MedBIoT: Generation of an IoT Botnet Dataset in a Medium-sized IoT Network

Guerra-Manzanares, Alejandro; Medina-Galindo, Jorge; Bahşi, Hayretdin; Nõmm, Sven

doi:10.5220/0009187802070218

Cited by 87 publications

(62 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition, the TON_IoT dataset includes a single TCP connection for all the nodes, hence making it particularly difficult to distinguish different nodes, for instance at transport layer. MedBIoT is another dataset related to IoT botnet focused on the detection of botnet attacks as Mirai, Yakuza and Torii [ 34 ] but in this dataset the authentication phase is not present. Another IoT dataset is BoT-IoT [ 35 ].…”

Section: Related Workmentioning

confidence: 99%

MQTTset, a New Dataset for Machine Learning Techniques on MQTT

Vaccari

Chiola

Aiello

et al. 2020

Sensors

170

View full text Add to dashboard Cite

IoT networks are increasingly popular nowadays to monitor critical environments of different nature, significantly increasing the amount of data exchanged. Due to the huge number of connected IoT devices, security of such networks and devices is therefore a critical issue. Detection systems assume a crucial role in the cyber-security field: based on innovative algorithms such as machine learning, they are able to identify or predict cyber-attacks, hence to protect the underlying system. Nevertheless, specific datasets are required to train detection models. In this work we present MQTTset, a dataset focused on the MQTT protocol, widely adopted in IoT networks. We present the creation of the dataset, also validating it through the definition of a hypothetical detection system, by combining the legitimate dataset with cyber-attacks against the MQTT network. Obtained results demonstrate how MQTTset can be used to train machine learning models to implement detection systems able to protect IoT contexts.

show abstract

Section: Related Workmentioning

confidence: 99%

MQTTset, a New Dataset for Machine Learning Techniques on MQTT

Vaccari

Chiola

Aiello

et al. 2020

Sensors

170

View full text Add to dashboard Cite

show abstract

“…For example, the effectiveness of the dataset put forward in [33] is impeded by highly imbalanced records because it has only 477 legitimate traffic samples and 3,668,045 attack traffic samples. Among these recent efforts, and for the purposes of this study, the MedBIoT [32] and Mirai-RGU [8] datasets were selected. These datasets have been selected for the following reasons:…”

Section: A Dataset Selectionmentioning

confidence: 99%

“…• There was a diversity of attacks that were launched. The MedBIoT dataset [32] is collected from a mediumsized network with 83 physical and virtual IoT devices, including switches, light bulbs, locks, and fans. Mirai [17], BashLite [15] and Torii [34] were used to initiate the malicious behavior of botnets.…”

Section: A Dataset Selectionmentioning

confidence: 99%

“…A random undersampling technique followed to minimize the number of samples and to introduce some kind of balancing for the imbalanced classes. For MedBIoT [32], we split the dataset into two halves, normal and attacks, and then divided the attack classes equally. For the Mirai-RGU [8], we followed the attack vectors distribution of Mirai published by [17] to reflect a more realistic situation.…”

Section: Dataset Samplingmentioning

confidence: 99%

“…4. MedBIoT Dataset[32] Classes After Undersampling. Mirai-RGU Dataset[8] Classes Before Undersampling.Fig.…”

mentioning

confidence: 99%

See 2 more Smart Citations

A Multi-Class Neural Network Model for Rapid Detection of IoT Botnet Attacks

Alzahrani¹

2020

IJACSA

View full text Add to dashboard Cite

The tremendous number of Internet of Things (IoT) devices and their widespread use have made our lives considerably more manageable and safer. At the same time, however, the vulnerability of these innovations means that our day-today existence is surrounded by insecure devices, thereby facilitating ways for cybercriminals to launch various attacks by large-scale robot networks (botnets) through IoT. In consideration of these issues, we propose a neural network-based model to detect IoT botnet attacks. Furthermore, the model provides multi-classification, which is necessary for taking appropriate countermeasures to understand and stop the attacks. In addition, it is independent and does not require specific equipment or software to fetch the required features. According to the conducted experiments, the proposed model is accurate and achieves 99.99%, 99.04% as F1 score for two benchmark datasets in addition to fulfilling IoT constraints regarding complexity and speed. It is less complicated in terms of computations, and it provides real-time detection that outperformed the state-of-theart, achieving a detection time ratio of 1:5 and a ratio of 1:8.

show abstract