UNSW-NB15 is a network intrusion dataset. It contains nine different attacks, includes DoS, worms, Backdoors, and Fuzzers. The dataset contains raw network packets. The number of records in the training set is 175,341 records and the testing set is 82,332 records from the different types, attack and normal. Source: Evaluation of Adversarial Training on Different Types of Neural Networks in Deep Learning-based IDSs Image Source: https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/ Paper: UNSW-NB15: a comprehensive data set for network intrusion detection systems

The 20 Newsgroups data set is a collection of approximately 20,000 newsgroup documents, partitioned (nearly) evenly across 20 different newsgroups.

Intrusion Detection Evaluation Dataset (CIC-IDS2017) Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are the most important defense tools against the sophisticated and ever-growing network attacks. Due to the lack of reliable test and validation datasets, anomaly-based intrusion detection approaches are suffering from consistent and accurate performance evolutions. Our evaluations of the existing eleven datasets since 1998 show that most are out of date and unreliable. Some of these datasets suffer from the lack of traffic diversity and volumes, some do not cover the variety of known attacks, while others anonymize packet payload data, which cannot reflect the current trends. Some are also lacking feature set and metadata. CICIDS2017 dataset contains benign and the most up-to-date common attacks, which resembles the true real-world data (PCAPs). It also includes the results of the network traffic analysis using CICFlowMeter with labeled flows based on the time stamp, source, and destination IPs, source and destination ports, protocols and attack (CSV files). Also available is the extracted features definition. Generating realistic background traffic was our top priority in building this dataset. We have used our proposed B-Profile system (Sharafaldin, et al. 2016) to profile the abstract behavior of human interactions and generates naturalistic benign background traffic. For this dataset, we built the abstract behaviour of 25 users based on the HTTP, HTTPS, FTP, SSH, and email protocols. The data capturing period started at 9 a.m., Monday, July 3, 2017 and ended at 5 p.m. on Friday July 7, 2017, for a total of 5 days. Monday is the normal day and only includes the benign traffic. The implemented attacks include Brute Force FTP, Brute Force SSH, DoS, Heartbleed, Web Attack, Infiltration, Botnet and DDoS. They have been executed both morning and afternoon on Tuesday, Wednesday, Thursday and Friday. In our recent dataset evaluation framework (Gharib et al., 2016), we have identified eleven criteria that are necessary for building a reliable benchmark dataset. None of the previous IDS datasets could cover all of the 11 criteria. In the following, we briefly outline these criteria: Complete Network configuration: A complete network topology includes Modem, Firewall, Switches, Routers, and presence of a variety of operating systems such as Windows, Ubuntu and Mac OS X. Complete Traffic: By having a user profiling agent and 12 different machines in Victim-Network and real attacks from the Attack-Network. Labelled Dataset: Section 4 and Table 2 show the benign and attack labels for each day. Also, the details of the attack timing will be published on the dataset document. Complete Interaction: As Figure 1 shows, we covered both within and between internal LAN by having two different networks and Internet communication as well. Complete Capture: Because we used the mirror port, such as tapping system, all traffics have been captured and recorded on the storage server. Available Protocols: Provided the presence of all common available protocols, such as HTTP, HTTPS, FTP, SSH and email protocols. Attack Diversity: Included the most common attacks based on the 2016 McAfee report, such as Web based, Brute force, DoS, DDoS, Infiltration, Heart-bleed, Bot and Scan covered in this dataset. Heterogeneity: Captured the network traffic from the main Switch and memory dump and system calls from all victim machines, during the attacks execution. Feature Set: Extracted more than 80 network flow features from the generated network traffic using CICFlowMeter and delivered the network flow dataset as a CSV file. See our PCAP analyzer and CSV generator. MetaData: Completely explained the dataset which includes the time, attacks, flows and labels in the published paper. The full research paper outlining the details of the dataset and its underlying principles: Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Purtogal, January 