Dragon_Pi: IoT Side-Channel Power Data Intrusion Detection Dataset and Unsupervised Convolutional Autoencoder for Intrusion Detection

Dragon_Pi For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name: Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088 - specifically Section 3.2: Dataset Overview. Dragon_Pi is an intrusion detection dataset for IoT devices. In the field of IoT security there are few datasets, and those which do exist tend to focus solely on network traffic. The Dragon_Pi dataset seeks to provide not only more data for the field of IoT security, but also, data of a somewhat under-published type: linear time series power consumption data. Dragon_Pi is a fully labelled Intrusion Detection dataset for IoT devices. It is composed of both normal and under-attack power consumption data obtained from two separate testbeds - one using a DragonBoard 410c and the other a Raspberry Pi Model 3 - Hence the moniker Dragon_Pi. These testbeds were set up with predefined normal behavour as described in the attached publications. The normal linear time series power consumption was sampled from the testbed under these normal conditions. Both testbeds were then attacked using some common attacks on IoT - the linear time series power consumption captured under these condtions as well. Specifically, the testbeds were subjected to the Port Scan (using Nmap), SSH Brute Force (using Hydra) and SYNFlood Denial of Service (using Hping3) attacks. These attacks were repeated to gain insight to what their signatures looked like and also how varying the tool settings effected the resultant signature. A fourth type of scenario was also conducted on the testbeds - the "Capture the Flag" scenarios. In these files multiple attack types were used with a more specific target - to exfiltrate a hidden file from the testbeds. Each file has three hierarchical levels of annotation for each sample within: A simple "Normal or Anomaly" label for the specific sample A specifc attack type label e.g. "SSH Bruteforce", for the specific sample A specific tool setting for that attack e.g. "Hydra_T16", for the specific sample Users can decide for themselves what level of annotation they require for their specific task. Each file in the Dragon_Pi dataset is accompanied by its own legend file. This file explains the contents of the specific .csv file and the specific indexes of the events within. The Dragon_Pi dataset consists of approximately 67 files, as shown in Table 1. Compressed, the datset totals approximately 13GB. Completely decompressed the dataset is approximately 80GB ( 30GB Pi data, 50 GB Dragon data). Label Type Specific Label Number of Files DragonBoard 410c Number of Files Raspberry Pi Normal Normal 3 2 Port Scan Attack Nmap_T5 2 1 Nmap_T4 1 1 Nmap_T3 1 1 Nmap_T2 1 1 SSH Brute Force Hydra_T32 4 2 Hydra_T16 16 2 Hydra_T3 8 2 Hydra_T1 5 2 SYNFlood DOS SYNFlood DOS 1 1 Capture the Flag Misc Attacks 3 5 Table 1. Enumeration of the in the Dragon_Pi dataset. For a more in depth description of the Dragon_Pi dataset, please consult the journal article of the