Dataset used for quantitative evaluation in the paper: Y. Meidan, D. Avraham, H. Libhaber and A. Shabtai, "CADeSH: Collaborative Anomaly Detection for Smart Homes," in IEEE Internet of Things Journal, 2022, doi: 10.1109/JIOT.2022.3194813. This is a table of flow-level traffic data which was continuously captured during a period of 21 days from five real home networks which were subscribed to a smart home security service, and from our lab at Ben-Gurion University of The Negev. This security service provider shared with us these network traffic flows, plus the related DNS requests and responses, and reputation intelligence of the destination IP addresses. Each instance in this dataset represents an outbound network traffic flow (in the form of an IPFIX) which emanated from an instance of the IoT model streamer.Amazon.Fire_TV_Gen_3. In our lab, we infected our streamer.Amazon.Fire_TV_Gen_3 with a cryptominer and executed cryptomining from this device. To imitate a scanning activity typically performed by some botnets, we also scanned the network using Nmap. In accordance, we labeled these malicious activities as (1) `is executing cryptomining,' or (2) `being scanned by Nmap.' All of the remaining IPFIXs captured in our lab or on the home networks were labeled as `assumed benign'. The multitude of real home networks, and the multitude of identical source devices, enable using this dataset for quantitative evaluation of (collaborative) anomaly/attack detection methods, especially for the IoT.

{"references": ["Y. Meidan, D. Avraham, H. Libhaber and A. Shabtai, \"CADeSH: Collaborative Anomaly Detection for Smart Homes,\" in IEEE Internet of Things Journal, 2022, doi: 10.1109/JIOT.2022.3194813.", "@ARTICLE{9844137, author={Meidan, Yair and Avraham, Dan and Libhaber, Hanan and Shabtai, Asaf}, journal={IEEE Internet of Things Journal}, title={CADeSH: Collaborative Anomaly Detection for Smart Homes}, year={2022}, volume={}, number={}, pages={1-1}, doi={10.1109/JIOT.2022.3194813}}"]}