Internet-scale active NAT detections for IoT Devices

1.Decription: This dataset was generated by an experimental evalation of our research ( title: Detecting Internet-scale NATs for IoT Devices Based on Tri-net). Condersing the necessary of privacy protection and experimental reproduction, we randomly sampled one tenth of our total experimental resualts as this dataset. 2.Counts: The number of entries in this dataset is 864,461. Among which, each entry contains an entire NAT detection result labels of a online IoT device (details see label defination). 3.Label defination: The values of NAT label have three categories: 1 means NAT, -1 means non-NAT, 0 means unknown.N1: NAT pre-label of network layer;N2: NAT pre-label of transport layer;N3: NAT pre-laber of application layer;acknum: TCP acknowledgment number (an) of transport layer;banner: protocol banner is obtained (value as True) or not (value as False);deviceBrand: the brand of current IoT device;deviceCategory: the category of current IoT device (RSS and CSS means general router or switch device; VSS means monitor device; ICS means industrial device; OAS means printer device, unknown means other type of device);deviceModel: the model of current IoT device;deviceType: the detail type of current IoT device (such as IP camera, printer, firewall);icmp: ICMP type and code IDs of network layer;ip: public IP address of current IoT device;ipid: IP identification of network layer;port: port number of current IoT device;protocol: protocol type of current IoT device;sn: TCP sequence number (sn) of transport layer;ttl: Time to live (ttl) of network layer;ws: TCP window size (ws) of transport layer;other1: temporary label one (pseudo-Label);other2: temporary label two (pseudo-Label);label: final NAT detection result. 4.Data sources: The original public data was collected on Rapid7 website which contains the original values on network and transport layer, and the protocol banner of the IP and port on application layer.The brand, model and type was fingerprinted by our previous approach.The pre-labels were conducted based on the features of different dimensions on each layers, and these pre-labeled instances can be used as training dataset of Tri-net module. 5.Privacy protection and ethical statement: As our evalation has been implemented on Internet-scale online IoT devices, the public IP addresses are truly accessed on the Internet. Consequently, excepect of sampling one tenth of total results, we also processed the IP addresses for privacy protection. The last two numbers of the IP addresses were replaced as "*". For example, "192.168.101.102" was processed as "192.168.10*.10*". Even so, we still ethically claim that this dataset should only be used for research experiments. And we call upon all researchers not use the dataset for other motivations in duty. 6.Reusable value According to our test, the sampled dataset was still completely satisfy the demand of the realization experiment with both the performance experiment and the experiment to realize our approach based on Tri-net.1. 数据集说明：本数据集源自我们一项研究的实验评估（研究标题：基于Tri-net的物联网设备互联网级网络地址转换检测）。考虑到隐私保护与实验复现的需求，我们从全部实验结果中随机抽取十分之一作为本数据集。 2. 数据规模：本数据集共包含864,461条数据条目，每条条目对应一台在线物联网设备的完整网络地址转换（Network Address Translation, NAT）检测结果标签（标签定义详见下文）。 3. 标签定义：NAT标签共包含三类取值：1代表存在NAT，-1代表不存在NAT，0代表未知。 N1：网络层NAT预标签； N2：传输层NAT预标签； N3：应用层NAT预标签； acknum：传输层TCP（Transmission Control Protocol）确认号； banner：是否获取到协议标识（取值为True代表已获取，False代表未获取）； deviceBrand：当前物联网设备的品牌； deviceCategory：当前物联网设备的类别（RSS与CSS代表通用路由器或交换机设备；VSS代表监控设备；ICS代表工业设备；OAS代表打印机设备，unknown代表其他类型设备）； deviceModel：当前物联网设备的型号； deviceType：当前物联网设备的详细类型（如IP摄像头、打印机、防火墙）； icmp：网络层ICMP（Internet Control Message Protocol）类型与代码标识； ip：当前物联网设备的公网IP地址； ipid：网络层IP标识； port：当前物联网设备的端口号； protocol：当前物联网设备的协议类型； sn：传输层TCP（Transmission Control Protocol）序列号； ttl：网络层生存时间（Time to Live, TTL）； ws：传输层TCP（Transmission Control Protocol）窗口大小； other1：临时标签一（伪标签）； other2：临时标签二（伪标签）； label：最终NAT检测结果。 4. 数据来源：原始公开数据采集自Rapid7官网，包含网络层与传输层的原始数值，以及应用层对应IP与端口的协议标识。设备品牌、型号与类型通过我们此前的方法进行指纹识别得到。预标签基于各层不同维度的特征生成，这些带有预标签的样本可作为Tri-net模块的训练数据集。 5. 隐私保护与伦理声明：由于我们的评估基于互联网级别的在线物联网设备开展，所涉及的公网IP地址均为互联网上真实存在的访问地址。因此，除抽取十分之一的实验结果外，我们还对IP地址进行了隐私保护处理：将IP地址的最后两段数字替换为"*"。例如，将"192.168.101.102"处理为"192.168.10*.10*"。即便如此，我们仍从伦理层面声明，本数据集仅可用于科研实验，并呼吁所有研究者出于学术义务，勿将本数据集用于其他非科研目的。 6. 复用价值：经我们测试，该抽样数据集仍可完全满足两类实验的需求：一是性能验证实验，二是基于Tri-net的研究方法实现实验。