# ZigBeeNet: Decrypted Zigbee IoT Network Traffic Dataset in Smart Home Environment
## 2 Related Work  
Zigbee technology, with its low power consumption and expandable network structure, is widely used in smart home systems for applications such as smart lighting control systems [8; 9; 10], smart thermostats, security systems [11], smart locks, energy management systems, smart home assistants [12], and automation [13]. Thus, large amounts of data often need to be collected and analyzed to understand network traffic in smart homes, ensure security, and ensure efficient operation of systems. We now briefly review the previous studies in the literature that required and used Zigbee datasets. First, we provide an example of using a decrypted Zigbee network traffic dataset. Ref. [6] presents two use cases of a Zigbee network traffic dataset. The first case involved using the data to identify the type of smart home device. The packets from the dataset were categorized, and features (e.g., packet length) were extracted for each category. These features were then fed into a machine-learning classification model. As a result, it was possible to detect the type of device (such as smart sockets or motion sensors) based on encrypted data. The second use case focused on identifying the device's status. In this case, the dataset needed to be decrypted and was used solely for training purposes. This allowed the classifier to accurately recognize the status transmitted by each device (e.g., motion detection). Such information can, in turn, be used for the analysis of users' daily behavior. In contrast to the above study, we aim to understand the network performance by decrypting the payload in the packets and extracting the characteristics of the traffic in order to develop a Zigbee traffic generator in the next stage. In addition, we would like to emphasize that our dataset can also be used in device status identification studies. Second, we present previous security research on the Zigbee protocol and devices. In the study in [14], traffic between multiple Zigbee sensors (door, motion sensor, etc.) devices was decrypted. The experiments investigated how attackers could interpret this traffic, and the data packets sent by the sensors were analyzed. In this way, it was revealed how attackers could monitor the building's security system and how they could exploit the security vulnerabilities of the Zigbee protocol, and the precautions that could be taken against these vulnerabilities were evaluated. In the study in [15], they experimented with using IoT light bulbs to demonstrate the security vulnerabilities of Zigbee devices. With the help of Wireshark, the network key was captured, and the communication between the Trust light bulb was decrypted using this key. The above studies focused on the security vulnerabilities of the Zigbee protocol and the security vulnerabilities of Zigbee devices. Although our network key extraction is very similar to study [14], our purposes for using the dataset are not similar. In contrast to the above studies, we aim to decrypt the packets in the traffic to obtain the payload and analyze the network traffic. Finally, we want to mention existing IoT network traffic datasets. The CIC IoT dataset [16] contains traffic from IoT devices connected in an LAN network. In contrast to our approach, this dataset is focused on packets transmitted between devices and the cloud solutions of individual manufacturers. Our solution, on the other hand, operates within the Zigbee network, capturing raw packets exchanged within the mesh network. However, comparing our dataset to other Zigbee datasets, we can distinguish three other examples. The Zigbee attack experimental dataset [17] consists of Zigbee packets from WIDS sensors during energy depletion attack experiments. CyLab Security and Privacy Institute supported this study. Four experiments were performed to test against an energy exhaustion attack launched by ATUSB using four Zigbee devices with CR2450 lithium batteries. Zigbee packets were captured between 29 April 2021 and 2 May 2021 for three days.