Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset

By Nickolaos Koroniotis, Nour Moustafa, Elena Sitnikova, Benjamin P. Turnbull. Future generations computer systems, 2018

1,683 citations recorded by the source corpus.

The proliferation of IoT systems, has seen them targeted by malicious third parties. To address this, realistic protection and investigation countermeasures need to be developed. Such countermeasures include network intrusion detection and network forensic systems. For that purpose, a well-structured and representative dataset is paramount for training and validating the credibility of the systems. Although there are several network, in most cases, not much information is given about the Botnet scenarios that were used. This paper, proposes a new dataset, Bot-IoT, which incorporates legitimate and simulated IoT network traffic, along with various types of attacks. We also present a realistic testbed environment for addressing the existing dataset drawbacks of capturing complete network information, accurate labeling, as well as recent and complex attack diversity. Finally, we evaluate the reliability of the BoT-IoT dataset using different statistical and machine learning methods for forensics purposes compared with the existing datasets. This work provides the baseline for allowing botnet identificaiton across IoT-specifc networks. The Bot-IoT dataset can be accessed at [1].

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c94d52a92b1da191f720cc4471d2f176e1d7ef0b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

E-GraphSAGE: A Graph Neural Network based Intrusion Detection System for IoT (2021, methodology): “The first three datasets, consisting of UNSW-NB15 [14], ToN-IoT [15] and BoT-IoT [16], have proprietary formats and feature sets, and have been widely used to evaluate Machine Learning based network intrusion”
Smart Anomaly Detection in Sensor Systems (2020, neutral): “The Bot-IoT dataset [29] contains a collection of normal and anomalous network traﬃc generated within a real IoT scenario at UNSW Canberra Cyber Lab.”
A Deep Blockchain Framework-Enabled Collaborative Intrusion Detection for Protecting IoT and Cloud Networks (2021, methodology): “The performance evaluation of the IDS was conducted on the UNSW-NB15, and BoT-IoT data sets, with the overall accuracy, demonstrated for various hidden nodes (HN = {10, 20, 30, 40, 50, 60}), as listed in Tables I and II, respectively.”
A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions (2020, methodology): “Moreover, applying the idea of profiling, which was used to produce these datasets, in real networks could be problematic due to their intrinsic complexity [209].”
NetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems (2020, background): “– BoT-IoT- The Cyber Range Lab of the Australian Centre for Cyber Security (ACCS) designed a realistic network environment that consists of normal and botnet traffic [7].”
Towards a Standard Feature Set for Network Intrusion Detection System Datasets (2021, methodology): “Four widely used NIDS datasets, referred to as UNSW-NB15 [7], BoT-IoT [8], ToN-IoT [9], and CIC-CSE-IDS2018 [10] have been converted into a common basic NetFlow-based feature set [11].”
Internet of Things (IoT) Security Intelligence: A Comprehensive Overview, Machine Learning Solutions and Research Directions (2022, background): “tal [19], Comodo [7], Contagio [8], DREBIN [74], Microsoft [16], Bot-IoT [71].”
Anomaly-based intrusion detection system for IoT networks through deep learning model (2022, positive): “We employed a BoT-IoT dataset [22] for experiments.”
CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment (2023, background): “BoT-Iot (2019) is introduced in [37] as a realistic traffic dataset, produced considering heterogeneous network profiles.”
InSDN: A Novel SDN Intrusion Dataset (2020, background): “However, applying the concept of profiling could be problematic due to their innate complexity [19].”
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study (2020, background): “The Bot-IoT dataset is proposed by Koroniotis et al. [123], which is new for the IoT environment compared to previous datasets.”