IoMT-TrafficData: A Dataset for Benchmarking Intrusion Detection in IoMT

DOI10.5281/zenodo.8116338Zenodo8116338MaRDI QIDQ6697612

Dataset published at Zenodo repository.

Author name not available (Why is that?)

Publication date: 5 July 2023

Copyright license: No records found.

Description

Article Information The work involved in developing the dataset and benchmarking its use of machine learning is set out in the article IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things. DOI: 10.1109/ACCESS.2024.3437214. Please do cite the aforementioned article when using this dataset. Abstract The increasing importance of securing the Internet of Medical Things (IoMT) due to its vulnerabilities to cyber-attacks highlights the need for an effective intrusion detection system (IDS). In this study, our main objective was to develop a Machine Learning Model for the IoMT to enhance the security of medical devices and protect patients private data. To address this issue, we built a scenario that utilised the Internet of Things (IoT) and IoMT devices to simulate real-world attacks. We collected and cleaned data, pre-processed it, and provided it into our machine-learning model to detect intrusions in the network. Our results revealed significant improvements in all performance metrics, indicating robustness and reproducibility in real-world scenarios. This research has implications in the context of IoMT and cybersecurity, as it helps mitigate vulnerabilities and lowers the number of breaches occurring with the rapid growth of IoMT devices. The use of machine learning algorithms for intrusion detection systems is essential, and our study provides valuable insights and a road map for future research and the deployment of such systems in live environments. By implementing our findings, we can contribute to a safer and more secure IoMT ecosystem, safeguarding patient privacy and ensuring the integrity of medical data. ZIP Folder Content The ZIP folder comprises two main components: Captures and Datasets. Within the captures folder, we have included all the captures used in this project. These captures are organized into separate folders corresponding to the type of network analysis: BLE or IP-Based. Similarly, the datasets folder follows a similar organizational approach. It contains datasets categorized by type: BLE, IP-Based Packet, and IP-Based Flows. To cater to diverse analytical needs, the datasets are provided in two formats: CSV (Comma-Separated Values) and pickle. The CSV format facilitates seamless integration with various data analysis tools, while the pickle format preserves the intricate structures and relationships within the dataset. This organization enables researchers to easily locate and utilize the specific captures and datasets they require, based on their preferred network analysis type or dataset type. The availability of different formats further enhances the flexibility and usability of the provided data. Datasets' Content Within this dataset, three sub-datasets are available, namely BLE, IP-Based Packet, and IP-Based Flows. Below is a table of the features selected for each dataset and consequently used in the evaluation model within the provided work. Identified Key Features Within Bluetooth Dataset Feature Meaning btle.advertising_header BLE Advertising Packet Header btle.advertising_header.ch_sel BLE Advertising Channel Selection Algorithm btle.advertising_header.length BLE Advertising Length btle.advertising_header.pdu_type BLE Advertising PDU Type btle.advertising_header.randomized_rx BLE Advertising Rx Address btle.advertising_header.randomized_tx BLE Advertising Tx Address btle.advertising_header.rfu.1 Reserved For Future 1 btle.advertising_header.rfu.2 Reserved For Future 2 btle.advertising_header.rfu.3 Reserved For Future 3 btle.advertising_header.rfu.4 Reserved For Future 4 btle.control.instant Instant Value Within a BLE Control Packet btle.crc.incorrect Incorrect CRC btle.extended_advertising Advertiser Data Information btle.extended_advertising.did Advertiser Data Identifier btle.extended_advertising.sid Advertiser Set Identifier btle.length BLE Length frame.cap_len Frame Length Stored Into the Capture File frame.interface_id Interface ID frame.len Frame Length Wire nordic_ble.board_id Board ID nordic_ble.channel Channel Index nordic_ble.crcok Indicates if CRC is Correct nordic_ble.flags Flags nordic_ble.packet_counter Packet Counter nordic_ble.packet_time Packet time (start to end) nordic_ble.phy PHY nordic_ble.protover Protocol Version Identified Key Features Within IP-Based Packets Dataset Feature Meaning http.content_length Length of content in an HTTP response http.request HTTP request being made http.response.code Sequential number of an HTTP response http.response_number Sequential number of an HTTP response http.time Time taken for an HTTP transaction tcp.analysis.initial_rtt Initial round-trip time for TCP connection tcp.connection.fin TCP connection termination with a FIN flag tcp.connection.syn TCP connection initiation with SYN flag tcp.connection.synack TCP connection establishment with SYN-ACK flags tcp.flags.cwr Congestion Window Reduced flag in TCP tcp.flags.ecn Explicit Congestion Notification flag in TCP tcp.flags.fin FIN flag in TCP tcp.flags.ns Nonce Sum flag in TCP tcp.flags.res Reserved flags in TCP tcp.flags.syn SYN flag in TCP tcp.flags.urg Urgent flag in TCP tcp.urgent_pointer Pointer to urgent data in TCP ip.frag_offset Fragment offset in IP packets eth.dst.ig Ethernet destination is in the internal network group eth.src.ig Ethernet source is in the internal network group eth.src.lg Ethernet source is in the local network group eth.src_not_group Ethernet source is not in any network group arp.isannouncement Indicates if an ARP message is an announcement Identified Key Features Within IP-Based Flows Dataset Feature Meaning proto Transport layer protocol of the connection service Identification of an application protocol orig_bytes Originator payload bytes resp_bytes Responder payload bytes history Connection state history orig_pkts Originator sent packets resp_pkts Responder sent packets flow_duration Length of the flow in seconds fwd_pkts_tot Forward packets total bwd_pkts_tot Backward packets total fwd_data_pkts_tot Forward data packets total bwd_data_pkts_tot Backward data packets total fwd_pkts_per_sec Forward packets per second bwd_pkts_per_sec Backward packets per second flow_pkts_per_sec Flow packets per second fwd_header_size Forward header bytes bwd_header_size Backward header bytes fwd_pkts_payload Forward payload bytes bwd_pkts_payload Backward payload bytes flow_pkts_payload Flow payload bytes fwd_iat Forward inter-arrival time bwd_iat Backward inter-arrival time flow_iat Flow inter-arrival time active Flow active duration

This page was built for dataset: IoMT-TrafficData: A Dataset for Benchmarking Intrusion Detection in IoMT