Energy Aware SmartHome Real-Life Testbed Dataset for Fault and Attack Classification in IoT-based CPS

## Overview | | ||---|---|| **File** | `SmartHome_RealLife_TB.csv` || **Total instances** | 788 || **Features** | 25 (+ 1 class label column) || **Source** | Real-time testbed — TCP packet capture via Wireshark | This dataset was collected from a real-time testbed implementation of an **Energy Aware Smart Home (EASH)** system, as described in: > G. Tertytchny, N. Nicolaou, and M. K. Michael, *"Classifying network abnormalities into faults and attacks in IoT-based cyber physical systems using machine learning"*, Preprint submitted to Elsevier. The dataset supports a supervised machine learning framework for **differentiating between component faults and network attacks** in IoT-based Cyber Physical Systems (CPS), based on communication channel characteristics extracted from TCP traffic. --- ## Testbed Setup The physical testbed comprised: | Component | Role ||---|---|| 3× Raspberry Pi 3 Model B+ | Peripheral nodes, each connected via Bluetooth to a Texas Instruments SensorTag CC2650 for humidity and temperature sensing || MacBook Pro | Central coordinator node, running Wireshark for packet sniffing || Ubuntu PC | Attacker machine used to launch Man-in-the-Middle (MITM) attacks via ARP spoofing (poisoning) | The network followed a **star topology**, with peripheral Raspberry Pi nodes transmitting sensor measurements as TCP packets to the central coordinator. Wireshark captured all traffic, and each packet was labelled according to the execution class active at the time of capture. --- ## Execution Classes The dataset contains instances from the following five classes: | Label | Class | Type | Description ||:-----:|---------------------------|:------:|-------------|| `N` | Normal | — | Peripheral nodes capture and transmit humidity/temperature measurements normally, with no faults or attacks present. || `F1` | Low Energy Failure | Fault | The peripheral node's communication is interrupted by cutting off its power supply, emulating a low-energy failure that prevents normal packet generation and transmission. || `F3` | Packet Dropped Failure | Fault | A threshold is applied to packet quality at generation time; packets exceeding the threshold are transmitted, others are dropped — emulating noise-induced packet corruption. || `A2` | Sink Hole Attack | Attack | MITM via ARP spoofing; the attacker intercepts all traffic from a peripheral node to the coordinator and drops it entirely (no retransmission). Affects availability. || `A3` | Message Modification Attack | Attack | MITM via ARP spoofing; the attacker intercepts and modifies packet payloads (sensor measurement values) before forwarding them to the coordinator. Affects integrity. | ### Class Distribution | Class | Instances ||------------------------------|----------:|| N — Normal | 486 || F1 — Low Energy Failure | 94 || F3 — Packet Dropped Failure | 81 || A2 — Sink Hole Attack | 78 || A3 — Message Modification | 49 || **Total** | **788** | --- ## Features All features are extracted from TCP packet headers captured by Wireshark and exported in JSON/CSV format. The original Wireshark field names are preserved in the column headers. | # | Column Name | Wireshark Field | Description ||:--:|-------------|-----------------|-------------|| 1 | `id` | — | Row identifier (integer index) || 2 | `frame.time_delta` | `frame.time_delta` | Time delta between current and previous captured frame (seconds) || 3 | `frame.time_delta_displayed` | `frame.time_delta_displayed` | Time delta between current and previous *displayed* frame (seconds) || 4 | `frame.time_relative` | `frame.time_relative` | Time elapsed since the first frame in the capture (seconds) || 5 | `frame.number` | `frame.number` | Sequential frame number within the capture || 6 | `frame.len` | `frame.len` | Total length of the frame on the wire (bytes) || 7 | `frame.cap_len` | `frame.cap_len` | Length of the frame as captured (bytes) || 8 | `ip.len` | `ip.len` | Total length of the IP datagram (bytes) || 9 | `tcp.srcport` | `tcp.srcport` | TCP source port number || 10 | `tcp.dstport` | `tcp.dstport` | TCP destination port number || 11 | `tcp.port` | `tcp.port` | Combined TCP port field (src or dst, used by Wireshark for display filtering) || 12 | `tcp.len` | `tcp.len` | TCP segment payload length (bytes) || 13 | `tcp.seq` | `tcp.seq` | TCP sequence number || 14 | `tcp.nxtseq` | `tcp.nxtseq` | Next expected TCP sequence number || 15 | `tcp.ack` | `tcp.ack` | TCP acknowledgement number || 16 | `tcp.hdr_len` | `tcp.hdr_len` | TCP header length (bytes) || 17 | `tcp.window_size_value` | `tcp.window_size_value` | Raw TCP receive window size value (before scaling) || 18 | `tcp.window_size` | `tcp.window_size` | Calculated TCP receive window size (after applying scale factor) || 19 | `tcp.options.timestamp.tsval` | `tcp.options.timestamp.tsval` | TCP Timestamp option — sender's timestamp value (TSval) || 20 | `tcp.options.timestamp.tsecr` | `tcp.options.timestamp.tsecr` | TCP Timestamp option — echo reply timestamp (TSecr) || 21 | `tcp.time_relative` *(stream)* | `tcp.time_relative` | Time since the first frame in the TCP stream (seconds) || 22 | `tcp.time_delta` *(stream)* | `tcp.time_delta` | Time since the previous frame in the TCP stream (seconds) || 23 | `tcp.analysis.ack_rtt` | `tcp.analysis.ack_rtt` | Round-trip time measured from data segment to its ACK (seconds) || 24 | `tcp.analysis.initial_rtt` | `tcp.analysis.initial_rtt` | Initial round-trip time estimated during TCP handshake (seconds) || 25 | `tcp.window_size_scalefactor` | `tcp.window_size_scalefactor` | TCP window scale factor (from the Window Scale option) || 26 | `class` | — | **Target label**: `N`, `F1`, `F3`, `A2`, or `A3` (see Execution Classes above) | > **Note on column names:** The full Wireshark JSON export paths (e.g. `_source/layers/tcp/tcp.srcport`) are preserved verbatim in the CSV header row. The shorthand names above are provided for readability. --- ## Citation If you use this dataset, please cite the associated paper: ```G. Tertytchny, N. Nicolaou, and M. K. Michael,"Classifying network abnormalities into faults and attacks in IoT-basedcyber physical systems using machine learning," Affiliation: Electrical and Computer Engineering Department,KIOS Research and Innovation Centre of Excellence, University of Cyprus.``` This work was funded by the European Union's Horizon 2020 research and innovation programmeunder grant agreement No. 739551 (KIOS CoE) and the Republic of Cyprus through theDirectorate General for European Programmes, Coordination and Development.