2018 Day, Date, Description, Size (GB) Monday, Normal Activity, 11.0G Tuesday, attacks + Normal Activity, 11G Wednesday, attacks + Normal Activity, 13G Thursday, attacks + Normal Activity, 7.8G Friday, attacks + Normal Activity, 8.3G Victim and attacker networks information Firewall: 205.174.165.80, 172.16.0.1 DNS+ DC Server: 192.168.10.3 Outsiders (Attackers network) Kali: 205.174.165.73 Win: 205.174.165.69, 70, 71 Insiders (Victim network) Web server 16 Public: 192.168.10.50, 205.174.165.68 Ubuntu server 12 Public: 192.168.10.51, 205.174.165.66 Ubuntu 14.4, 32B: 192.168.10.19 Ubuntu 14.4, 64B: 192.168.10.17 Ubuntu 16.4, 32B: 192.168.10.16 Ubuntu 16.4, 64B: 192.168.10.12 Win 7 Pro, 64B: 192.168.10.9 Win 8.1, 64B: 192.168.10.5 Win Vista, 64B: 192.168.10.8 Win 10, pro 32B: 192.168.10.14 Win 10, 64B: 192.168.10.15 MAC: 192.168.10.25 Monday, July 3, 2017 Benign (Normal human activities) Tuesday, July 4, 2017 Brute Force FTP-Patator (9:20 – 10:20 a.m.) SSH-Patator (14:00 – 15:00 p.m.) Attacker: Kali, 205.174.165.73 Victim: WebServer Ubuntu, 205.174.165.68 (Local IP: 192.168.10.50) NAT Process on Firewall: Attack: 205.174.165.73 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.10 -> 192.168.10.50 Reply: 192.168.10.50 -> 172.16.0.1 -> 205.174.165.80 -> 205.174.165.73 Wednesday, July 5, 2017 DoS / DDoS DoS slowloris (9:47 – 10:10 a.m.) DoS Slowhttptest (10:14 – 10:35 a.m.) DoS Hulk (10:43 – 11 a.m.) DoS GoldenEye (11:10 – 11:23 a.m.) Attacker: Kali, 205.174.165.73 Victim: WebServer Ubuntu, 205.174.165.68 (Local IP192.168.10.50) NAT Process on Firewall: Attack: 205.174.165.73 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.10 -> 192.168.10.50 Reply: 192.168.10.50 -> 172.16.0.1 -> 205.174.165.80 -> 205.174.165.73 Heartbleed Port 444 (15:12 - 15:32) Attacker: Kali, 205.174.165.73 Victim: Ubuntu12, 205.174.165.66 (Local IP192.168.10.51) NAT Process on Firewall: Attack: 205.174.165.73 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.11 -> 192.168.10.51 Reply: 192.168.10.51 -> 172.16.0.1 -> 205.174.165.80 -> 205.174.165.73 Thursday, July 6, 2017 Morning Web Attack – Brute Force (9:20 – 10 a.m.) Web Attack – XSS (10:15 – 10:35 a.m.) Web Attack – Sql Injection (10:40 – 10:42 a.m.) Attacker: Kali, 205.174.165.73 Victim: WebServer Ubuntu, 205.174.165.68 (Local IP192.168.10.50) NAT Process on Firewall: Attack: 205.174.165.73 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.10 -> 192.168.10.50 Reply: 192.168.10.50 -> 172.16.0.1 -> 205.174.165.80 -> 205.174.165.73 Afternoon Infiltration – Dropbox download Meta exploit Win Vista (14:19 and 14:20-14:21 p.m.) and (14:33 -14:35) Attacker: Kali, 205.174.165.73 Victim: Windows Vista, 192.168.10.8 Infiltration – Cool disk – MAC (14:53 p.m. – 15:00 p.m.) Attacker: Kali, 205.174.165.73 Victim: MAC, 192.168.10.25 Infiltration – Dropbox download Win Vista (15:04 – 15:45 p.m.) First Step: Attacker: Kali, 205.174.165.73 Victim: Windows Vista, 192.168.10.8 Second Step (Portscan + Nmap): Attacker:Vista, 192.168.10.8 Victim: All other clients Friday, July 7, 2017 Morning Botnet ARES (10:02 a.m. – 11:02 a.m.) Attacker: Kali, 205.174.165.73 Victims: Win 10, 192.168.10.15 + Win 7, 192.168.10.9 + Win 10, 192.168.10.14 + Win 8, 192.168.10.5 + Vista, 192.168.10.8 Afternoon Port Scan: Firewall Rule on (13:55 – 13:57, 13:58 – 14:00, 14:01 – 14:04, 14:05 – 14:07, 14:08 - 14:10, 14:11 – 14:13, 14:14 – 14:16, 14:17 – 14:19, 14:20 – 14:21, 14:22 – 14:24, 14:33 – 14:33, 14:35 - 14:35) Firewall rules off (sS 14:51-14:53, sT 14:54-14:56, sF 14:57-14:59, sX 15:00-15:02, sN 15:03-15:05, sP 15:06-15:07, sV 15:08-15:10, sU 15:11-15:12, sO 15:13-15:15, sA 15:16-15:18, sW 15:19-15:21, sR 15:22-15:24, sL 15:25-15:25, sI 15:26-15:27, b 15:28-15:29) Attacker: Kali, 205.174.165.73 Victim: Ubuntu16, 205.174.165.68 (Local IP: 192.168.10.50) NAT Process on Firewall: Attacker: 205.174.165.73 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.1 Afternoon DDoS LOIT (15:56 – 16:16) Attackers: Three Win 8.1, 205.174.165.69 - 71 Victim: Ubuntu16, 205.174.165.68 (Local IP: 192.168.10.50) NAT Process on Firewall: Attackers: 205.174.165.69, 70, 71 -> 205.174.165.80 (IP Valid Firewall) -> 172.16.0.1 License The CICIDS2017 dataset consists of labeled network flows, including full packet payloads in pcap format, the corresponding profiles and the labeled flows (GeneratedLabelledFlows.zip) and CSV files for machine and deep learning purpose (MachineLearningCSV.zip) are publicly available for researchers. If you are using our dataset, you should cite our related paper which outlining the details of the dataset and its underlying principles: Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal, January 2018

