Dragon_Pi: IoT Side-Channel Power Data Intrusion Detection Dataset and Unsupervised Convolutional Autoencoder for Intrusion Detection

Dragon_Pi

For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name:

Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088 - specifically Section 3.2: Dataset Overview.

Dragon_Pi is an intrusion detection dataset for IoT devices. In the field of IoT security there are few datasets, and those which do exist tend to focus solely on network traffic. The Dragon_Pi dataset seeks to provide not only more data for the field of IoT security, but also, data of a somewhat under-published type: linear time series power consumption data.

Dragon_Pi is a fully labelled Intrusion Detection dataset for IoT devices. It is composed of both normal and under-attack power consumption data obtained from two separate testbeds - one using a DragonBoard 410c and the other a Raspberry Pi Model 3 - Hence the moniker Dragon_Pi. 

These testbeds were set up with predefined normal behavour as described in the attached publications. The normal linear time series power consumption  was sampled from the testbed under these normal conditions. Both testbeds were then attacked using some common attacks on IoT - the linear time series power consumption captured under these condtions as well. 

Specifically, the testbeds were subjected to the Port Scan (using Nmap), SSH Brute Force (using Hydra) and SYNFlood Denial of Service (using Hping3) attacks. These attacks were repeated to gain insight to what their signatures looked like and also how varying the tool settings effected the resultant signature.  A fourth type of scenario was also conducted on the testbeds - the "Capture the Flag" scenarios. In these files multiple attack types were used with a more specific target - to exfiltrate a hidden file from the testbeds.

Each file has three hierarchical levels of annotation for each sample within:

A simple "Normal or Anomaly" label for the specific sample

A specifc attack type label e.g. "SSH Bruteforce", for the specific sample

A specific tool setting for that attack e.g. "Hydra_T16", for the specific sample

Users can decide for themselves what level of annotation they require for their specific task. 

Each file in the Dragon_Pi dataset is accompanied by its own legend file. This file explains the contents of the specific .csv file and the specific indexes of the events within.

The Dragon_Pi dataset consists of approximately 67 files, as shown in Table 1. Compressed, the datset totals approximately 13GB. Completely decompressed the dataset is approximately 80GB ( 30GB Pi data, 50 GB Dragon data). 

Label Type
Specific Label 
Number of Files DragonBoard 410c
Number of Files Raspberry Pi

Normal 
Normal 
3 
2

Port Scan Attack 
Nmap_T5
2
1

Nmap_T4
1
1

Nmap_T3
1
1

Nmap_T2
1
1

SSH Brute Force
Hydra_T32
4
2

Hydra_T16
16
2

Hydra_T3
8
2

Hydra_T1
5
2

SYNFlood DOS
SYNFlood DOS
1
1

Capture the Flag
Misc Attacks
3
5

Table 1. Enumeration of the in the Dragon_Pi dataset.

For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name:

Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088 - specifically Section 3.2: Dataset Overview.

Publication of this dataset:

This dataset was published in Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088. Consult and cite this article for a more in depth dataset description, as well as an in depth review of first AI Intrusion Detection model trained on this dataset. 

See article Lightbody et al., Future Internet, 2023, https://doi.org/10.3390/fi15050187 for a detailed investigation on  the attack signatures discovered while creating this dataset. This work was an inital investigation of the dataset and can serve as a part 1 to the Dragon_Pi paper.

How to cite this dataset in your work: 

Please cite these two DOIs when publishing using this dataset:

Dragon_Pi release publication: https://doi.org/10.3390/fi16030088 (most important)

Zenodo Dataset DOI: https://doi.org/10.5281/zenodo.10784947