## 5 Results
### Statistical Characterization of Network Traffic  
To strengthen the descriptive foundation of the dataset, we conducted a statistical analysis of the captured traffic. Over the course of approximately 54 h, the system recorded a total of 2326 network flows. The mean connection duration was 354.33 s, with a standard deviation of 2253.69 s. Notably, approximately 76.48% of the flows were unacknowledged (Zeek _conn_state = \(S0\)_), but that may have resulted not only from network loss or unreachable endpoints, but also from the inherent behavior of many IoT protocols that rely on UDP or transmit data without expecting responses. These include services such as CoAP, UDP, and DNS, where unidirectional exchanges are common and not indicative of an anomaly. These metrics provide a first view of the characteristics of the generated traffic, highlighting the heterogeneity of IoT communications in terms of payload size and session activity. To evaluate the overall activity of the experimental sessions, Figure 9 illustrates the network throughput measured over 15 min intervals, computed as the average number of bytes transmitted per second within each time window. The shaded area around the throughput represents the 95% confidence interval based on the standard deviation of each 15 min sample. This representation offers a granular view of the data transmission patterns across the experiments. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Filename** & **Description** & **Relevant Fields and Metadata** \\ \hline conn.log & Registers all network connections & Protocol, source/destination IPs and ports, connection state, duration, bytes sent/received \\ \hline dns.log & DNS queries and responses & Queried domain, query type, response codes, returned IP addresses, transaction ID, DNS class \\ \hline http.log & HTTP requests & HTTP method, URI, host, referrer, user-agent, status code, MIME type, request/response body size \\ \hline files.log & Transferred or detected files & File name, MIME type, SHA1/MD5/SHA256 hashes, source connection UID, total bytes \\ \hline ftp.log & FTP activity & FTP commands issued, responses received, usernames, file operations, command/response payload sizes \\ \hline ssl.log & TLS/SSL sessions & SSL version, cipher suite, server name (SNI), certificate chain UID, validation status \\ \hline smtp.log & SMTP activity & Mail from/to, message ID, subject, headers, delivery status, number of recipients \\ \hline ssh.log & SSH connections & Client and server banners, authentication method, success/failure, negotiated encryption algorithms \\ \hline dhcp.log & DHCP IP address assignments & Assigned IP address, MAC address, hostname, lease time, DHCP message type \\ \hline rdp.log & RDP connections & Client IP, screen resolution, keyboard layout, encryption level, connection result \\ \hline weird.log & Anomalous behaviors or unexpected errors & Event description, connection UID, source script, severity level \\ \hline packet\_filter.log & Filters applied when processing the trace & List of fields used in filter \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Main Zeek log file summary. The figure reveals clear traffic bursts corresponding to periods of active sensor communication, interleaved with quieter intervals. These fluctuations reflect the natural operation of the IoT devices under the various configurations. The use of 15 min intervals balanced temporal resolution with statistical stability, allowing the identification of trends and low-activity periods, without overemphasizing transient variations. To further characterize the network traffic generated in the laboratory, two aggregated analyses were conducted on the captured flows. First, the total payload size of each session, computed as the sum of origin and responder bytes, was evaluated to estimate the volume of information exchanged by the devices during each session.