Large-scale topological botnet detection datasets for graph machine learning and network security, containing 4 different types of synthetic botnet topologies and 2 different real botnet topologies overlaid onto large real-world background traffic communication networks. Each dataset contains a specific botnet topology, with 960 graphs in total, randomly split to train/val/test sets. There are labels on both nodes and edges indicating whether they were in the botnet (evil) community. Learning tasks could target at predicting on nodes to detect whether they are botnet nodes, or recovering the whole botnet community by also predicting on edges as whether they belong to the original botnet. There are no unique features on nodes or edges, as the detection is purely based on topological properties within the graph (topological discovery).

For automatic data downloading, evaluation API, and GNN (graph neural network) training pipeline, check https://github.com/jzhou316/botnet-detection