ibIDS - A dataset of real-world network communication and user physical contextual data

This is a novel dataset that integrates both synthetic attack traces and real-world benign behaviour. Specifically, the malicious data is sourced from the widely referenced CIC-AndMal2017 dataset, while the benign data (ibIDS) is collected through our in-situ data acquisition process using a real Android device. Here is the list of features and their descriptions: 1. Flow-based network features (in netflows.csv files) # Feature name Description 1 ip_v IP version (4: IPv4, 6: IPv6) 2 ip_proto Transport layer protocol (6: TCP, 17: UDP) 3 src_ip Source IP address 4 dst_ip Destination IP address 5 src_port Source Port number 6 dst_port Destination Port number 7 begin_time Beginning timestamp of the flow 8 end_time Ending timestamp of the flow 9 sent_bytes Total bytes from src to dst 10 rcvd_bytes Total bytes from dst to src 11 sent_pkts Total packets from src to dst 12 rcvd_pkts Total packets from dst to src 13 payload_length Total payload length 2. Physical features (in accelerometer.csv, light.csv, speed.csv files) Data name # Feature name Description Accelerometer 1 timestamp Timestamp of each record 2 acce_x x-axis value (m/s²) 3 acce_y y-axis value (m/s²) 4 acce_z z-axis value (m/s²) Ambient Light 1 timestamp Timestamp of each record 2 light Amount of ambient light (lux) Speed 1 timestamp Timestamp of each record 2 speed User's speed (m/s) 3. Context labels We define two user contexts (in context_label.csv files): c1: The user is actively using the smartphone (e.g., holding or interacting with the device) c2: The user is not using the smartphone (e.g., the device is stationary on a surface or stored in a pocket)