TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems

Abdullah Alsaedi,Abdun Mahmood,Zahir Tari,Nour Moustafa,Adnan Anwar

doi:10.1109/access.2020.3022862

Abstract

Although the Internet of Things (IoT) can increase efficiency and productivity through intelligent and remote management, it also increases the risk of cyber-attacks. The potential threats to IoT applications and the need to reduce risk have recently become an interesting research topic. It is crucial that effective Intrusion Detection Systems (IDSs) tailored to IoT applications be developed. Such IDSs require an updated and representative IoT dataset for training and evaluation. However, there is a lack of benchmark IoT and IIoT datasets for assessing IDSs-enabled IoT systems. This paper addresses this issue and proposes a new data-driven IoT/IIoT dataset with the ground truth that incorporates a label feature indicating normal and attack classes, as well as a type feature indicating the sub-classes of attacks targeting IoT/IIoT applications for multi-classification problems. The proposed dataset, which is named TON_IoT, includes Telemetry data of IoT/IIoT services, as well as Operating Systems logs and Network traffic of IoT network, collected from a realistic representation of a medium-scale network at the Cyber Range and IoT Labs at the UNSW Canberra (Australia). This paper also describes the proposed dataset of the Telemetry data of IoT/IIoT services and their characteristics. TON_IoT has various advantages that are currently lacking in the state-of-the-art datasets: i) it has various normal and attack events for different IoT/IIoT services, and ii) it includes heterogeneous data sources. We evaluated the performance of several popular Machine Learning (ML) methods and a Deep Learning model in both binary and multi-class classification problems for intrusion detection purposes using the proposed Telemetry dataset.

Highlights

The Internet of Things (IoT) is an emerging paradigm that enables the interconnection of physical objects and computing capabilities to connect to the Internet
EXPERIMENTAL RESULTS This section discusses the performance of the candidates ML methods for intrusion detection purposes using the proposed Industrial IoT (IIoT) datasets
We will describe the experimental methodology applied to evaluate the performance of the selected ML methods using the proposed IIoT datasets

Summary

Introduction

The Internet of Things (IoT) is an emerging paradigm that enables the interconnection of physical objects and computing capabilities to connect to the Internet. The IoT can help to build flexible and efficient applications in various domains such as health care, environmental monitoring, and industrial control systems [1], [2]. IoT can increase productivity and efficiency through intelligent and remote management, it increases the risk of cyber attacks due. To a lack of security measures in the IoT ecosystem that exposes IoT devices to malicious attacks from both inside and outside of enterprise networks [3]. The potential threats to IoT applications and the need to reduce risks have recently become a hot topic in the cyber security area. Some IoT-based applications, commonly known as Industrial IoT (IIoT) in the Industry 4.0 revolution, involve mission-critical tasks such as industrial control and infrastructure systems which require a high level of security.

Objectives

Results

Conclusion