Generating Datasets for Anomaly-Based Intrusion Detection Systems in IoT and Industrial IoT Networks

Abstract

Over the past few years, we have witnessed the emergence of Internet of Things (IoT) and Industrial IoT networks that bring significant benefits to citizens, society, and industry. However, their heterogeneous and resource-constrained nature makes them vulnerable to a wide range of threats. Therefore, there is an urgent need for novel security mechanisms such as accurate and efficient anomaly-based intrusion detection systems (AIDSs) to be developed before these networks reach their full potential. Nevertheless, there is a lack of up-to-date, representative, and well-structured IoT/IIoT-specific datasets which are publicly available and constitute benchmark datasets for training and evaluating machine learning models used in AIDSs for IoT/IIoT networks. Contribution to filling this research gap is the main target of our recent research work and thus, we focus on the generation of new labelled IoT/IIoT-specific datasets by utilising the Cooja simulator. To the best of our knowledge, this is the first time that the Cooja simulator is used, in a systematic way, to generate comprehensive IoT/IIoT datasets. In this paper, we present the approach that we followed to generate an initial set of benign and malicious IoT/IIoT datasets. The generated IIoT-specific information was captured from the Contiki plugin “powertrace” and the Cooja tool “Radio messages”.

An Anomaly-Based Intrusion Detection System for Internet of Medical Things Networks

“…In this subsection, the following six existing datasets for the training and evaluation of IoT AIDSs are reviewed: (i) the LWSNDR dataset [26], (ii) the dataset presented in [27] for classifying IoT devices using network traffic characteristics, (iii) the "Bot-IoT" dataset [28], (iv) the dataset presented in [29] for detecting DoS attacks on IoT devices using network traffic traces, (v) the "TON_IoT Telemetry" dataset [15], which is the most recent and representative data-driven IoT/IIoT-based dataset [30], and (vi) the dataset generated as described in [7], which includes information related to the behavior of the IoT devices and the IoT network traffic based on a simulated benign scenario and a simulated malicious scenario. In this work, we utilized a part of the "TON_IoT Telemetry" dataset [15] and a part of the dataset generated as presented in [7] for the training and evaluation of the ML algorithms.…”

“…Therefore, more efforts are required toward datasets including information about the behavior of IoT devices when they function under normal operation conditions, as well as when they function under attack. To this direction, and to the best of our knowledge, a first step is the IoT device behavior datasets generated by the work in [7]. The IoT device behavior datasets include information related to the behavior of the IoT devices based on a simulated benign scenario and a simulated malicious scenario.…”

“…Nevertheless, the high resource requirements of complex and heavyweight conventional security mechanisms cannot be afforded by (a) the resource-constrained IoMT edge devices with limited processing power, storage capacity, and battery life, and/or (b) the constrained environment in which the IoMT edge devices are deployed and interconnected using lightweight communication protocols [7]. Therefore, it is clear that there is an urgent need for novel security mechanisms to address the pressing security challenges of IoMT networks in an effective and efficient manner, taking into consideration their inherent limitations due to their resource-constrained characteristics, before IoMT networks gain the trust of all involved stakeholders and reach their full potential in the healthcare market [5,[8][9][10][11][12].…”

“…However, so far, and to the best of our knowledge, there is only one related work on AIDSs for IoMT presented in [14], demonstrating the lack of proper works of AIDSs for IoMT networks. Therefore, our aim is to fill this significant research gap by developing a novel hybrid AIDS tailored to the resource-constrained characteristics of IoMT edge networks [7]. Thus, in this paper, we present the system architecture for a novel hybrid AIDS for IoMT networks, leveraging host-based and network-based techniques to reliably monitor and collect log files from the IoMT devices and the gateway, as well as traffic from the IoMT edge network, while simultaneously considering the computational cost.…”

“…The detection process of the proposed AIDS is to be implemented by the detection engine running on the gateway of the IoMT edge network and relying on machine learning (ML) techniques, considering the computation overhead, in order to detect abnormalities in the collected data and thus identify malicious incidents in the IoMT network. Besides that, in order to evaluate potential detection ML algorithms and identify the most appropriate ones, among the most popular ML algorithms (e.g., naïve Bayes, the decision tree (DT), random forest (RF) and k-nearest neighbor (KNN)), for the proposed AIDS, we used (i) the network part of the "TON_IoT Telemetry dataset" [15], as it is the most recent and representative datadriven IoT/IIoT-based dataset, and (ii) the dataset that was produced according to the approach of the authors in [7] and that includes information related to the behavior of the IoT devices that is not included in the "TON_IoT Telemetry dataset" [15], but is very critical for building effective ML-based detection models for AIDSs. We used these two datasets to evaluate potential detection ML algorithms because, to the best of our knowledge, there is no publicly available IoMT-specific dataset containing all of this useful information other than the above mentioned two datasets.…”