DOI: 10.26190/5d7ac9bfe8487
title: New Generations of Internet of Things Datasets for Cybersecurity Applications based Machine Learning: TON_IoT Datasets

description: Collecting and analysing heterogeneous data sources from the Internet of Things (IoT) and Industrial IoT (IIoT) are essential for training and validating the fidelity of cybersecurity applications-based machine learning. However, the analysis of those data sources is still a big challenge for reducing high dimensional space and selecting important features and observations from different data sources. The study proposes a new testbed for an IIoT network that was utilised for creating new datasets called TON_IoT that collected Telemetry data, Operating systems data and Network data. The testbed is deployed using multiple virtual machines including hosts of windows, Linux and Kali Linux operating systems to manage the interconnections between the three layers of IIoT, Cloud and Edge/Fog systems. The initial statistical evaluation of the datasets reveals their capability for evaluating cybersecurity applications such as intrusion detection, threat intelligence, adversarial machine learning and privacy-preserving models.
description: The research methodology includes three main phases: 1) extending the testbed of IoT network at the Cyber Range labs at UNSW Canberra; 2) collecting and filtering heterogeneous datasets; and 3)initial evaluation of datasets using statistical and deep learning models, as briefly explained below. 1) Extending the testbed of IoT network at the Cyber Range labs at UNSW Canberra In the Cyber Range Labs of UNSW Canberra, a testbed network for the industry 4.0 network that includes IoT and IIoT devices and services has been designed. The testbed will be extended to generate a new systematic testbed of IIoT networks for creating new realistic datasets, as presented in Figure 1. The testbed is deployed using multiple virtual machines and hosts of windows, Linux and Kali Linux operating systems to manage the interconnection between the three layers of IoT, Cloud and Edge/Fog systems. A set of IoT devices and sensors, such as green gas IoT and industrial IoT actuators, is connected to MQTT gateways to publish and subscribe to various topics, such as measuring temperature and humidity. 2) Collecting and analysing heterogeneous datasets From the designed testbed network, there are four heterogonous data sources collected from telemetry data of IoT systems, data of Windows and Linux Ubuntu systems and their network traffic. The datasets contain a wide range of new attack surfaces and vectors, as well as legitimate events. For analysing the datasets, existing and new tools are utilised to extract multiple features for evaluating the efficiency of the datasets for validating cyber applications and improving big data analytics tools. 3) Evaluation of datasets using statistical and deep learning models The datasets have diverse patterns and large-scale events to assess different cyber applications-based learning models such as intrusion detection, privacy-preserving, and digital forensics systems. Deep learning and statistical algorithms can be used for evaluating the new datasets compared with current benchmark network and IoT datasets.