline (Choudhary et al., 10 Dec 2025).

6. Rectification, controversies, and research use considerations

The principal controversy surrounding NF-ToN-IoT v2 concerns data integrity and feature semantics rather than its value as a benchmark. The 2022 rectification paper reports duplicated flows with different labels in NF-ToN-IoT, flows to or from external IPs recorded as attacks although they should not be considered for realistic internal NIDS training, and benign router or DNS traffic involving 192.168.1.1 labeled as attacks. It also argues that enumerating connection flags and then applying conventional dataset-dependent normalization makes the meaning of those flags impossible to restore and reduces cross-dataset portability (Raskovalov et al., 2022).

These issues matter because much of the dataset’s appeal lies in its intended realism. The original NF dataset paper emphasized NetFlow as a common, lightweight, production-feasible representation, while later work often used richer schemas, balanced resampling, or benchmark-specific preprocessing. The MA-IDS paper, for example, deliberately uses uniform class sampling with equal class quotas, which facilitates macro-averaged evaluation and rule induction but does not reflect the dataset’s natural skew (Islam et al., 7 Apr 2026). The adversarial-training paper uses a random 70/30 split and does not describe temporal or device-based partitioning, which leaves open the extent to which the reported performance reflects deployment-like generalization (Gurung et al., 26 Jul 2025).

Versioning is itself a documented ambiguity. Sarhan et al. describe NF-ToN-IoT but not a v2 revision, and they explicitly publish the first NetFlow family for research purposes. Later works refer to NF-ToN-IoT-v2 or treat “NF-ToN-IoT” as implicitly v2, while also changing reported feature counts and total flows (Sarhan et al., 2020, Islam et al., 7 Apr 2026). For that reason, exact usage requires consultation of the dataset release being employed: the precise feature list, label definitions, and any corrections relative to earlier NetFlow releases are not stable across all papers.

Despite those caveats, the dataset remains a central reference point for IoT intrusion detection research. It connects flow-based NIDS evaluation to the wider ToN-IoT ecosystem of host and telemetry data collected on the same SDN/NFV-backed testbed, and it supports binary, multi-class, adversarial, graph-based, federated, and LLM-grounded evaluation paradigms. Its significance lies not in a single fixed schema, but in a continuing line of NetFlow-based ToN-IoT benchmarks whose evolution has itself become part of the research problem (Moustafa et al., 2020, Moustafa et al., 2020, Raskovalov et al., 2022).