HITL-IoT: Human-in-the-Loop Intrusion Detection Dataset

Abstract: HITL-IoT is the first intrusion detection dataset for IoT environments that integrates human analyst decision metadata with traditional benign/attack labels. The dataset includes network traffic covering twelve IoT attack categories, complemented by 10,227 human-annotated samples produced by security analysts across three expertise levels (expert 80.5%, intermediate 14.4%, novice 5.1%). Each annotation includes the analyst's decision, confidence score (0-1 scale), decision latency, and justification text, enabling detailed study of human decision behavior, human-AI collaboration, and oversight mechanisms. The dataset provides 54 CICFlowMeter-style features per flow and covers 12 IoT device types, including cameras, thermostats, doorbells, and speakers. The dataset release includes baseline benchmarks for nine classical and deep learning models (best: XGBoost 99.59% accuracy, 1.67s training), together with preprocessing utilities and evaluation protocols to ensure reproducible experimentation. Human annotation performance ranges from expert (92.2% accuracy, ECE=0.152) to novice (76.9% accuracy, ECE=0.256), demonstrating the importance of expertise stratification in HITL systems. HITL-IoT enables research in human-centered intrusion detection, selective-deferral strategies, confidence calibration, and regulatory oversight analysis aligned with EU AI Act Article 14 requirements. All dataset files, metadata, baseline code, and documentation are openly available under CC BY 4.0 license to support transparent, extensible research in trustworthy, human-aligned IoT cybersecurity.

If you use this dataset, please cite:

1. The dataset (this Zenodo record)[Full citation detailsbibtex@dataset{Wakili2025hitliot_dataset,  author       = {Abubakar Wakili, Muhammad Idris, Sara Bakkali                   },  title        = {HITL-IoT: Human-in-the-Loop Intrusion Detection Dataset},  year         = 2025,  publisher    = {Zenodo},  doi          = {10.5281/zenodo.17862334},  url          = {https://doi.org/10.5281/zenodo.17862334}}

Keywords:human-in-the-loop, intrusion detection, IoT security, cybersecurity dataset, network traffic analysis, human-AI collaboration, confidence calibration, expert annotations, EU AI Act, trustworthy AI, anomaly detection, benchmark dataset