same name: Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088 - specifically Section 3.2: Dataset Overview. Publication of this dataset: This dataset was published in Lightbody et al., Future Internet, 2024, https://doi.org/10.3390/fi16030088. Consult and cite this article for a more in depth dataset description, as well as an in depth review of first AI Intrusion Detection model trained on this dataset. See article Lightbody et al., Future Internet, 2023, https://doi.org/10.3390/fi15050187 for a detailed investigation on the attack signatures discovered while creating this dataset. This work was an inital investigation of the dataset and can serve as a part 1 to the Dragon_Pi paper. How to cite this dataset in your work: Please cite these two DOIs when publishing using this dataset: Dragon_Pi release publication: https://doi.org/10.3390/fi16030088 (most important) Zenodo Dataset DOI: https://doi.org/10.5281/zenodo.10784947### Dragon_Pi 数据集说明 若需获取Dragon_Pi数据集的详细描述，请参阅同名期刊论文：Lightbody等人发表于《Future Internet》2024年的文章，链接为https://doi.org/10.3390/fi16030088，尤其关注其3.2节：数据集概览。 Dragon_Pi是一款面向物联网（IoT）设备的入侵检测数据集。当前物联网安全领域的公开数据集较为匮乏，且现有数据集大多仅聚焦于网络流量数据。Dragon_Pi数据集旨在为物联网安全领域补充更多可用数据，同时涵盖一类尚未被充分公开的数据源：线性时序功耗数据。 Dragon_Pi是一款全标注的物联网设备入侵检测数据集，其数据源自两个独立的测试平台：其一搭载DragonBoard 410c开发板，另一款则采用树莓派3代（Raspberry Pi Model 3），因此得名Dragon_Pi。数据集同时包含正常运行与受攻击状态下的功耗时序数据。 两个测试平台均预先配置了预设的正常运行行为（详见已发表文献），研究人员在此正常工况下采集了线性时序功耗数据。随后，研究人员针对两个测试平台实施了多种常见物联网攻击，并同步采集了攻击状态下的线性时序功耗数据。 具体而言，测试平台先后遭受了三类典型物联网攻击：端口扫描（使用Nmap工具）、SSH暴力破解（使用Hydra工具）以及SYN泛洪拒绝服务（SYNFlood DOS，使用Hping3工具）攻击。为深入分析各类攻击的特征签名，以及调整攻击工具参数对特征签名的影响，研究人员重复开展了多轮攻击实验。此外，测试平台还被用于第四类攻击场景："夺旗（Capture the Flag）"场景，该场景中会综合使用多种攻击手段，核心目标为从测试平台中窃取隐藏文件。 每个样本均包含三级分层标注： 1. 针对该样本的简易"Normal or Anomaly"二分类标签（即正常或异常）； 2. 针对该样本的具体攻击类型标签，例如"SSH Bruteforce"（SSH暴力破解）； 3. 针对该攻击的具体工具参数设置标签，例如"Hydra_T16"。 用户可根据自身任务需求，选择对应层级的标注开展研究。 Dragon_Pi数据集中的每个文件均配套有专属的说明文件，用于解释对应.csv文件的内容以及其中事件的具体索引位置。 Dragon_Pi数据集共包含约67个文件，详见表1。压缩状态下，数据集总容量约为13GB；完全解压后总容量约为80GB（其中树莓派平台数据约30GB，DragonBoard平台数据约50GB）。 --- 表1 Dragon_Pi数据集样本文件枚举 | 标签类别 | 具体标签 | DragonBoard 410c平台文件数 | Raspberry Pi平台文件数 | |------------------------|------------------------|---------------------------|-----------------------| | 正常工况 | 正常 | 3 | 2 | | 端口扫描攻击 | Nmap_T5 | 2 | 1 | | | Nmap_T4 | 1 | 1 | | | Nmap_T3 | 1 | 1 | | | Nmap_T2 | 1 | 1 | | SSH暴力破解攻击 | Hydra_T32 | 4 | 2 | | | Hydra_T16 | 16 | 2 | | | Hydra_T3 | 8 | 2 | | | Hydra_T1 | 5 | 2 | | SYN泛洪拒绝服务攻击 | SYNFlood DOS | 1 | 1 | | 夺旗场景攻击 | Misc Attacks（混合攻击）| 3 | 5 | --- 若需获取Dragon_Pi数据集的详细描述，请再次参阅同名期刊论文：Lightbody等人发表于《Future Internet》2024年的文章，链接为https://doi.org/10.3390/fi16030088，尤其关注其3.2节：数据集概览。 ### 数据集发表与引用说明 本数据集已正式发表于Lightbody等人的论文中，详见《Future Internet》2024年的文章，链接为https://doi.org/10.3390/fi16030088。如需获取更详细的数据集描述，以及基于本数据集训练的首款AI入侵检测模型的深度分析，请参阅该论文。 另有一篇2023年发表于《Future Internet》的论文（Lightbody等人，链接为https://doi.org/10.3390/fi15050187），该论文对本数据集构建过程中发现的攻击特征签名开展了详细研究，可视为Dragon_Pi系列论文的第一部分。 ### 数据集引用规范 若您的研究中使用了本数据集，请引用以下两个DOI： 1. Dragon_Pi数据集正式发表论文：https://doi.org/10.3390/fi16030088（最为重要） 2. Zenodo平台数据集存档DOI：https://doi.org/10.5281/zenodo.10784947