# Trustworthy AI and Federated Learning for Intrusion Detection in 6G-Connected Smart Buildings
## 5 Network and IoT Datasets for Smart Buildings
### ToN-IoT  
The ToN-IoT dataset provides data from three heterogeneous domains: telemetry, Operating System (OS), and network domains. IoT sensors are responsible for gathering and transmitting telemetry data. The other kinds of data are obtained from OS logs and by measuring network traffic. The primary innovation of this dataset is its integration of three distinct data sources to comprehensively document the intricate progression of cyber attacks, from their initial stages to their ultimate consequences. The testbed includes a full architecture consisting of cloud services, a fog layer, and an edge layer where simulated IoT devices are located. The report shows that attacks are carried out using complete systems (Kali machines), and for each type of attack, the used tool is reported [42]. The available attacks and their implementations are described in the following. * **Backdoor**: Utilizing Metasploit with the persistence option enabled, a backdoor is established within the target system, allowing unauthorized access to persist, even after the system reboots [43]. * **DoS (Denial of Service)**: Scapy is employed to craft Python scripts designed to launch DoS attacks against vulnerable devices, rendering them inaccessible to legitimate users [44]. * **DDoS (Distributed Denial of Service)**: Automation is achieved using Ufonet to develop bash scripts capable of orchestrating large-scale DDoS attacks, overwhelming target networks or servers with malicious traffic [45]. * **Injection**: Various injection techniques, including SQL injection and exploitation of broken authentication mechanisms, are executed against Web applications, aiming to compromise their integrity or gain unauthorized access. * **MITM**: Through the use of Ettercap, ARP spoofing, ICMP redirection, port stealing, and DHCP spoofing are carried out, enabling interception and manipulation of communication between targeted devices [46]. * **Scanning**: Employing Nessus and Nmap, extensive scanning is conducted across a range of addresses, identifying potential vulnerabilities within systems or networks for exploitation [47,48]. * **Ransomware**: Leveraging Metasploit, malicious payloads are executed on Windows systems to deploy ransomware, encrypting critical files and demanding ransom for decryption keys [43]. * **Password Attacks**: Hydra and Cewl are configured to simultaneously launch password attacks, brute-forcing login credentials or generating custom word lists based on Web content to enhance the effectiveness of the attack [49,50]. * **XSS (Cross-Site Scripting)**: XSSer is utilized to inject malicious Bash code into vulnerable Web applications, exploiting client-side vulnerabilities to execute unauthorized commands or steal sensitive information [51]. The testbed integrates edge, fog, and cloud layers. Edge computing handles IoT device management, using NSX-VMware for virtual machine (VM) management. Fog computing uses the same technology to provide computing and analytics close to data sources, extending Software-Defined Networking (SDN), Network Function Virtualization (NVF), and Service Orchestration (SO) capabilities. The cloud layer extends services for data analytics and Internet of Things (IoT) and Industrial IoT (IIoT) service interaction, facilitated by public platforms such as HIVE MQTT. Core technologies include SDN for dynamic network configuration, NVF for hardware virtualization, and SO for operational efficiency. The elements of each layer are listed as follows:  
* **Edge Layer:*
* vSphere System
* NSX VMware Server
* IoT/IIoT sensors
* Smart devices (two iPhones, smart TV)
* **Virtualization of Fog Layer:*
* Windows VMs
* Orchestrated Server--Ubuntu
* Metasploitable3 VM
* DVWA Service
* OWASP Shepherd VM
* Middleware Server--Ubuntu
* Offensive Systems--KALI
* Security Onion VM
* Virtual Switch
* **Cloud Layer:*
* Hive-MQTT broker
* Vulnerable PHP website
* Cloud centers (DHCP services)  
An important aspect to highlight is the simulation of IoT sensors at the edge, where scripts are used to emulate sensor behavior.