Dataset: Large-scale Urban IoT Activity Data for DDoS Attack Emulation

TL;DR

This paper introduces a large-scale urban IoT activity dataset with synthetic DDoS attack injections, enabling improved training and evaluation of machine learning models for IoT security.

Contribution

It provides a comprehensive urban IoT dataset with synthetic attack data and demonstrates its use in training neural networks for attack detection.

Findings

Dataset effectively captures IoT activity patterns.

Synthetic DDoS injection simulates realistic attack scenarios.

Neural network trained on dataset can identify attacked nodes.

Abstract

As IoT deployments grow in scale for applications such as smart cities, they face increasing cyber-security threats. In particular, as evidenced by the famous Mirai incident and other ongoing threats, large-scale IoT device networks are particularly susceptible to being hijacked and used as botnets to launch distributed denial of service (DDoS) attacks. Real large-scale datasets are needed to train and evaluate the use of machine learning algorithms such as deep neural networks to detect and defend against such DDoS attacks. We present a dataset from an urban IoT deployment of 4060 nodes describing their spatio-temporal activity under benign conditions. We also provide a synthetic DDoS attack generator that injects attack activity into the dataset based on tunable parameters such as number of nodes attacked and duration of attack. We discuss some of the features of the dataset. We also demonstrate the utility of the dataset as well as our synthetic DDoS attack generator by using them for the training and evaluation of a simple multi-label feed-forward neural network that aims to identify which nodes are under attack and when.