Kitsune Network Attack: Nine Attacks on IP Cameras and IoT

Overview

Kitsune provides traffic from an IP surveillance network and an IoT network for evaluating intrusion detection. The original paper describes an eight-camera surveillance deployment and a separate network containing nine IoT devices and three PCs.

Attack coverage

• OS Scan, Fuzzing, Video Injection, ARP MitM and Active Wiretap.
• SSDP Flood, SYN DoS, SSL Renegotiation and Mirai.

Files and labels

Each capture has packet traces, extracted feature data and a separate label vector. Feature files are distributed as compressed CSVs. The documented total is 27,170,754 packets; the nine counts in the original paper sum to this value. UCI lists a 17.7 GB download.

Labels are 0 for benign and 1 for malicious traffic. In the MitM captures, packets passing through the attacker are labelled 1. Captures start with benign traffic.

Feature count and limitations

The documented feature matrix has 115 columns, computed from 23 statistics over five decaying time windows. This excludes the separate label; appending it produces 116 columns. UCI's headline value of 7 features conflicts with its detailed documentation. The stored column count refers to the feature matrix.

UCI reports no missing values and packet captures truncated to 200 bytes. Truncation alone does not establish complete anonymization. Full archives were not independently scanned for this catalog.

Citation and license

The 2019 UCI record lists no named creators, and its automatically generated citation begins with the dataset title. This catalog attributes the dataset to the four researchers who collected it, as identified in their 2018 paper and code repository: Yisroel Mirsky, Tomer Doitshman, Yuval Elovici and Asaf Shabtai.

Dataset DOI: 10.24432/C5D90Q. Paper: Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. The authors' repository requests citation of this paper when using the data or code.

The UCI record licenses the data under CC BY 4.0. Reuse requires appropriate attribution, a license link and an indication of changes. This catalog description is an independently prepared summary.