Aposemat IoT-23

A Labeled Dataset With Malicious And Benign IoT Network Traffic

After two years of observing real internet of things (IoT) devices we finally release the IoT-23 Dataset with data of malicious and benign network traffic. It was created as part of our joint Avast-AIC laboratory (AAICL) with funding from Avast Software. We hope this dataset will bring researchers closer to the security of smart homes and encourage the creation of new and better ways of protect the millions of IoT devices that we already have in the industry and more importantly, at home. A detailed report on the whole research and data is published on the team's blog.

IoT-23 research team

This dataset was created as part of the Apsemat project that focuses on research of internet of things. Aposemat belongs to the many activities of Stratosphere lab, the cybersecurity research group of the department's AI Center. Authors of these dataset are: Sebastián García who is also the head of Avast-AIC laboratory mentioned above, María José Erquiaga and Agustin Parmisano.

Devices used for obtaining the network traffic

Among the real devices used to gather these data were a Philips HUE smart LED lamp, an Amazon Echo home intelligent personal assistant and a Somfy Smart Door Lock. It is important to mention that these three IoT devices are real hardware and not simulated. That allowed us to capture and analyze real network behavior without any bias or issue that typically comes from simulated traffic.

Structure of IoT-23 Dataset

The IoT-23 Dataset contains 20 captures of malware executed in IoT devices, and 3 captures of benign IoT devices traffic. The dataset contains more than 760 million packets and 325 million labeled flows of more than 500 hours of traffic. If you want to learn more about the characteristics of the IoT-23 Dataset, read this detailed report on Startosphere's blog.

Download the data

We encourage you to use our data for research purposes. Download the IoT-23 Dataset in full or lighter (without pcaps files) version. Please, always reference our work when using the data as "Stratosphere Laboratory. A labeled dataset with malicious and benign IoT network traffic. January 22th. Agustin Parmisano, Sebastian Garcia, Maria Jose Erquiaga."