IoMT-TrafficData: A Dataset for Benchmarking Intrusion Detection in IoMT

Article Information

The work involved in developing the dataset and benchmarking its use of machine learning is set out in the article ‘IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things’. DOI: 10.1109/ACCESS.2024.3437214.

Please do cite the aforementioned article when using this dataset. 

Abstract

The increasing importance of securing the Internet of Medical Things (IoMT) due to its vulnerabilities to cyber-attacks highlights the need for an effective intrusion detection system (IDS). In this study, our main objective was to develop a Machine Learning Model for the IoMT to enhance the security of medical devices and protect patients’ private data. To address this issue, we built a scenario that utilised the Internet of Things (IoT) and IoMT devices to simulate real-world attacks. We collected and cleaned data, pre-processed it, and provided it into our machine-learning model to detect intrusions in the network. Our results revealed significant improvements in all performance metrics, indicating robustness and reproducibility in real-world scenarios. This research has implications in the context of IoMT and cybersecurity, as it helps mitigate vulnerabilities and lowers the number of breaches occurring with the rapid growth of IoMT devices. The use of machine learning algorithms for intrusion detection systems is essential, and our study provides valuable insights and a road map for future research and the deployment of such systems in live environments. By implementing our findings, we can contribute to a safer and more secure IoMT ecosystem, safeguarding patient privacy and ensuring the integrity of medical data.

ZIP Folder Content

The ZIP folder comprises two main components: Captures and Datasets. Within the captures folder, we have included all the captures used in this project. These captures are organized into separate folders corresponding to the type of network analysis: BLE or IP-Based. Similarly, the datasets folder follows a similar organizational approach. It contains datasets categorized by type: BLE, IP-Based Packet, and IP-Based Flows.

To cater to diverse analytical needs, the datasets are provided in two formats: CSV (Comma-Separated Values) and pickle. The CSV format facilitates seamless integration with various data analysis tools, while the pickle format preserves the intricate structures and relationships within the dataset.

This organization enables researchers to easily locate and utilize the specific captures and datasets they require, based on their preferred network analysis type or dataset type. The availability of different formats further enhances the flexibility and usability of the provided data.

Datasets' Content

Within this dataset, three sub-datasets are available, namely BLE, IP-Based Packet, and IP-Based Flows. Below is a table of the features selected for each dataset and consequently used in the evaluation model within the provided work.

Identified Key Features Within Bluetooth Dataset

Feature
Meaning

btle.advertising_header
BLE Advertising Packet Header

btle.advertising_header.ch_sel
BLE Advertising Channel Selection Algorithm

btle.advertising_header.length
BLE Advertising Length

btle.advertising_header.pdu_type
BLE Advertising PDU Type

btle.advertising_header.randomized_rx
BLE Advertising Rx Address

btle.advertising_header.randomized_tx
BLE Advertising Tx Address

btle.advertising_header.rfu.1
Reserved For Future 1

btle.advertising_header.rfu.2
Reserved For Future 2

btle.advertising_header.rfu.3
Reserved For Future 3

btle.advertising_header.rfu.4
Reserved For Future 4

btle.control.instant
Instant Value Within a BLE Control Packet

btle.crc.incorrect
Incorrect CRC

btle.extended_advertising
Advertiser Data Information

btle.extended_advertising.did
Advertiser Data Identifier

btle.extended_advertising.sid
Advertiser Set Identifier

btle.length
BLE Length

frame.cap_len
Frame Length Stored Into the Capture File

frame.interface_id
Interface ID

frame.len
Frame Length Wire

nordic_ble.board_id
Board ID

nordic_ble.channel
Channel Index

nordic_ble.crcok
Indicates if CRC is Correct

nordic_ble.flags
Flags

nordic_ble.packet_counter
Packet Counter

nordic_ble.packet_time
Packet time (start to end)

