Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset

Abstract

The proliferation of IoT systems, has seen them targeted by malicious third parties. To address this, realistic protection and investigation countermeasures need to be developed. Such countermeasures include network intrusion detection and network forensic systems. For that purpose, a well-structured and representative dataset is paramount for training and validating the credibility of the systems. Although there are several network, in most cases, not much information is given about the Botnet scenarios that were used. This paper, proposes a new dataset, Bot-IoT, which incorporates legitimate and simulated IoT network traffic, along with various types of attacks. We also present a realistic testbed environment for addressing the existing dataset drawbacks of capturing complete network information, accurate labeling, as well as recent and complex attack diversity. Finally, we evaluate the reliability of the BoT-IoT dataset using different statistical and machine learning methods for forensics purposes compared with the existing datasets. This work provides the baseline for allowing botnet identificaiton across IoT-specific networks. The Bot-IoT dataset can be accessed at [1].

Analyzing Adversarial Attacks against Deep Learning for Intrusion Detection in IoT Networks

“…Moustafa et al [8] in the original paper that described the IoT dataset that we used for our experiments implemented LSTM, SVM and RNN machine learning techniques to analyze the IoT dataset but they did not evaluate the adversarial robustness of their machine learning models in their study. Additionally, their study only carried out binary classification on the dataset and the prediction output of the machine learning models was classified as either attack or normal traffic.…”

“…For our dataset, we use the BoT-IoT dataset [8] provided from the Cyber Range Lab of The center of UNSW Canberra Cyber. This dataset provides a realistic representation of an IoT network since it was created in a dedicated IoT environment, and contains adequate number of records with heterogeneous network profiles.…”

“…A selection of the 10 best features have been provided in the original dataset and were also used for this study. [8].…”

Internet of Things Cyber Attacks Detection using Machine Learning

“…The studies provide evidence that machine learning techniques can achieve success for attack detection. From the works discussing the issue of using machine learning for IoT security, the detection methodologies can be categorized as unsupervised methods [10], [12], [13], [14] and supervised methods [15], [16], [17], [9], [18].…”

“…In this study, we contribute to the literature as part of a defense against IoT attack behavior by investigating the efficacy of using machine learning approaches to detect IoT network attacks. The detection algorithms are evaluated using a recent dataset, Bot-IoT, that combines legitimate and simulated IoT network traffic along with different types of attacks [9]. Using the Random Forest Regressor algorithm, features were selected from this dataset.…”