IoT-deNAT: Outbound flow-based network traffic data of IoT and non-IoT devices behind a home NAT

This dataset is comprised of NetFlow records, which capture the outbound network traffic of 8 commercial IoT devices and 5 non-IoT devices, collected during a period of 37 days in a lab at Ben-Gurion University of The Negev. The dataset was collected in order to develop a method for telecommunication providers to detect vulnerable IoT models behind home NATs. Each NetFlow record is labeled with the device model which produced it; for research reproducibilty, each NetFlow is also allocated to either the "training" or "test" set, in accordance with the partitioning described in: Y. Meidan, V. Sachidananda, H. Peng, R. Sagron, Y. Elovici, and A. Shabtai, A novel approach for detecting vulnerable IoT devices connected behind a home NAT, Computers &amp; Security, Volume 97, 2020, 101968, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2020.101968. (http://www.sciencedirect.com/science/article/pii/S0167404820302418) Please note: The dataset itself is free to use, however users are requested to cite the above-mentioned paper, which describes in detail the research objectives as well as the data collection, preparation and analysis. Following is a brief description of the features used in this dataset. # NetFlow features, used in the related paper for analysis 'FIRST_SWITCHED': System uptime at which the first packet of this flow was switched<br> 'IN_BYTES': Incoming counter for the number of bytes associated with an IP Flow<br> 'IN_PKTS': Incoming counter for the number of packets associated with an IP Flow<br> 'IPV4_DST_ADDR': IPv4 destination address<br> 'L4_DST_PORT': TCP/UDP destination port number<br> 'L4_SRC_PORT': TCP/UDP source port number<br> 'LAST_SWITCHED': System uptime at which the last packet of this flow was switched<br> 'PROTOCOL': IP protocol byte (6: TCP, 17: UDP)<br> 'SRC_TOS': Type of Service byte setting when there is an incoming interface<br> 'TCP_FLAGS': Cumulative of all the TCP flags seen for this flow # Features added by the authors 'IP': Prefix of the destination IP address, representing the network (without the host)<br> 'DURATION': Time (seconds) between first/last packet switching # Label<br> 'device_model': &lt;type&gt;.&lt;manufacturer&gt;.&lt;model number&gt; # Partition<br> 'partition': Training or test # Additional NetFlow features (mostly zero-variance)<br> 'SRC_AS': Source BGP autonomous system number<br> 'DST_AS': Destination BGP autonomous system number<br> 'INPUT_SNMP': Input interface index<br> 'OUTPUT_SNMP': Output interface index<br> 'IPV4_SRC_ADDR': IPv4 source address<br> 'MAC': MAC address of the source # Additional data<br> 'category': IoT or non-IoT<br> 'type': IoT, access_point, smartphone, laptop<br> 'date': Datepart of FIRST_SWITCHED<br> 'inter_arrival_time': Time (seconds) between successive flows of the same device (identified by its MAC address)