nordic_ble.phy
PHY

nordic_ble.protover
Protocol Version

Identified Key Features Within IP-Based Packets Dataset

Feature
Meaning

http.content_length
Length of content in an HTTP response

http.request
HTTP request being made

http.response.code
Sequential number of an HTTP response

http.response_number
Sequential number of an HTTP response

http.time
Time taken for an HTTP transaction

tcp.analysis.initial_rtt
Initial round-trip time for TCP connection

tcp.connection.fin
TCP connection termination with a FIN flag

tcp.connection.syn
TCP connection initiation with SYN flag

tcp.connection.synack
TCP connection establishment with SYN-ACK flags

tcp.flags.cwr
Congestion Window Reduced flag in TCP

tcp.flags.ecn
Explicit Congestion Notification flag in TCP

tcp.flags.fin
FIN flag in TCP

tcp.flags.ns
Nonce Sum flag in TCP

tcp.flags.res
Reserved flags in TCP

tcp.flags.syn
SYN flag in TCP

tcp.flags.urg
Urgent flag in TCP

tcp.urgent_pointer
Pointer to urgent data in TCP

ip.frag_offset
Fragment offset in IP packets

eth.dst.ig
Ethernet destination is in the internal network group

eth.src.ig
Ethernet source is in the internal network group

eth.src.lg
Ethernet source is in the local network group

eth.src_not_group
Ethernet source is not in any network group

arp.isannouncement
Indicates if an ARP message is an announcement

Identified Key Features Within IP-Based Flows Dataset

Feature
Meaning

proto
Transport layer protocol of the connection

service
Identification of an application protocol

orig_bytes
Originator payload bytes

resp_bytes
Responder payload bytes

history
Connection state history

orig_pkts
Originator sent packets

resp_pkts
Responder sent packets

flow_duration
Length of the flow in seconds

fwd_pkts_tot
Forward packets total

bwd_pkts_tot
Backward packets total

fwd_data_pkts_tot
Forward data packets total

bwd_data_pkts_tot
Backward data packets total

fwd_pkts_per_sec
Forward packets per second

bwd_pkts_per_sec
Backward packets per second

flow_pkts_per_sec
Flow packets per second

fwd_header_size
Forward header bytes

bwd_header_size
Backward header bytes

fwd_pkts_payload
Forward payload bytes

bwd_pkts_payload
Backward payload bytes

flow_pkts_payload
Flow payload bytes

fwd_iat
Forward inter-arrival time

bwd_iat
Backward inter-arrival time

flow_iat
Flow inter-arrival time

active
Flow active duration

### 文章信息
本数据集的构建及其机器学习应用基准测试相关工作，已发表于论文《IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things》。DOI: 10.1109/ACCESS.2024.3437214。
使用本数据集时，请引用上述论文。

### 摘要
由于医疗物联网（Internet of Medical Things, IoMT）易受网络攻击，其安全防护的重要性日益凸显，这凸显了构建高效入侵检测系统（Intrusion Detection System, IDS）的必要性。本研究的核心目标是为医疗物联网构建机器学习模型，以提升医疗设备的安全性，保护患者的隐私数据。
为解决该问题，我们搭建了基于物联网（Internet of Things, IoT）与医疗物联网设备的仿真场景，用以模拟真实网络攻击。我们完成了数据采集、清洗与预处理工作，并将处理后的数据输入机器学习模型以检测网络入侵行为。实验结果显示，所有性能指标均得到显著提升，证明本方法在真实场景下具备鲁棒性与可复现性。
本研究对医疗物联网与网络安全领域具有重要意义：随着医疗物联网设备的快速增长，本研究有助于缓解其安全漏洞，减少数据泄露事件的发生。将机器学习算法应用于入侵检测系统至关重要，本研究为未来相关领域的研究，以及在真实生产环境中部署此类系统提供了宝贵的参考思路与实施路线。通过落地本研究成果，我们可为构建更安全的医疗物联网生态系统贡献力量，切实保护患者隐私，保障医疗数据的完整性。

### 压缩包内容说明
本压缩包包含两大核心组件：捕获文件（Captures）与数据集（Datasets）。其中，捕获文件文件夹内收录了本项目所用的全部网络捕获数据，并按照网络分析类型分为蓝牙低功耗（Bluetooth Low Energy, BLE）与基于IP（IP-Based）两个子文件夹。数据集文件夹采用类似的组织方式，按数据类型划分为BLE、基于IP的数据包（IP-Based Packet）以及基于IP的数据流（IP-Based Flows）三类数据集。
为满足多样化的分析需求，本数据集提供两种存储格式：逗号分隔值（Comma-Separated Values, CSV）与pickle格式。其中，CSV格式可与各类数据分析工具无缝兼容，而pickle格式则能完整保留数据集内的复杂结构与数据关联关系。
这种组织方式可让研究人员根据自身偏好的网络分析类型或数据集类型，快速定位并使用所需的捕获文件与数据集。多种格式的提供进一步提升了本数据集的灵活性与可用性。