The TON_IoT datasets are new generations of Internet of Things (IoT) and Industrial IoT (IIoT) datasets for evaluating the fidelity and efficiency of different cybersecurity applications based on Artificial Intelligence (AI). The datasets have been called ‘ToN_IoT’ as they include heterogeneous data sources collected from Telemetry datasets of IoT and IIoT sensors, Operating systems datasets of Windows 7 and 10 as well as Ubuntu 14 and 18 TLS and Network traffic datasets. The datasets were collected from a realistic and large-scale network designed at the IoT Lab of the UNSW Canberra Cyber, the School of Engineering and Information technology (SEIT), UNSW Canberra @ the Australian Defence Force Academy (ADFA). The datasets were gathered in a parallel processing to collect several normal and cyber-attack events from IoT networks. A new testbed was developed at the IoT lab to connect many virtual machine, physical systems, hacking platforms, cloud and fog platforms, IoT and IIoT sensors to mimic the complexity and scalability of industrial IoT and Industry 4.0 networks. Different hacking techniques, such as DoS, DDoS and ransomware against, were launched against web applications, IoT gateways and computer systems across the IIoT network.

ABSTRACT In this project, we propose a new comprehensive realistic cyber security dataset of IoT and IIoT applications, called Edge-IIoTset, which can be used by machine learning-based intrusion detection systems in two different modes, namely, centralized and federated learning. Specifically, the proposed testbed is organized into seven layers, including, Cloud Computing Layer, Network Functions Virtualization Layer, Blockchain Network Layer, Fog Computing Layer, Software-Defined Networking Layer, Edge Computing Layer, and IoT and IIoT Perception Layer. In each layer, we propose new emerging technologies that satisfy the key requirements of IoT and IIoT applications, such as, ThingsBoard IoT platform, OPNFV platform, Hyperledger Sawtooth, Digital twin, ONOS SDN controller, Mosquitto MQTT brokers, Modbus TCP/IP, ...etc. The IoT data are generated from various IoT devices (more than 10 types) such as Low-cost digital sensors for sensing temperature and humidity, Ultrasonic sensor, Water level detection sensor, pH Sensor Meter, Soil Moisture sensor, Heart Rate Sensor, Flame Sensor, ...etc.). However, we identify and analyze fourteen attacks related to IoT and IIoT connectivity protocols, which are categorized into five threats, including, DoS/DDoS attacks, Information gathering, Man in the middle attacks, Injection attacks, and Malware attacks. In addition, we extract features obtained from different sources, including alerts, system resources, logs, network traffic, and propose new 61 features with high correlations from 1176 found features. After processing and analyzing the proposed realistic cyber security dataset, we provide a primary exploratory data analysis and evaluate the performance of machine learning approaches (i.e., traditional machine learning as well as deep learning) in both centralized and federated learning modes. Instructions: Great news! The Edge-IIoT dataset has been featured as a "Document in the top 1% of Web of Science." This indicates that it is ranked within the top 1% of all publications indexed by the Web of Science (WoS) in terms of citations and impact. Please kindly visit kaggle link for the updates: https://www.kaggle.com/datasets/mohamedamineferrag/edgeiiotset-cyber-sec... Free use of the Edge-IIoTset dataset for academic research purposes is hereby granted in perpetuity. Use for commercial purposes is allowable after asking the leader author, Dr Mohamed Amine Ferrag, who has asserted his right under the Copyright. The details of the Edge-IIoT dataset were published in following the paper. For the academic/public use of these datasets, the authors have to cities the following paper: Mohamed Amine Ferrag, Othmane Friha, Djallel Hamouda, Leandros Maglaras, Helge Janicke, "Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning", IEEE Access, April 2022 (IF: 3.37), DOI: 10.1109/ACCESS.2022.3165809 Link to paper : https://ieeexplore.ieee.org/document/9751703 ******************************************** The directories of the Edge-IIoTset dataset include the following: •File 1 (Normal traffic) -File 1.1 (Distance): This file includes two documents, namely, Distance.csv and Distance.pcap. The IoT sensor (Ultrasonic sensor) is used to capture the IoT data. -File 1.2 (Flame_Sensor): This file includes two documents, namely, Flame_Sensor.csv and Flame_Sensor.pcap. The IoT sensor (Flame Sensor) is used to capture the IoT data. -File 1.3 (Heart_Rate): This file includes two documents, namely, Flame_Sensor.csv and Flame_Sensor.pcap. The IoT sensor (Flame Sensor) is used to capture the IoT data. -File 1.4 (IR_Receiver): This file includes two documents, namely, IR_Receiver.csv and IR_Receiver.pcap. The IoT sensor (IR (Infrared) Receiver Sensor) is used to capture the IoT data. -File 1.5 (Modbus): This file includes two documents, namely, Modbus.csv and Modbus.pcap. The IoT