DOI: 10.5281/zenodo.8116338
title: IoMT-TrafficData: A Dataset for Benchmarking Intrusion Detection in IoMT

description: Article Information

The work involved in developing the dataset and benchmarking its use of machine learning is set out in the article ‘IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things’. DOI: 10.1109/ACCESS.2024.3437214.

Please do cite the aforementioned article when using this dataset. 

Abstract

The increasing importance of securing the Internet of Medical Things (IoMT) due to its vulnerabilities to cyber-attacks highlights the need for an effective intrusion detection system (IDS). In this study, our main objective was to develop a Machine Learning Model for the IoMT to enhance the security of medical devices and protect patients’ private data. To address this issue, we built a scenario that utilised the Internet of Things (IoT) and IoMT devices to simulate real-world attacks. We collected and cleaned data, pre-processed it, and provided it into our machine-learning model to detect intrusions in the network. Our results revealed significant improvements in all performance metrics, indicating robustness and reproducibility in real-world scenarios. This research has implications in the context of IoMT and cybersecurity, as it helps mitigate vulnerabilities and lowers the number of breaches occurring with the rapid growth of IoMT devices. The use of machine learning algorithms for intrusion detection systems is essential, and our study provides valuable insights and a road map for future research and the deployment of such systems in live environments. By implementing our findings, we can contribute to a safer and more secure IoMT ecosystem, safeguarding patient privacy and ensuring the integrity of medical data.

ZIP Folder Content

The ZIP folder comprises two main components: Captures and Datasets. Within the captures folder, we have included all the captures used in this project. These captures are organized into separate folders corresponding to the type of network analysis: BLE or IP-Based. Similarly, the datasets folder follows a similar organizational approach. It contains datasets categorized by type: BLE, IP-Based Packet, and IP-Based Flows.

To cater to diverse analytical needs, the datasets are provided in two formats: CSV (Comma-Separated Values) and pickle. The CSV format facilitates seamless integration with various data analysis tools, while the pickle format preserves the intricate structures and relationships within the dataset.

This organization enables researchers to easily locate and utilize the specific captures and datasets they require, based on their preferred network analysis type or dataset type. The availability of different formats further enhances the flexibility and usability of the provided data.

Datasets' Content

Within this dataset, three sub-datasets are available, namely BLE, IP-Based Packet, and IP-Based Flows. Below is a table of the features selected for each dataset and consequently used in the evaluation model within the provided work.

Identified Key Features Within Bluetooth Dataset




Feature
Meaning


btle.advertising_header
BLE Advertising Packet Header


btle.advertising_header.ch_sel
BLE Advertising Channel Selection Algorithm


btle.advertising_header.length
BLE Advertising Length


btle.advertising_header.pdu_type
BLE Advertising PDU Type


btle.advertising_header.randomized_rx
BLE Advertising Rx Address


btle.advertising_header.randomized_tx
BLE Advertising Tx Address


btle.advertising_header.rfu.1
Reserved For Future 1


btle.advertising_header.rfu.2
Reserved For Future 2


btle.advertising_header.rfu.3
Reserved For Future 3


btle.advertising_header.rfu.4
Reserved For Future 4


btle.control.instant
Instant Value Within a BLE Control Packet


btle.crc.incorrect
Incorrect CRC


btle.extended_advertising
Advertiser Data Information


btle.extended_advertising.did
Advertiser Data Identifier


btle.extended_advertising.sid
Advertiser Set Identifier


btle.length
BLE Length


frame.cap_len
Frame Length Stored Into the Capture File


frame.interface_id
Interface ID


frame.len
Frame Length Wire


nordic_ble.board_id
Board ID


nordic_ble.channel
Channel Index


nordic_ble.crcok
Indicates if CRC is Correct


nordic_ble.flags
Flags


nordic_ble.packet_counter
Packet Counter


nordic_ble.packet_time
Packet time (start to end)


nordic_ble.phy
PHY


nordic_ble.protover
Protocol Version




 

Identified Key Features Within IP-Based Packets Dataset




Feature
Meaning


http.content_length
Length of content in an HTTP response


http.request
HTTP request being made


http.response.code
Sequential number of an HTTP response


http.response_number
Sequential number of an HTTP response


http.time
Time taken for an HTTP transaction


tcp.analysis.initial_rtt
Initial round-trip time for TCP connection


tcp.connection.fin
TCP connection termination with a FIN flag


tcp.connection.syn
TCP connection initiation with SYN flag


tcp.connection.synack
TCP connection establishment with SYN-ACK flags


tcp.flags.cwr
Congestion Window Reduced flag in TCP


tcp.flags.ecn
Explicit Congestion Notification flag in TCP


tcp.flags.fin
FIN flag in TCP


tcp.flags.ns
Nonce Sum flag in TCP


tcp.flags.res
Reserved flags in TCP


tcp.flags.syn
SYN flag in TCP


tcp.flags.urg
Urgent flag in TCP


tcp.urgent_pointer
Pointer to urgent data in TCP


ip.frag_offset
Fragment offset in IP packets


eth.dst.ig
Ethernet destination is in the internal network group


eth.src.ig
Ethernet source is in the internal network group


eth.src.lg
Ethernet source is in the local network group


eth.src_not_group
Ethernet source is not in any network group


arp.isannouncement
Indicates if an ARP message is an announcement




 

Identified Key Features Within IP-Based Flows Dataset




Feature
Meaning


proto
Transport layer protocol of the connection


service
Identification of an application protocol


orig_bytes
Originator payload bytes


resp_bytes
Responder payload bytes


history
Connection state history


orig_pkts
Originator sent packets


resp_pkts
Responder sent packets


flow_duration
Length of the flow in seconds


fwd_pkts_tot
Forward packets total


bwd_pkts_tot
Backward packets total


fwd_data_pkts_tot
Forward data packets total


bwd_data_pkts_tot
Backward data packets total


fwd_pkts_per_sec
Forward packets per second


bwd_pkts_per_sec
Backward packets per second


flow_pkts_per_sec
Flow packets per second


fwd_header_size
Forward header bytes


bwd_header_size
Backward header bytes


fwd_pkts_payload
Forward payload bytes


bwd_pkts_payload
Backward payload bytes


flow_pkts_payload
Flow payload bytes


fwd_iat
Forward inter-arrival time


bwd_iat
Backward inter-arrival time


flow_iat
Flow inter-arrival time


active
Flow active duration