• R Anurekha

Distributed Denial-of-Service (DDoS) attacks remain a significant threat to the availability and reliability of Internet-based services. The increasing diversity of attack mechanisms, communication protocols, network architectures, and deployment environments has resulted in the development of numerous datasets for DDoS and network-security research. However, these datasets differ substantially in their provenance, traffic-generation methodology, network environment, attack coverage, traffic representation, labeling, temporal characteristics, and accessibility. Consequently, datasets containing DDoS traffic cannot be considered equivalent, and selecting an appropriate dataset requires an understanding of these differences. This paper presents a comprehensive analytical review of representative publicly available datasets relevant to DDoS research. Rather than attempting to catalogue every dataset reported in the literature, the study applies a structured screening methodology to identify representative non-IoT datasets and distinguish dedicated DDoS datasets from broader network-security datasets containing DDoS traffic. Ten representative datasets are initially examined according to their origin, network environment, DDoS relevance, attack coverage, traffic representation, temporal characteristics, and principal limitations. Three complementary datasets—CAIDA DDoS Attack 2007, CICDDoS2019, and the Boğaziçi University DDoS Dataset—are subsequently selected for detailed analysis because they represent distinct data-collection conditions: an observed real Internet DDoS event, a dedicated controlled multi-vector DDoS environment, and a university campus network containing experimentally generated DDoS traffic alongside real background traffic. The comparative analysis demonstrates that the datasets examined in this study provide complementary forms of evidence rather than interchangeable representations of the DDoS threat. Observational datasets provide operational context but may be limited in event and attack diversity, whereas controlled datasets provide structured attack scenarios and documented experimental conditions but may not reproduce all characteristics of operational Internet traffic. The study further identifies variations in attack taxonomy, temporal representation, background traffic, ground truth, network context, and traffic representation. Based on these observations, requirements for future DDoS datasets are identified, including documented provenance, diverse attack scenarios, temporal annotations, representative benign traffic, reliable ground truth, packet and flow representations, and transparent documentation.

Distributed Denial-of-Service, DDoS datasets, network traffic, cybersecurity, dataset analysis, network security, intrusion detection

"DDoS Attack Datasets: A Comprehensive Analytical Review of Representative Datasets", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 10, page no.a640-a652, October-2026, Available :http://www.jetir.org/papers/JETIR2610070.pdf

"DDoS Attack Datasets: A Comprehensive Analytical Review of Representative Datasets", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 10, page no. ppa640-a652, October-2026, Available at : http://www.jetir.org/papers/JETIR2610070.pdf