MQTT-IoT-IDS2020: MQTT Internet of Things Intrusion Detection Dataset

Message Queuing Telemetry Transport (MQTT) protocol is one of the most recent standards used in Internet of Things (IoT) machine to machine communication. The increase in the number of available IoT devices and used protocols reinforce the need for new and robust Intrusion Detection Systems (IDS). However, building IoT IDS requires the availability of datasets to process, train and evaluate these models. The dataset presented in this paper is the first to simulate and MQTT-based network. The dataset is generated using a simulated MQTT network architecture. The network comprises twelve sensors, a broker, a simulated camera, and an attacker. Five scenarios are recorded: (1) normal operation, (2) aggressive scan, (3) UDP scan, (4) Sparta SSH brute-force, and (5) MQTT brute-force attack. The raw pcap files are saved, then features are extracted. Three abstraction levels of features are extracted from the raw pcap files: (a) packet features, (b) Unidirectional flow features and (c) Bidirectional flow features. The csv feature files in the dataset are suited for Machine Learning (ML) usage. Also, the raw pcap files are suitable for the deeper analysis of MQTT IoT networks communication and the associated attacks.消息队列遥测传输（Message Queuing Telemetry Transport, MQTT）协议是当前物联网（Internet of Things, IoT）机器对机器通信领域应用最为广泛的标准之一。随着可用物联网设备数量与所使用协议的持续增长，对新型且鲁棒的入侵检测系统（Intrusion Detection Systems, IDS）的需求愈发凸显。然而，构建物联网入侵检测系统需要可供处理、训练与评估模型的数据集支撑。本文所提出的数据集是首个针对基于MQTT的网络进行仿真的数据集。该数据集基于仿真MQTT网络架构生成，该网络包含12个传感器、1台MQTT消息代理、1台仿真摄像头与1个攻击者节点。本次实验共记录了5类场景：(1) 正常运行工况；(2) 主动扫描攻击；(3) UDP扫描攻击；(4) Sparta SSH暴力破解攻击；(5) MQTT暴力破解攻击。研究人员首先保存原始pcap数据包文件，随后从中提取特征，共从原始pcap文件中提取了三类不同抽象层级的特征：(a) 报文特征；(b) 单向流特征；(c) 双向流特征。数据集中的CSV格式特征文件适配机器学习（Machine Learning, ML）模型的使用需求。此外，原始pcap文件可用于对MQTT物联网网络通信及其关联攻击开展深度分析。

搜集汇总

背景与挑战

背景概述

该数据集是首个专注于MQTT物联网协议的入侵检测数据集，模拟了包含正常操作和四种攻击类型（如暴力破解和扫描）的网络场景。它提供了原始数据包（pcap）和多层次特征（数据包、单向流、双向流）的CSV文件，专门设计用于机器学习模型的训练和评估，以支持物联网安全研究。