CADeSH Dataset: Collaborative Anomaly Detection for Smart Homes

<p>Dataset used for quantitative evaluation in the paper:</p> <p>Y. Meidan, D. Avraham, H. Libhaber and A. Shabtai, &quot;CADeSH: Collaborative Anomaly Detection for Smart Homes,&quot; in IEEE Internet of Things Journal, 2022, doi: 10.1109/JIOT.2022.3194813.</p> <p>&nbsp;</p> <p>This is a table of flow-level traffic data which was continuously captured during a period&nbsp;of 21 days from&nbsp;five real home networks which were subscribed to a smart home security service, and from our lab at Ben-Gurion University of The Negev.&nbsp;This security service provider shared with us these network traffic flows, plus the related DNS requests and responses, and reputation intelligence of the destination IP addresses.&nbsp;Each instance in this dataset represents an outbound network traffic flow (in the form of an IPFIX) which emanated from an instance of the IoT model&nbsp;streamer.Amazon.Fire_TV_Gen_3.</p> <p>In our lab, we infected our streamer.Amazon.Fire_TV_Gen_3 with a cryptominer and executed cryptomining from this device. To imitate a scanning activity typically performed by some botnets, we also scanned the network using Nmap.&nbsp;In accordance, we labeled these malicious activities as (1)&nbsp;`is executing cryptomining,&#39; or (2)&nbsp;`being scanned by Nmap.&#39; All of the remaining IPFIXs captured in our lab or on the home networks were labeled as `assumed benign&#39;.</p> <p>The multitude of real home networks, and the multitude of identical source devices, enable using this dataset for quantitative evaluation of (collaborative) anomaly/attack detection methods, especially for the IoT.</p>