Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

This repository contains research data for evaluating network-traffic-based classification of Philips Hue smart-home actions. The dataset provides packet-level captures for repeated light on/off commands and labeled packet-burst features for Hue security-state commands. It is intended to support reproducible experiments on IoT traffic analysis, command inference, and device-behavior fingerprinting.

Short Description

Research dataset of Philips Hue smart-home network traces for IoT traffic analysis. The repository contains 10,000 labeled on/off PCAP captures and labeled packet-burst features for arm/disarm security-state commands.

Dataset Contents

Repository/
-- armstate_labeled.csv
-- Left_Spot_device_10ktrial.7z

On-Off

On-Off/Left_Spot_device_10ktrial.7z contains 10,000 PCAP files captured during repeated Philips Hue light-control actions for a smart-light device communicating with a Hue Bridge Pro. The archive contains 5,000 Turn_On captures and 5,000 Turn_Off captures. File names encode the trial number, timestamp, device label and action label.

Arm-Disarm

Arm-Disarm/armstate_labeled.csv contains 100 labeled packet-burst feature records for Hue security-state commands:

arm_home: 25 records

arm_away: 25 records

disarm: 50 records

The CSV uses the following columns:

label: command class label.

TO-lengths: ordered packet-length sequence for packets sent to the target device.

total-t: total burst duration in seconds.

IAT: mean inter-arrival time in seconds.

packet-amount: number of packets in the burst.

FAIR Data Statement

This dataset is structured to support the FAIR principles:

Findable: Files are organized by task (On-Off, Arm-Disarm) and named with explicit device/action labels.

Accessible: Data is provided in commonly supported formats: PCAP for packet captures, CSV for tabular features, and 7z for compressed distribution. Users can inspect the PCAP files with tools such as Wireshark, tshark, tcpdump, or Scapy.

Interoperable: Labels, timing features, packet counts, and packet-length sequences are represented using plain-text CSV fields. Packet captures use the standard PCAP format for compatibility with established network-analysis tools.

Reusable: The repository documents the dataset structure, labels, feature definitions, file naming scheme, license, and provisional citation guidance.

Suggested Citation

If you use this dataset, cite the accompanying paper and the archived dataset release. A final citation will be added once the publication metadata and persistent dataset identifier are available.

Until then, please cite this repository as:

Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

Temporary BibTeX entry:

@dataset{hue_research_data_2026,
title = {Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic},
author = {{Paul Mairinger et al.}},
year = {2026},
note = {Dataset repository. Final citation metadata to be added after publication.},
url = {TODO}
}

广域网流量轨迹：从加密智能家居流量中推断告警状态与用户行为

本仓库包含用于评估基于网络流量分类飞利浦Hue智能家居操作的研究数据。该数据集提供了重复执行灯光开/关命令的数据包级捕获文件，以及针对Hue安全状态命令的标记数据包突发特征集，旨在为物联网（IoT）流量分析、命令推断与设备行为指纹识别领域的可复现实验提供支撑。

## 简短描述
本研究数据集为面向物联网流量分析的飞利浦Hue智能家居网络轨迹数据集。本仓库包含10000条标记化的灯光开/关PCAP（Packet Capture）捕获文件，以及针对布防/撤防安全状态命令的标记数据包突发特征集。

## 数据集内容

Repository/
-- armstate_labeled.csv
-- Left_Spot_device_10ktrial.7z

### 开灯/关灯模块
On-Off/Left_Spot_device_10ktrial.7z 包含10000条PCAP捕获文件，源自某智能照明设备与Hue Pro桥接器（Hue Bridge Pro）通信过程中重复执行的飞利浦Hue灯光控制操作。该压缩包内含5000条开灯（Turn_On）捕获文件与5000条关灯（Turn_Off）捕获文件。文件名编码包含试验编号、时间戳、设备标签与操作标签信息。

### 布防/撤防模块
Arm-Disarm/armstate_labeled.csv 包含100条针对Hue安全状态命令的标记数据包突发特征记录，具体类别与分布如下：
- 家庭布防（arm_home）：25条记录
- 远程布防（arm_away）：25条记录
- 撤防（disarm）：50条记录

该CSV文件包含以下字段：
- label：命令类别标签
- TO-lengths：发送至目标设备的数据包长度有序序列
- total-t：数据包突发总时长，单位为秒
- IAT（Inter-Arrival Time）：平均包间到达时间，单位为秒
- packet-amount：突发数据包总数量

## FAIR数据声明
本数据集遵循FAIR数据原则：
1. **可发现性（Findable）**：文件按任务类别（开灯/关灯、布防/撤防）进行组织，文件名均包含明确的设备与操作标签。
2. **可访问性（Accessible）**：数据采用通用支持的格式存储：数据包捕获文件使用PCAP格式，表格特征文件使用CSV格式，压缩分发包使用7z格式。用户可通过Wireshark、tshark、tcpdump或Scapy等工具查看PCAP文件。
3. **可互操作性（Interoperable）**：标签、时序特征、数据包数量与数据包长度序列均采用纯文本CSV字段存储；数据包捕获文件采用标准PCAP格式，可兼容现有主流网络分析工具。
4. **可复用性（Reusable）**：本仓库详细记录了数据集结构、标签体系、特征定义、文件命名规则、许可协议以及临时引用指南。

## 推荐引用方式
若您使用本数据集，请引用配套学术论文与存档数据集版本。最终引用元数据与永久数据集标识符确定后，将补充完整引用信息。在此之前，请按以下方式引用本仓库：
> Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

### 临时BibTeX引用条目
bibtex
@dataset{hue_research_data_2026,
title = {Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic},
author = {{Paul Mairinger et al.}},
year = {2026},
note = {Dataset repository. Final citation metadata to be added after publication.},
url = {TODO}
}