sensor (Modbus Sensor) is used to capture the IoT data. -File 1.6 (phValue): This file includes two documents, namely, phValue.csv and phValue.pcap. The IoT sensor (pH-sensor PH-4502C) is used to capture the IoT data. -File 1.7 (Soil_Moisture): This file includes two documents, namely, Soil_Moisture.csv and Soil_Moisture.pcap. The IoT sensor (Soil Moisture Sensor v1.2) is used to capture the IoT data. -File 1.8 (Sound_Sensor): This file includes two documents, namely, Sound_Sensor.csv and Sound_Sensor.pcap. The IoT sensor (LM393 Sound Detection Sensor) is used to capture the IoT data. -File 1.9 (Temperature_and_Humidity): This file includes two documents, namely, Temperature_and_Humidity.csv and Temperature_and_Humidity.pcap. The IoT sensor (DHT11 Sensor) is used to capture the IoT data. -File 1.10 (Water_Level): This file includes two documents, namely, Water_Level.csv and Water_Level.pcap. The IoT sensor (Water sensor) is used to capture the IoT data. •File 2 (Attack traffic): -File 2.1 (Attack traffic (CSV files)): This file includes 13 documents, namely, Backdoor_attack.csv, DDoS_HTTP_Flood_attack.csv, DDoS_ICMP_Flood_attack.csv, DDoS_TCP_SYN_Flood_attack.csv, DDoS_UDP_Flood_attack.csv, MITM_attack.csv, OS_Fingerprinting_attack.csv, Password_attack.csv, Port_Scanning_attack.csv, Ransomware_attack.csv, SQL_injection_attack.csv, Uploading_attack.csv, Vulnerability_scanner_attack.csv, XSS_attack.csv. Each document is specific for each attack. -File 2.2 (Attack traffic (PCAP files)): This file includes 13 documents, namely, Backdoor_attack.pcap, DDoS_HTTP_Flood_attack.pcap, DDoS_ICMP_Flood_attack.pcap, DDoS_TCP_SYN_Flood_attack.pcap, DDoS_UDP_Flood_attack.pcap, MITM_attack.pcap, OS_Fingerprinting_attack.pcap, Password_attack.pcap, Port_Scanning_attack.pcap, Ransomware_attack.pcap, SQL_injection_attack.pcap, Uploading_attack.pcap, Vulnerability_scanner_attack.pcap, XSS_attack.pcap. Each document is specific for each attack. •File 3 (Selected dataset for ML and DL): -File 3.1 (DNN-EdgeIIoT-dataset): This file contains a selected dataset for the use of evaluating deep learning-based intrusion detection systems. -File 3.2 (ML-EdgeIIoT-dataset): This file contains a selected dataset for the use of evaluating traditional machine learning-based intrusion detection systems. ******************************************** Step 1: Downloading The Edge-IIoTset dataset From the Kaggle platform from google.colab import files !pip install -q kaggle files.upload() !mkdir ~/.kaggle !cp kaggle.json ~/.kaggle/ !chmod 600 ~/.kaggle/kaggle.json !kaggle datasets download -d mohamedamineferrag/edgeiiotset-cyber-security-dataset-of-iot-iiot -f "Edge-IIoTset dataset/Selected dataset for ML and DL/DNN-EdgeIIoT-dataset.csv" !unzip DNN-EdgeIIoT-dataset.csv.zip !rm DNN-EdgeIIoT-dataset.csv.zip Step 2: Reading the Datasets' CSV file to a Pandas DataFrame: import pandas as pd import numpy as np df = pd.read_csv('DNN-EdgeIIoT-dataset.csv', low_memory=False) Step 3 : Exploring some of the DataFrame's contents: df.head(5) print(df['Attack_type'].value_counts()) Step 4: Dropping data (Columns, duplicated rows, NAN, Null..): from sklearn.utils import shuffle drop_columns = ["frame.time", "ip.src_host", "ip.dst_host", "arp.src.proto_ipv4","arp.dst.proto_ipv4", "http.file_data","http.request.full_uri","icmp.transmit_timestamp", "http.request.uri.query", "tcp.options","tcp.payload","tcp.srcport", "tcp.dstport", "udp.port", "mqtt.msg"] df.drop(drop_columns, axis=1, inplace=True) df.dropna(axis=0, how='any', inplace=True) df.drop_duplicates(subset=None, keep="first", inplace=True) df = shuffle(df) df.isna().sum() print(df['Attack_type'].value_counts()) Step 5: Categorical data encoding (Dummy Encoding): import numpy as np from sklearn.model_selection import train_test_split from sklearn.preprocessing import StandardScaler from sklearn import preprocessing def encode_text_dummy(df, name): dummies = pd.get_dummies(df[name]) for x in dummies.columns: dummy_name = f"{name}-{x}" df[dummy_name] = dummies[x] df.drop(name, axis=1, inplace=True) encode_text_dummy(df,'http.request.method') encode_text_dummy(df,'http.referer') encode_text_dummy(df,"http.request.version") encode_text_dummy(df,"dns.qry.name.len") encode_text_dummy(df,"mqtt.conack.flags") encode_text_dummy(df,"mqtt.protoname") encode_text_dummy(df,"mqtt.topic") Step 6: Creation of the preprocessed dataset df.to_csv('preprocessed_DNN.csv', encoding='utf-8') ******************************************** For more information about the dataset, please contact the lead author of this project, Dr Mohamed Amine Ferrag, on his email: mohamed.amine.ferrag@gmail.com More information about Dr. Mohamed Amine Ferrag is available at: https://www.linkedin.com/in/Mohamed-Amine-Ferrag https://dblp.uni-trier.de/pid/142/9937.html https://www.researchgate.net/profile/Mohamed_Amine_Ferrag https://scholar.google.fr/citations?user=IkPeqxMAAAAJ&hl=fr&oi=ao https://www.scopus.com/authid/detail.uri?authorId=56115001200 https://publons.com/researcher/1322865/mohamed-amine-ferrag/ https://orcid.org/0000-0002-0632-3172 Last Updated: 27 Mar. 2023