### 数据集内容说明
本数据集包含三个子数据集，分别为BLE、基于IP的数据包以及基于IP的数据流。下表列出了本研究中各数据集所选用的特征，这些特征同时用于后续的模型评估工作。

#### 蓝牙子数据集关键特征
| 特征 | 含义 |
| ---- | ---- |
| btle.advertising_header | BLE 广播数据包头 |
| btle.advertising_header.ch_sel | BLE 广播信道选择算法 |
| btle.advertising_header.length | BLE 广播数据包长度 |
| btle.advertising_header.pdu_type | BLE 广播PDU类型 |
| btle.advertising_header.randomized_rx | BLE 广播Rx地址 |
| btle.advertising_header.randomized_tx | BLE 广播Tx地址 |
| btle.advertising_header.rfu.1 | 预留字段1 |
| btle.advertising_header.rfu.2 | 预留字段2 |
| btle.advertising_header.rfu.3 | 预留字段3 |
| btle.advertising_header.rfu.4 | 预留字段4 |
| btle.control.instant | BLE控制包内的瞬时值 |
| btle.crc.incorrect | CRC校验错误 |
| btle.extended_advertising | 广播方数据信息 |
| btle.extended_advertising.did | 广播方数据标识符 |
| btle.extended_advertising.sid | 广播方集合标识符 |
| btle.length | BLE数据包长度 |
| frame.cap_len | 捕获文件中存储的帧长度 |
| frame.interface_id | 接口ID |
| frame.len | 线缆上的帧长度 |
| nordic_ble.board_id | 板卡ID |
| nordic_ble.channel | 信道索引 |
| nordic_ble.crcok | CRC校验正确性标识 |
| nordic_ble.flags | 标志位 |
| nordic_ble.packet_counter | 数据包计数器 |
| nordic_ble.packet_time | 数据包时长（起始至结束） |
| nordic_ble.phy | PHY层 |
| nordic_ble.protover | 协议版本 |

#### 基于IP的数据包子数据集关键特征
| 特征 | 含义 |
| ---- | ---- |
| http.content_length | HTTP响应内容长度 |
| http.request | 发起的HTTP请求 |
| http.response.code | HTTP响应序列号 |
| http.response_number | HTTP响应序列号 |
| http.time | HTTP事务耗时 |
| tcp.analysis.initial_rtt | TCP连接初始往返时间 |
| tcp.connection.fin | 带FIN标志的TCP连接终止请求 |
| tcp.connection.syn | 带SYN标志的TCP连接发起请求 |
| tcp.connection.synack | 带SYN-ACK标志的TCP连接建立响应 |
| tcp.flags.cwr | TCP拥塞窗口缩减标志 |
| tcp.flags.ecn | TCP显式拥塞通知标志 |
| tcp.flags.fin | TCP FIN标志 |
| tcp.flags.ns | TCP Nonce Sum标志 |
| tcp.flags.res | TCP预留标志位 |
| tcp.flags.syn | TCP SYN标志 |
| tcp.flags.urg | TCP紧急指针标志 |
| tcp.urgent_pointer | TCP紧急数据指针 |
| ip.frag_offset | IP数据包分片偏移量 |
| eth.dst.ig | 以太网目的地址属于内部网络组 |
| eth.src.ig | 以太网源地址属于内部网络组 |
| eth.src.lg | 以太网源地址属于本地网络组 |
| eth.src_not_group | 以太网源地址不属于任何网络组 |
| arp.isannouncement | 标识ARP报文是否为通告报文 |

#### 基于IP的数据流子数据集关键特征
| 特征 | 含义 |
| ---- | ---- |
| proto | 连接的传输层协议 |
| service | 应用协议标识 |
| orig_bytes | 发起方有效载荷字节数 |
| resp_bytes | 响应方有效载荷字节数 |
| history | 连接状态历史 |
| orig_pkts | 发起方发送数据包数 |
| resp_pkts | 响应方发送数据包数 |
| flow_duration | 流持续时长（秒） |
| fwd_pkts_tot | 正向数据包总数 |
| bwd_pkts_tot | 反向数据包总数 |
| fwd_data_pkts_tot | 正向数据数据包总数 |
| bwd_data_pkts_tot | 反向数据数据包总数 |
| fwd_pkts_per_sec | 每秒正向数据包数 |
| bwd_pkts_per_sec | 每秒反向数据包数 |
| flow_pkts_per_sec | 每秒流数据包数 |
| fwd_header_size | 正向头部字节数 |
| bwd_header_size | 反向头部字节数 |
| fwd_pkts_payload | 正向有效载荷字节数 |
| bwd_pkts_payload | 反向有效载荷字节数 |
| flow_pkts_payload | 流有效载荷字节数 |
| fwd_iat | 正向包间间隔时间 |
| bwd_iat | 反向包间间隔时间 |
| flow_iat | 流包间间隔时间 |
| active | 流活跃时长