Index of /publicDatasets/IoT-23-Dataset-v2

Name	Last modified	Size

Parent Directory		-
CTU-Honeypot-Capture-4-1/	2024-01-21 12:22	-
CTU-Honeypot-Capture-5-1/	2022-11-25 12:09	-
CTU-Honeypot-Capture-7-1/	2022-11-25 12:10	-
CTU-Honeypot-Capture-7-2/	2024-01-21 15:13	-
CTU-Honeypot-Capture-7-3/	2024-01-21 15:14	-
CTU-Honeypot-Capture-7-4/	2024-01-21 15:15	-
CTU-Honeypot-Capture-7-5/	2024-01-21 15:16	-
CTU-Honeypot-Capture-7-6/	2024-01-21 15:16	-
CTU-IoT-Malware-Capture-1-1/	2024-01-21 15:25	-
CTU-IoT-Malware-Capture-3-1/	2023-01-09 18:30	-
CTU-IoT-Malware-Capture-7-1/	2024-01-21 17:23	-
CTU-IoT-Malware-Capture-8-1/	2024-01-21 17:25	-
CTU-IoT-Malware-Capture-9-1/	2024-01-21 21:30	-
CTU-IoT-Malware-Capture-17-1/	2022-11-25 12:14	-
CTU-IoT-Malware-Capture-20-1/	2022-11-25 15:05	-
CTU-IoT-Malware-Capture-21-1/	2022-11-25 15:06	-
CTU-IoT-Malware-Capture-33-1/	2022-11-25 15:07	-
CTU-IoT-Malware-Capture-34-1/	2022-11-25 15:14	-
CTU-IoT-Malware-Capture-35-1/	2022-11-25 15:14	-
CTU-IoT-Malware-Capture-36-1/	2022-11-25 15:20	-
CTU-IoT-Malware-Capture-39-1/	2022-11-25 15:22	-
CTU-IoT-Malware-Capture-42-1/	2022-11-25 15:49	-
CTU-IoT-Malware-Capture-43-1/	2022-11-25 15:50	-
CTU-IoT-Malware-Capture-44-1/	2022-11-25 15:56	-
CTU-IoT-Malware-Capture-48-1/	2022-11-25 15:56	-
CTU-IoT-Malware-Capture-49-1/	2022-11-25 15:58	-
CTU-IoT-Malware-Capture-52-1/	2022-11-25 15:59	-
CTU-IoT-Malware-Capture-60-1/	2022-11-25 16:06	-
README.html	2022-11-18 14:12	18K
README.md	2022-11-18 14:12	9.5K

IoT 23 v2: a labeled dataset with malicious and benign IoT network traffic

** please note this is a work in progress and the dataset version is not fully finished yet **

The IoT 23 is a dataset of malicious and benign network traffic from “Internet of Things” (IoT) devices. The goal of this dataset is to offer an extensive curated dataset of real labeled IoT traffic for machine learning network security research. The network traffic was captured in the Stratosphere Laboratory, AIC group, CTU University in Prague, Czech Republic. This dataset and its research were funded by Avast Software.

The IoT 23 dataset consists of 20 malware captures run in bare-metal IoT devices and 8 benign captures from real IoT devices. In the malware scenarios, the malware was allowed to connect to the Internet.

There are two versions of this dataset:

IoT 23 v1 was originally published in January 2020.
IoT 23 v2 - this version - is an improvement of the original dataset.

IoT 23 Version 2 Changelog

The IoT 23 dataset version 2 contains the raw capture files as version 1 with the following improvements:

Better dataset structure that is clearer and more intuitive
A homogeneous naming convention for all dataset files
An improved README for all dataset scenarios
Removed files not strictly related to the dataset
Removed infection timeline from readme as it was often incomplete and not accurate
Renamed Bro to Zeek everywhere to reflect the change in the tool’s name
Better and consistent dataset files permissions
Fixed broken headers on various pcap files in the dataset using the tool pcapfix
Fixed incorrect host IPs on READMEs
Fixed incorrect packet numbers on READMEs
Fixed incorrect packet capture size on READMEs
Fixed incorrect start date of the capture on READMEs
Fixed incorrect capture name on READMEs
Incorporated the device name used for each scenario in the READMEs
A separation of the original 3 benign captures into 8 since the original had several pcaps on each capture.
Better labels for each scenario with fewer errors and more reproducibility.

Description of files in each scenario

pcap: original raw network data packets in pcap format.
zeek-conn.log.labeled: raw flow data generated by the Zeek tool from the pcap file with expert labels.
labels.config: Rules used to label this capture.
README.md: Readme file

Labels

Security experts labeled this dataset manually by analyzing the traffic and creating labeling rules. The labeling program used is NetflowLabeler https://github.com/stratosphereips/netflowlabeler. The labels.config file contains the rules used to label this capture.

Contact

Contact our team for information about this dataset at mailto:stratosphere@aic.fel.cvut.cz.

Citation

For information on how to cite this dataset check our Stratosphere IoT-23 website.