Kitsune Network Attack Dataset This is a collection of nine network attack datasets captured from a either an IP-based commercial surveillance system or a network full of IoT devices. Each dataset contains millions of network packets and diffrent cyber attack within it. For each attack, you are supplied with: * A preprocessed dataset in csv format (ready for machine learning) * The corresponding label vector in csv format * The original network capture in pcap format (in case you want to engineer your own features) We will now describe in detail what's in these datasets and how they were collected. ### The Network Attacks We have collected a wide variety of attacks which you would find in a real network intrusion. The following is a list of the cyber attack datasets avalaible: <img src="https://www.googleapis.com/download/storage/v1/b/kaggle-user-content/o/inbox%2F827271%2F79e305668553e521b0709a2413323c45%2Fkaggle_dataset_table.png?generation=1598461684070844&alt=media" alt="image" width="100"> For more details on the attacks themselves, please refer to our NDSS paper (citation below). The Data Collection The following figure presents the network topologies which we used to collect the data, and the corrisponding attack vectors at which the attacks were performed. The network capture took place at point 1 and point X at the router (where a network intrusion detection system could feasibly be placed). For each dataset, clean network traffic was captured for the first 1 million packets, then the cyber attack was performed. ### The Dataset Format Each preprocessed dataset csv has m rows (packets) and 115 columns (features) with no header. The 115 features were extracted using our AfterImage feature extractor, described in our NDSS paper (see below) and available in Python here. In summary, the 115 features provide a statistical snapshot of the network (hosts and behaviors) in the context of the current packet traversing the network. The AfterImage feature extractor is unique in that it can efficiently process millions of streams (network channels) in real-time, incrementally, making it suitable for handling network traffic. Citation If you use these datasets, please cite: @inproceedings{mirsky2018kitsune, title={Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection}, author={Mirsky, Yisroel and Doitshman, Tomer and Elovici, Yuval and Shabtai, Asaf}, booktitle={The Network and Distributed System Security Symposium (NDSS) 2018}, year={2018} }

1. DATASET We created various types of network attacks in Internet of Things (IoT) environment for academic purpose. Two typical smart home devices -- SKT NUGU (NU 100) and EZVIZ Wi-Fi Camera (C2C Mini O Plus 1080P) -- were used. All devices, including some laptops or smart phones, were connected to the same wireless network. The dataset consists of 42 raw network packet files (pcap) at different time points. * The packet files are captured by using monitor mode of wireless network adapter. The wireless headers are removed by Aircrack-ng. * All attacks except Mirai Botnet category are the packets captured while simulating attacks using tools such as Nmap. The case of Mirai Botnet category, the attack packets were generated on a laptop and then manipulated to make it appear as if it originated from the IoT device. Revision History * Three more packet files of Mirai Botnet -- Host Discovery and Telnet Bruteforce -- were added on September 20, 2019. ## 2. SUMMARY OF OUR DATASET ## 3. DOWNLOADS You can download our dataset from IEEE dataport page: https://ieee-dataport.org/open-access/iot-network-intrusion-dataset ## 4. CİTATİON Please cite our dataset's page when you use this dataset as follows. Hyunjae Kang, Dong Hyun Ahn, Gyung Min Lee, Jeong Do Yoo, Kyung Ho Park, and Huy Kang Kim, "IoT Network Intrusion Dataset.", http://ocslab.hksecurity.net/Datasets/iot-network-intrusion-dataset, 2019 or Hyunjae Kang, Dong Hyun Ahn, Gyung Min Lee, Jeong Do Yoo, Kyung Ho Park, and Huy Kang Kim, "IoT network intrusion dataset", IEEE Dataport, 2019. [Online]. Available: http://dx.doi.org/10.21227/q70p-q449. Accessed: Sep. 30, 2019. ## 5. CONTACT Hyunjae Kang (trifle19@korea.ac.kr) or Huy Kang Kim (cenda@korea.ac.kr) ## 6. SEE ALSO See also our another dataset containing IoT traffic: IoT-Environment-Dataset Please read [IoT-Environment-Dataset > 1.3 Comparison with IoT Network Intrusion Dataset] for more details. cenda at korea.ac.kr | 로봇융합관 304 | +82-2-3290-4898

This is the first image-based network intrusion detection dataset. This large-scale dataset included network traffic protocol communication-based images from 15 different observation locations of different countries in Asia. This dataset is used to identify two different types of anomalies from benign network traffic. Each image with a size of 48 × 48 contains multi-protocol communications within 128 seconds. The SIDD dataset can be to applied to a broad range of tasks such as machine learning-based network intrusion detection, non-iid federated learning, and so forth.

