ToN IoT - The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion datasets

ToN IoT - The role of heterogeneity and the need for standardization of features and attack types in IoT network intrusion datasets

Booij, T.M.
Chiscop, I.
Meeuwissen, H.B.
Moustafa, N.
den Hartor, F.T.H.

2021

The Internet of Things (IoT) is reshaping our connected world due to the proliferation of the availability of small devices connected to the Internet and their communication technologies. Therefore, the study and research towards intrusion detection in the IoT domain has a lot of significance. Network intrusion datasets are fundamental for this research, as many detection strategies are based on these datasets. In this paper we introduce a new IoT dataset called ToN IoT and compare it to other novel datasets. This comparison not only shows the importance of heterogeneity within these datasets, but also why even the slightest differences between datasets can have huge impact on industry applications. In a cross-training experiment we show that the inclusion of different data collection methods and a large diversity of the monitored features is of crucial importance for IoT network intrusion datasets to be useful for the industry. We also explain that practical application of IoT datasets in operational environments requires the standardization of features descriptions and attack classes. This can only be achieved with a joint effort from the research community to start creating such standards.

http://resolver.tudelft.nl/uuid:ba3d3a1e-a3af-4965-9d45-387c8d25f79f

946468

2327-4662

IEEE Internet of Things Journal

article