IoT network intrusion dataset

Citation Author(s):
Hyunjae
Kang
Dong Hyun
Ahn
Gyung Min
Lee
Jeong Do
Yoo
Kyung Ho
Park
Huy Kang
Kim
Submitted by:
Huy Kang Kim
Last updated:
Fri, 09/27/2019 - 04:57
DOI:
10.21227/q70p-q449
Data Format:
Links:
License:
9890 Views
Categories:
Keywords:
0
0 ratings - Please login to submit your rating.

Abstract 

We created various types of network attacks in Internet of Things (IoT) environment for academic purpose. Two typical smart home devices -- SKT NUGU (NU 100) and EZVIZ Wi-Fi Camera (C2C Mini O Plus 1080P) -- were used. All devices, including some laptops or smart phones, were connected to the same wireless network. The dataset consists of 42 raw network packet files (pcap) at different time points.

* The packet files are captured by using monitor mode of wireless network adapter. The wireless headers are removed by Aircrack-ng.

* All attacks except Mirai Botnet category are the packets captured while simulating attacks using tools such as Nmap. The case of Mirai Botnet category, the attack packets were generated on a laptop and then manipulated to make it appear as if it originated from the IoT device.

Instructions: 

The dataset consists of 42 raw network packet files (pcap) at different time points.

* The packet files are captured by using monitor mode of wireless network adapter. The wireless headers are removed by Aircrack-ng.

* All attacks except Mirai Botnet category are the packets captured while simulating attacks using tools such as Nmap. The case of the Mirai Botnet category, the attack packets were generated on a laptop and then manipulated to make it appear as if it originated from the IoT device.

 

<packet file description>

benign-dec.pcap: benign-only traffic

mitm-arpspoofing-n(1~6)-dec.pcap: traffic containing benign and MITM(arp spoofing)

dos-synflooding-n(1~6)-dec.pcap: traffic containing benign and DoS(SYN flooding) attack

scan-hostport-n(1~6)-dec.pcap: traffic containing benign and Scan(host & port scan) attack

scan-portos-n(1~6)-dec.pcap: traffic containing benign and Scan(port & os scan) attack

mirai-udpflooding-n(1~4)-dec.pcap: traffic containing benign and 3 most typical attacks(UDP/ACK/HTTP Flooding) of zombie pc compromised by mirai malware

mirai-ackflooding-n(1~4)-dec.pcap

mirai-httpflooding-n(1~4)-dec.pcap

mirai-hostbruteforce-n(1~5)-dec.pcap: traffic containing benign and initial phase of Mirai malware including host discovery and Telnet brute-force attack