The dataset is annotated with stance towards one topic, namely, the independence of Catalonia. Source: Multilingual Stance Detection: The Catalonia Independence Corpus

CIC IoT Dataset 2022 This project aims to generate a state-of-the-art dataset for profiling, behavioural analysis, and vulnerability testing of different IoT devices with different protocols such as IEEE 802.11, Zigbee-based and Z-Wave. The following illustrates the main objectives of the CIC-IoT dataset project: - Configure various IoT devices and analyze the behaviour exhibited. - Conduct manual and semi-automated experiments of various categories. - Further analyze the network traffic when the devices are idle for three minutes and when powered on for the first two minutes. - Generating different scenarios and analyzing the devices' behaviour in different situations. - Conducting and capturing the network terrific of devices undercurrent and important attacks in IoT environment. Current CIC IoT dataset project and activities around it can be summarized in the following steps: ### Network configuration Our lab network configuration was configured with a 64-bit Window machine with two network interface cards - one is connected to the network gateway, and the other is connected to an unmanaged network switch. Simultaneously, Wireshark, the open-source network protocol analyzer, listens to both interfaces, captures and saves the output packet captured (pcap) files. Hence, IoT devices that require an Ethernet connection are connected to this switch. Additionally, a smart automation hub, Vera Plus is also connected to the unmanaged switch, which creates our wireless IoT environment to serve IoT devices compatible with Wi-Fi, ZigBee, Z-Wave and Bluetooth. ### Dataset For collecting the data, we captured the network traffic of the IoT devices coming through the gateway using Wireshark and dumpcap in six different types of experiments. The former was used for manual experiments, while the latter was used for semi-automated ones. All the experiments can be organized as follows: 1. Power: In this experiment, we powered on all the devices in our lab individually and started a network traffic capture in isolation. 1. Idle: In this experiment, we captured the whole network traffic from late in the evening to early in the morning, which we call idle time. In this period, the whole lab was completely evacuated and there were no human interactions involved. 1. Interactions: In this experiment, all possible functionality on IoT devices has been extracted and the corresponding network activity and transmitted packets for each functionality/activity have been captured. 1. Scenarios: In these experiments, we conducted six different types of scenario experiments using a combination of devices as simulations of the network activity inside a smart home. These experiments were done to see how devices behave while interacting with each other simultaneously. 1. Active: In addition to the idle time, the whole network communications were also captured throughout the day. All fellow researchers during this period were allowed to enter the lab whenever they wanted. They might interact with devices and generate network traffic either passively or actively. 1. Attacks: In this experiment, we performed two different attacks, Flood and RTSP- Brute Force, on some of our devices and captured their attack network traffic. ### Case study – device identification After generating the dataset, we performed a case study on the idea of transferability – training datasets in our lab and transferring the trained model to another lab for testing. We conducted 20 different experiments based on the number of sampled devices from the United States lab. Forty-eight features were extracted from both the training dataset from our lab and the testing dataset from the other lab. Three classes of device types were used in this experiment: Audio, Camera and Home Automation. However, no labels were required for the test dataset since that was what was to be predicted but the training dataset required labels. After training, the model is transferred to the other lab for testing on each device to predict the class of the device in question. For example, if Amazon Echo Dot is tested on the trained model, the classifier should be able to predict this device as belonging to device type Audio. How this works is by counting the prediction of the classifier based on the features for each device type. The device type with the highest count is predicted as the class for the device in question. ### Dataset directory The main dataset directory (CIC IoT Dataset) contains six subdirectories related to each experiment, namely: 1. Power: In this directory, you will find the power experiment packet captures for each device, categorized by different device classes. 1. Idle: In this directory, you will find idle experiment packet captures for 30 days, named and sorted by date. 1. Interactions: In this directory, you will find the interactions experiments packet captures for each device, categorized by different device classes. Each interaction includes three packet captures. 1. Scenarios: In this directory, you will find six sub-directories, each of which is related to one scenario. Each scenario includes three packet captures. 1. Active: In this directory, you will find active experiment packet captures for 30 days, named and sorted by date. 1. Attacks: In this directory, you will find two sub-directories, Flood and RTSP BruteForce, each for a specific attack performed on a few devices. The latter was performed using two different tools, Hydra and Nmap. Each attack includes three packet captures per device. ### Contributing The project is not currently in development, but any contribution is welcome. Please contact one of the authors of the paper. ### Acknowledgments The authors would like to thank the Canadian Institute for Cybersecurity for its financial and educational support. ### Citation Sajjad Dadkhah, Hassan Mahdikhani, Priscilla Kyei Danso, Alireza Zohourian, Kevin Anh Truong, Ali A. Ghorbani, "Towards the development of a realistic multidimensional IoT profiling dataset", Submitted to: The 19th Annual International Conference on Privacy, Security & Trust (PST2022) August 22-24, 2022, Fredericton, Canada.