IoT 23 v2 Summary

Name of Dataset	Capture Type	Device	Malware	Capture Start Date	Capture Host IP	Capture Gateway IP	Capture packets	Capture Size (GB)	Capture Duration (hrs)
CTU-IoT-Malware-Capture-1-1	Malware	Raspberry Pi	Hide and Seek	2018-05-09	192.168.100.103	192.168.100.1	1686291	0.140	111.90
CTU-IoT-Malware-Capture-3-1	Malware	Raspberry Pi	Muhstik	2018-05-19	192.168.2.5	192.168.2.1	496959	0.056	36.12
CTU-IoT-Malware-Capture-7-1	Malware	Raspberry Pi	Linux.Mirai	2018-07-20	192.168.100.108	192.168.100.1	11508430	0.897	24.00
CTU-IoT-Malware-Capture-8-1	Malware	Raspberry Pi	Hakai	2018-07-31	192.168.100.113	192.168.100.1	23623	0.002	24.00
CTU-IoT-Malware-Capture-9-1	Malware	Raspberry Pi	Linux.Hajime	2018-07-25	192.168.100.111	192.168.100.1	6437837	0.472	23.99
CTU-IoT-Malware-Capture-17-1	Malware	Raspberry Pi	Kenjiro	2018-09-06	192.168.100.111	192.168.100.1	109399825	7.800	24.00
CTU-IoT-Malware-Capture-20-1	Malware	Raspberry Pi	Torii	2018-10-02	192.168.100.103	192.168.100.1	50156	0.004	23.99
CTU-IoT-Malware-Capture-21-1	Malware	Raspberry Pi	Torii	2018-10-03	192.168.100.113	192.168.100.1	50277	0.004	24.00
CTU-IoT-Malware-Capture-33-1	Malware	Raspberry Pi	Kenjiro	2018-12-20	192.168.1.197	192.168.1.1	54492172	3.900	24.00
CTU-IoT-Malware-Capture-34-1	Malware	Raspberry Pi	Mirai	2018-12-21	192.168.1.195	192.168.1.1	233865	0.121	24.00
CTU-IoT-Malware-Capture-35-1	Malware	Raspberry Pi	Mirai	2018-12-21	192.168.1.196	192.168.1.1	46832850	3.600	24.00
CTU-IoT-Malware-Capture-36-1	Malware	Raspberry Pi	Okiru	2018-12-21	192.168.1.198	192.168.1.1	13670225	0.992	24.00
CTU-IoT-Malware-Capture-39-1	Malware	Raspberry Pi	IRCBot	2019-01-09	192.168.1.194	192.168.1.1	73679609	5.300	7.58
CTU-IoT-Malware-Capture-42-1	Malware	Raspberry Pi	Trojan	2019-01-10	192.168.1.197	192.168.1.1	24485	0.003	8.35
CTU-IoT-Malware-Capture-43-1	Malware	Raspberry Pi	Mirai	2019-01-10	192.168.1.198	192.168.1.1	82113060	6.000	1.09
CTU-IoT-Malware-Capture-44-1	Malware	Raspberry Pi	Mirai	2019-01-10	192.168.1.199	192.168.1.1	1309350	1.700	1.91
CTU-IoT-Malware-Capture-48-1	Malware	Raspberry Pi	Mirai	2019-02-28	192.168.1.200	192.168.1.1	13565553	1.200	9.77
CTU-IoT-Malware-Capture-49-1	Malware	Raspberry Pi	Mirai	2019-02-28	192.168.1.193	192.168.1.1	18111840	1.300	8.16
CTU-IoT-Malware-Capture-52-1	Malware	Raspberry Pi	Mirai	2019-03-08	192.168.1.197	192.168.1.1	64503852	4.600	24.00
CTU-IoT-Malware-Capture-60-1	Malware	Raspberry Pi	Gafgyt	2019-09-20	192.168.1.195	192.168.1.1	271150516	21.00	23.99
CTU-Honeypot-Capture-4-1	Benign	Philips hue Bridge	N/A	2018-10-25	192.168.1.132	192.168.1.1	21664	0.005	21.90
CTU-Honeypot-Capture-5-1	Benign	Amazon Echo Dot	N/A	2018-09-21	192.168.2.3	192.168.2.1	398312	0.381	5.49
CTU-Honeypot-Capture-7-1	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-03	192.168.1.158	192.168.1.1	11485156	0.897	23.99
CTU-Honeypot-Capture-7-2	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-03	192.168.1.158	192.168.1.1	119638	0.033	24.00
CTU-Honeypot-Capture-7-3	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-04	192.168.1.158	192.168.1.1	62850	0.017	12.31
CTU-Honeypot-Capture-7-4	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-05	192.168.1.158	192.168.1.1	121554	0.032	24.00
CTU-Honeypot-Capture-7-5	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-06	192.168.1.158	192.168.1.1	121566	0.033	24.00
CTU-Honeypot-Capture-7-6	Benign	Somfy Smart Door Lock And Gateway	N/A	2019-07-07	192.168.1.158	192.168.1.1	119158	0.032	24.00