** please note this is a work in progress and the dataset version is not fully finished yet **
The IoT 23 is a dataset of malicious and benign network traffic from “Internet of Things” (IoT) devices. The goal of this dataset is to offer an extensive curated dataset of real labeled IoT traffic for machine learning network security research. The network traffic was captured in the Stratosphere Laboratory, AIC group, CTU University in Prague, Czech Republic. This dataset and its research were funded by Avast Software.
The IoT 23 dataset consists of 20 malware captures run in bare-metal IoT devices and 8 benign captures from real IoT devices. In the malware scenarios, the malware was allowed to connect to the Internet.
There are two versions of this dataset:
The IoT 23 dataset version 2 contains the raw capture files as version 1 with the following improvements:
Security experts labeled this dataset manually by analyzing the traffic and creating labeling rules. The labeling program used is NetflowLabeler https://github.com/stratosphereips/netflowlabeler. The labels.config
file contains the rules used to label this capture.
Contact our team for information about this dataset at mailto:stratosphere@aic.fel.cvut.cz.
For information on how to cite this dataset check our Stratosphere IoT-23 website.
Name of Dataset | Capture Type | Device | Malware | Capture Start Date | Capture Host IP | Capture Gateway IP | Capture packets | Capture Size (GB) | Capture Duration (hrs) |
---|---|---|---|---|---|---|---|---|---|
CTU-IoT-Malware-Capture-1-1 | Malware | Raspberry Pi | Hide and Seek | 2018-05-09 | 192.168.100.103 | 192.168.100.1 | 1686291 | 0.140 | 111.90 |
CTU-IoT-Malware-Capture-3-1 | Malware | Raspberry Pi | Muhstik | 2018-05-19 | 192.168.2.5 | 192.168.2.1 | 496959 | 0.056 | 36.12 |
CTU-IoT-Malware-Capture-7-1 | Malware | Raspberry Pi | Linux.Mirai | 2018-07-20 | 192.168.100.108 | 192.168.100.1 | 11508430 | 0.897 | 24.00 |
CTU-IoT-Malware-Capture-8-1 | Malware | Raspberry Pi | Hakai | 2018-07-31 | 192.168.100.113 | 192.168.100.1 | 23623 | 0.002 | 24.00 |
CTU-IoT-Malware-Capture-9-1 | Malware | Raspberry Pi | Linux.Hajime | 2018-07-25 | 192.168.100.111 | 192.168.100.1 | 6437837 | 0.472 | 23.99 |
CTU-IoT-Malware-Capture-17-1 | Malware | Raspberry Pi | Kenjiro | 2018-09-06 | 192.168.100.111 | 192.168.100.1 | 109399825 | 7.800 | 24.00 |
CTU-IoT-Malware-Capture-20-1 | Malware | Raspberry Pi | Torii | 2018-10-02 | 192.168.100.103 | 192.168.100.1 | 50156 | 0.004 | 23.99 |
CTU-IoT-Malware-Capture-21-1 | Malware | Raspberry Pi | Torii | 2018-10-03 | 192.168.100.113 | 192.168.100.1 | 50277 | 0.004 | 24.00 |
CTU-IoT-Malware-Capture-33-1 | Malware | Raspberry Pi | Kenjiro | 2018-12-20 | 192.168.1.197 | 192.168.1.1 | 54492172 | 3.900 | 24.00 |
CTU-IoT-Malware-Capture-34-1 | Malware | Raspberry Pi | Mirai | 2018-12-21 | 192.168.1.195 | 192.168.1.1 | 233865 | 0.121 | 24.00 |
CTU-IoT-Malware-Capture-35-1 | Malware | Raspberry Pi | Mirai | 2018-12-21 | 192.168.1.196 | 192.168.1.1 | 46832850 | 3.600 | 24.00 |
CTU-IoT-Malware-Capture-36-1 | Malware | Raspberry Pi | Okiru | 2018-12-21 | 192.168.1.198 | 192.168.1.1 | 13670225 | 0.992 | 24.00 |
CTU-IoT-Malware-Capture-39-1 | Malware | Raspberry Pi | IRCBot | 2019-01-09 | 192.168.1.194 | 192.168.1.1 | 73679609 | 5.300 | 7.58 |
CTU-IoT-Malware-Capture-42-1 | Malware | Raspberry Pi | Trojan | 2019-01-10 | 192.168.1.197 | 192.168.1.1 | 24485 | 0.003 | 8.35 |
CTU-IoT-Malware-Capture-43-1 | Malware | Raspberry Pi | Mirai | 2019-01-10 | 192.168.1.198 | 192.168.1.1 | 82113060 | 6.000 | 1.09 |
CTU-IoT-Malware-Capture-44-1 | Malware | Raspberry Pi | Mirai | 2019-01-10 | 192.168.1.199 | 192.168.1.1 | 1309350 | 1.700 | 1.91 |
CTU-IoT-Malware-Capture-48-1 | Malware | Raspberry Pi | Mirai | 2019-02-28 | 192.168.1.200 | 192.168.1.1 | 13565553 | 1.200 | 9.77 |
CTU-IoT-Malware-Capture-49-1 | Malware | Raspberry Pi | Mirai | 2019-02-28 | 192.168.1.193 | 192.168.1.1 | 18111840 | 1.300 | 8.16 |
CTU-IoT-Malware-Capture-52-1 | Malware | Raspberry Pi | Mirai | 2019-03-08 | 192.168.1.197 | 192.168.1.1 | 64503852 | 4.600 | 24.00 |
CTU-IoT-Malware-Capture-60-1 | Malware | Raspberry Pi | Gafgyt | 2019-09-20 | 192.168.1.195 | 192.168.1.1 | 271150516 | 21.00 | 23.99 |
CTU-Honeypot-Capture-4-1 | Benign | Philips hue Bridge | N/A | 2018-10-25 | 192.168.1.132 | 192.168.1.1 | 21664 | 0.005 | 21.90 |
CTU-Honeypot-Capture-5-1 | Benign | Amazon Echo Dot | N/A | 2018-09-21 | 192.168.2.3 | 192.168.2.1 | 398312 | 0.381 | 5.49 |
CTU-Honeypot-Capture-7-1 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-03 | 192.168.1.158 | 192.168.1.1 | 11485156 | 0.897 | 23.99 |
CTU-Honeypot-Capture-7-2 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-03 | 192.168.1.158 | 192.168.1.1 | 119638 | 0.033 | 24.00 |
CTU-Honeypot-Capture-7-3 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-04 | 192.168.1.158 | 192.168.1.1 | 62850 | 0.017 | 12.31 |
CTU-Honeypot-Capture-7-4 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-05 | 192.168.1.158 | 192.168.1.1 | 121554 | 0.032 | 24.00 |
CTU-Honeypot-Capture-7-5 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-06 | 192.168.1.158 | 192.168.1.1 | 121566 | 0.033 | 24.00 |
CTU-Honeypot-Capture-7-6 | Benign | Somfy Smart Door Lock And Gateway | N/A | 2019-07-07 | 192.168.1.158 | 192.168.1.1 | 119158 | 0.032 | 24.00 |