IOT BENIGN AND ATTACK TRACES # Data Collected for ACM SOSR 2019 # Attack & Benign Data # Instructions Flow data contains flow counters of MUD flow, each instance in the file are collected every one minute. Annotations contains information about the start, end time of the attack and corresponsing MUD flows that are impacted through the Attack. More information about the device and the attacker can be found in here Below is an example of the annotations from the Samsung smart camera. eg: "1527838552,1527839153,Localfeatures|Arpfeatures,ArpSpoof100L2D" The above line indicates that the start time of the attack to be 1527838552 and end time is 1527839153. "Localfeatures|Arpfeatures" explains that it should impact the local communication and ARP protocol. "ArpSpoof100L2D" means that the attack was arpspoof lauched with the maximum rate of 100 packets per seconds. In order to identify the attack rows in flow stats you can use below condition. "if (flowtime >= startTime*1000 and endTime*1000>=flowtime) then attack = true" -- This corresponds to the line 4470 to 4479 in the samsung smart camera. # Cite our data A. Hamza, H. Habibi Gharakheili, T. Benson, V. Sivaraman, "Detecting Volumetric Attacks on IoT Devices via SDN-Based Monitoring of MUD Activity", ACM SOSR, San Jose, California, USA, Apr 2019. # Source code https://github.com/ayyoob/mud-ie # Contact ayyoobhamza@student.unsw.edu.au

This page contains ARINC 429 message data recorded from the hardware-in-a-loop simulator. These messages were recorded using a SIGLENT SDS2204X Plus oscilloscope sampling at 20 MHz. The intent of this data is to enable cybersecurity research and development for ARINC 429 by providing detailed message data from multiple hardware sources. The dataset consists of three csv files of ARINC 429 messages along with a data dictionary markdown file. The zip file is 550MB and each csv file is approximately 1.5GB. The csv filenames indicate which transmitter the messages were being sent from, with the EGPWS representing a “valid” transmitter while the RTX and AltaDT both represent adversarial transmitters.

ABSTRACT Recently, the technology of the fourth revolution has given the characteristics of things constantly expanding, and everything, including people, things, people, and the environment, is connected based on the Internet. In particular, the network structure is connected to various IoT devices and is changing from wired to wireless. Unlike users who operated each device, other devices can now be operated through gateways inside and outside the smart home. However, these changes have created an environment vulnerable to external attacks, and when an attacker accesses a gateway, he can attempt various attacks, including Port scans, OS&Service detection, and DoS attacks on IoT devices. Therefore, we disclose the dataset below to promote security research on IoT. ### 1. DATASET We provide IoT environment datasets which include Port Scan, OS & Service Detection, and HTTP Flooding Attack. After setting up the environment of IoT devices, we captured packets using Wireshark. #### 1.1 CONFIGURATION OF IoT ENVIRONMENT <img src="https://lh6.googleusercontent.com/42HRjprd2muU1GuwPx7vQkC_zsb7OFG1sJLjFLnStbK5n2FhehE5Ro1725rroKpEHUR3itxQvqhlWiF5nQSVCxZISN-vviVNRL7WdEVd5dHaK6IG=w1280" alt="drawing" width="1280"/> <p style="text-align: center;">Fig 1 - CONFIGURATION OF IoT ENVIRONMENT .</p> 192.168.10.1) Router 192.168.10.2) NUGU 192.168.10.3) EZVIZ home camera 192.168.10.4) Philips Hue 192.168.10.5) Google Home MINI 192.168.10.6) TP-Link home camera 192.168.10.7) Attacker's PC (HTTP Flooding Attack) 192.168.10.10) A cell phone 192.168.10.11) A cell phone 192.168.10.12) A cell phone 192.168.10.13) A cell phone 192.168.10.30) : Attacker's PC (OS & Service Detection Attack, Port Scan Attack) 121.53.216.31) : Daum Kakao Corp. 211.188.147.64) : SK Telecom Corp. #### 1.2 OVERVIEW OF DATASETS 1. Normal (All IoT) - Duration : about 34min - Number of attacks : None - Number of packets : 125,182 packets - Description : The traffic consists of various activities of all IoT devices (NUGU, EZVIZ, Hue, Google Home Mini, TP-Link). It mainly smart speakers (NUGU, Google Home Mini) answer to questions of play music, and home cameras (EZVIZ, TP-Link) stream images to a cell phone, and smart bulb (Hue) turn on/off or control the light color of bulbs. 2. Normal (Google Home Mini) - Duration : about 30min - Number of attacks : None - Number of packets : 14,400 packets - Description : The traffic consists of various activities of Google Home Mini. We asked various questions and request Google Home Mini and tried to manipulate the music function through cellphone. 3. Port Scan Attack - Attacker : PC (192.168.10.30) - Target : Google Home Mini (192.168.10.5) - Duration : about 21sec - Number of attacks : 2 times - Number of packets : 8,866 packets - Description : The attacker did port scanning by sending TCP packets with SYN flag on. 4. OS & Service Detection - Attacker : PC (192.168.10.30) - Target : Google Home Mini (192.168.10.5) - Duration : about 28min - Number of attacks : 4 times - Number of packets : 96,097 packets - Description : The attacker did OS & service detection by sending TCP packets with SYN flag on. Attack intensity could be varied. 5. HTTP Flooding Attack - Attacker : PC (192.168.10.7) - Target : Google Home Mini (192.168.10.5 : 8008) - Duration : about 6min - Number of attacks : Consistent - Number of packets : 1,126,070 packets - Description : The traffic consists of HTTP flooding packets using Flooding attack tool(LOIC) configured as 800 threads and highest speed, so the device (Google Home Mini) stuttered or disconnected from the phone application. #### 1.3 COMPARISON WITH IoT NETWORK INTRUSION DATASET This dataset has similarities with our other IoT dataset (IoT Network Intrusion Dataset), so we summarized the difference of two datasets as below. This dataset contains traffic of more various IoT devices: two security cameras, two AI speakers and a smart light hub as described in 1.1. Configuration of IoT Environment. IoT Network Intrusion Dataset only contains traffic of two IoT devices: SKT NUGU (NU 100) and EZVIZ Wi-Fi Camera (C2C Mini O Plus 1080P). There are less attack scenarios in this dataset; IoT Network Intrusion Dataset includes MITM, flooding attacks besides HTTP flooding, and telnet bruteforce, which are not in this dataset. Also, HTTP flooding attacks are in both datasets, but have different attackers and targets. In the case of this dataset, the attacker is the laptop and the target is the IoT device (Google Home Mini). In the case of IoT Network Intrusion Dataset, the attacker is the IoT device (assumed it is compromised by Mirai Botnet) and the target is a victim server. ### 2. DOWNLOADS For academic purposes, we are happy to release our datasets. If you want to use our dataset for your experiment, please cite our dataset’s page. 1. Normal (All IoT) 2. Normal (Google Home Mini) 3. Port Scan Attack 4. OS & Service Detection Attack 5. HTTP Flooding Attack If you want to download dataset, please fill out the questionnaire at the following URL. Dataset Download Link: Download ### 3. CONTACT Huy Kang Kim (cenda at korea.ac.kr) 4. SEE ALSO See also our another dataset containign IoT traffic: IoT Network Intrusion Dataset

