A Topology Poisoning Attack Dataset for Machine Learning-Based Detection in Software-Defined Networks

TPA Dataset is a multi-controller, multi-variant TPA dataset generated under controlled conditions will enable effective machine-learning detection of sophisticated host-location hijacking and link-fabrication attacks that existing SDN datasets largely omit.

Binary labels divide the data into normal or benign traffic, which accounts for 68,424 flows (27.7%), and attack traffic, which accounts for 178,922 flows (72.3%). Label 0 denotes normal traffic and label 1 denotes attack traffic. A finer category field further distinguishes the records: Benign traffic was drawn from the InSDN dataset while three novel attack scenarios, Persistent Ghost Host (PGH, a host-location hijacking variant), Chameleon Topography (CT, an adaptive link-fabrication attack), and a Combined Topology-Aware Host Hijacking orchestrator, were executed with Scapy scripts and captured by tcpdump; CICFlowMeter then extracted the statistical features.