NoSQLiM811: MongoDB Injection Detection Dataset

The queries were generated and validated in a controlled MongoDB 8.0.11 environment using a consistent document structure and cover all CRUD operations across multiple collections. Malicious samples span a broad range of NoSQL injection techniques, including tautologies, union‑based injections, JavaScript injections, piggybacked queries, blind injections, and time‑based variants, while benign queries reflect realistic operational behavior.

All queries are provided as raw MongoDB strings with a binary label indicating benign (0) or malicious (1), stored in a single CSV file for easy integration into machine learning workflows, anomaly detection, and the development of NoSQL injection detection techniques. The dataset is intended as a reusable resource for developing, testing, and comparing NoSQL security models and can be extended to incorporate additional attack patterns.