A comprehensive dataset, merging all the aforementioned datasets. The newly published dataset represents the benefits of shared dataset feature sets, where the merging of multiple smaller ones is possible. This will eventually lead to a bigger and more universal NIDS datasets containing flows from multiple network setups and different attack settings. An additional label feature identifying the original dataset of each flow. This can be used to compare the same attack scenarios conducted over two or more different test-bed networks. The attack categories have been modified to combine all parent categories. Attacks named DoS attacks-Hulk, DoS attacks-SlowHTTPTest, DoS attacks-GoldenEye and DoS attacks-Slowloris have been renamed to the parent DoS category. Attacks named DDOS attack-LOIC-UDP, DDOS attack-HOIC and DDoS attacks-LOIC-HTTP have been renamed to DDoS. Attacks named FTP-BruteForce, SSH-Bruteforce, Brute Force -Web and Brute Force -XSS have been combined as a brute-force category. Finally, SQL Injection attacks have been included in the injection attacks category. The NF-UQ-NIDS dataset has a total of 11,994,893 records, out of which 9,208,048 (76.77%) are benign flows and 2,786,845 (23.23%) are attacks. The table below lists the distribution of the final attack categories.

A comprehensive dataset, merging all the aforementioned datasets. The newly published dataset represents the benefits of shared dataset feature sets, where the merging of multiple smaller ones is possible. This will eventually lead to a bigger and more universal NIDS datasets containing flows from multiple network setups and different attack settings. An additional label feature identifying the original dataset of each flow. This can be used to compare the same attack scenarios conducted over two or more different test-bed networks. The attack categories have been modified to combine all parent categories. Attacks named DoS attacks-Hulk, DoS attacks-SlowHTTPTest, DoS attacks-GoldenEye and DoS attacks-Slowloris have been renamed to the parent DoS category. Attacks named DDOS attack-LOIC-UDP, DDOS attack-HOIC and DDoS attacks-LOIC-HTTP have been renamed to DDoS. Attacks named FTP-BruteForce, SSH-Bruteforce, Brute Force -Web and Brute Force -XSS have been combined as a brute-force category. Finally, SQL Injection attacks have been included in the injection attacks category. The NF-UQ-NIDS dataset has a total of 11,994,893 records, out of which 9,208,048 (76.77%) are benign flows and 2,786,845 (23.23%) are attacks. The table below lists the distribution of the final attack categories.

CICFlowMeter format of the datasets are made up of 83 features.

WEB-IDS23 is a network intrusion detection dataset that includes over 12 million flows, categorizing 20 attack types across FTP, HTTP/S, SMTP, SSH, and network scanning activities. This dataset is documented in the paper "Technical Report: Generating the WEB-IDS23 Dataset," which provides insights into the generation, structure, and key characteristics of the dataset.