Q-FedB-HIDS for IoT Networks

TON_IoT Dataset Description The TON_IoT dataset comprises a comprehensive collection of heterogeneous data sources designed to reflect realistic Internet of Things (IoT) and Industrial Internet of Things (IIoT) environments. It integrates telemetry data from IoT/IIoT sensors, operating system logs from Windows 7, Windows 10, Ubuntu 14, and Ubuntu 18, as well as Transport Layer Security (TLS) and network traffic data. The dataset was generated within a large-scale, realistic cyber range testbed developed at the Cyber Range and IoT Labs, School of Engineering and Information Technology (SEIT), UNSW Canberra at the Australian Defence Force Academy (ADFA). The testbed emulates an Industry 4.0 architecture comprising interconnected IoT, Edge/Fog, and Cloud layers. The infrastructure was deployed using multiple virtual machines and hosts running diverse operating systems, including Windows, Linux, and Kali Linux, to simulate real-world network interactions and system behaviors. This setup enabled the modeling of complex communication patterns across heterogeneous environments. A wide range of cyber-attack scenarios were executed within the testbed, including Denial of Service (DoS), Distributed Denial of Service (DDoS), and ransomware attacks targeting web applications, IoT gateways, and host systems. Data collection was performed in parallel across multiple sources, capturing both normal and malicious activities. The resulting dataset includes synchronized records from network traffic, Windows and Linux audit logs, and IoT telemetry streams, thereby providing a rich and diverse benchmark for developing and evaluating intrusion detection systems in IoT/IIoT environments. IoT-23 Dataset Description The IoT-23 dataset is a comprehensive collection of IoT network traffic designed for cybersecurity research, containing 23 scenarios with 20 malware captures and 3 benign traffic captures. Developed at the Stratosphere Laboratory, Czech Technical University, it includes data collected between 2018 and 2019 and published in 2020. Malicious scenarios involve executing malware samples on Raspberry Pi devices, simulating real attack behaviors across multiple protocols. Benign traffic was captured from real IoT devices, including a Philips Hue smart lamp, Amazon Echo, and Somfy smart lock. The dataset provides realistic, labeled traffic for developing and evaluating machine learning-based intrusion detection systems. UNSW-NB15 Dataset Description The UNSW-NB15 dataset was generated using the IXIA PerfectStorm tool in the Cyber Range Lab at UNSW Canberra to simulate modern normal and attack network behaviors. Raw network traffic (100 GB) was captured using tcpdump and processed with Argus and Bro-IDS to extract 49 features. The dataset includes nine attack categories: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms. It contains approximately 2.54 million records across multiple CSV files, with predefined training (175,341 records) and testing (82,332 records) sets, enabling effective evaluation of intrusion detection systems.