IoT-Zoo Network Traffic

This dataset consists of 696,139 network packet samples extracted from the IoT-Zoo testbed. It represents a 600-second execution of a heterogeneous IoT environment, featuring 43 distinct device profiles spanning Urban Observatory, Industrial, e-Health, and Smart Farming domains. Technical Specifications The dataset is the result of a synchronized fusion between two network analysis engines (Scapy and Tshark), providing a high-dimensional view of each packet. Unlike flow-based datasets, this is a packet-level collection, where each row represents an individual network frame. Dataset Characteristics Total Samples: 696,139 packets. Total Features: 11 columns. Trace Duration: 600 seconds. Device Heterogeneity: Covers telemetry from multiple domains with preserved temporal dynamics. Application Semantics: Includes structured payloads (JSON/XML) replayed from real-world datasets. Column Definitions (Schema) pkt_index: Unique sequential identifier for each packet. time_epoch: High-precision Unix timestamp of arrival. frame_len: The total length of the Ethernet frame in bytes. ip_src / ip_dst: Source and Destination IPv4 addresses. ip_proto: Layer 3 protocol identifier (e.g., 6 for TCP). src_port / dst_port: Layer 4 source and destination ports (e.g., 1883 for MQTT). app_protocol: Application layer protocol identified via Tshark's deep packet inspection (e.g., MQTT, NTP, DNS, RTSP). tcp_flags_hex: Raw TCP flags in hexadecimal format (0x00000000), optimized for numerical Machine Learning input. tcp_flags_str: Human-readable TCP flag mnemonics (e.g., PA, S, A) extracted via Scapy. Intended Use This CSV is ready for downstream Machine Learning tasks such as: Anomaly Detection: Using frame_len and time_epoch (IAT) to identify volumetric or timing-based attacks. Protocol Classification: Leveraging app_protocol and tcp_flags_hex for identifying IoT-specific behaviors. Security Research: Serving as a baseline for legitimate IoT traffic patterns in heterogeneous environments.本数据集包含从IoT-Zoo测试床提取的696,139个网络数据包样本，对应异构物联网（IoT, Internet of Things）环境连续运行600秒的流量采集数据，涵盖城市观测、工业、电子医疗与智慧农业四大领域的43种不同设备配置文件。 ### 技术规范 本数据集由两款网络分析引擎（Scapy与Tshark）同步融合生成，可呈现每个数据包的高维特征。与基于流的数据集不同，本数据集属于数据包级采集集合，每一行对应一个独立的网络帧。 ### 数据集特征 - 总样本量：696,139个数据包 - 总特征数：11列 - 采集时长：600秒 - 设备异构性：覆盖多领域遥测数据，并保留了完整的时间动态特性 - 应用语义：包含从真实数据集复现的结构化负载（JSON/XML格式） ### 列定义（数据模式） 1. `pkt_index`：每个数据包的唯一连续标识符 2. `time_epoch`：数据包到达时的高精度Unix时间戳 3. `frame_len`：以太网帧的总字节长度 4. `ip_src / ip_dst`：源IPv4地址与目的IPv4地址 5. `ip_proto`：第三层协议标识符（例如6代表传输控制协议（TCP）） 6. `src_port / dst_port`：第四层源端口与目的端口（例如1883代表消息队列遥测传输（MQTT）） 7. `app_protocol`：通过Tshark深度包检测识别的应用层协议（例如MQTT、网络时间协议（NTP）、域名系统（DNS）、实时流传输协议（RTSP）） 8. `tcp_flags_hex`：十六进制格式的原始TCP标志位（如`0x00000000`），经优化适配数值型机器学习（Machine Learning）输入 9. `tcp_flags_str`：通过Scapy提取的可读TCP标志位助记符（例如PA、S、A） ### 预期应用场景 本CSV文件可直接用于以下下游机器学习任务： 1. **异常检测**：利用`frame_len`与`time_epoch`（即数据包到达间隔时间IAT）识别基于流量体量或时序特征的攻击 2. **协议分类**：借助`app_protocol`与`tcp_flags_hex`识别物联网专属行为模式 3. **安全研究**：作为异构环境中合法物联网流量模式的基准数据集