IoT-DH: IoT DDoS Honeypot Dataset for Attack Analysis

Dataset Overview

The IoT DDoS Honeypot Dataset is a comprehensive collection designed to enhance our understanding of Distributed Denial of Service (DDoS) attacks targeting IoT devices. The data was collected from a specially designed honeypot system to attract real-world cyberattacks.

Key Features

• 10 key attributes for comprehensive analysis
• Real data from honeypot deployment
• Conversion from PCAP to CSV for accessibility
• Detailed information about attacker tactics and techniques
• Focus on DDoS attack patterns specific to IoT

Data Structure/Columns

The dataset contains 10 specific attributes:

• dt: Timestamp of the packet
• dur: Duration in seconds
• dur_nsec: Duration in nanoseconds
• tot_dur: Total duration
• pktrate: Packet rate
• protocol: Network protocol (TCP/UDP/ICMP)
• port_no: Port number
• tx_kbps: Transmission speed (kbps)
• rx_kbps: Reception speed (kbps)
• tot_kbps: Total bandwidth (kbps)
• label: Attack classification (Benign/Attack)

Data Collection Method

Data was collected using a honeypot system specifically designed to attract DDoS attacks on IoT devices. The data was recorded in PCAP format and then converted to CSV for ease of access and analysis in machine learning applications.

Research Applications

• Analysis of DDoS attack patterns on IoT
• Threat intelligence and threat identification
• Study of attacker tactics and techniques
• Development of defense mechanisms
• Network traffic profiling for IoT security

Machine Learning Use Cases

• Binary classification (Benign vs Attack)
• DDoS attack detection models
• Traffic pattern analysis
• Real-time anomaly detection
• Bandwidth-based attack identification