MQTT-IoT-IDS2020 — MQTT Internet of Things IDS Dataset

Overview

MQTT-IoT-IDS2020 is a public dataset for intrusion detection in MQTT-based Internet of Things networks. MQTT is a common machine-to-machine communication protocol in IoT, and the dataset was created because general-purpose IDS datasets do not always represent MQTT traffic well.

The dataset was generated using a simulated MQTT architecture containing twelve sensors, a broker, a simulated camera, and an attacker. Five scenarios were recorded: normal operation, aggressive scan, UDP scan, Sparta SSH brute-force, and MQTT brute-force attack.

Raw PCAP files are saved and feature files are extracted at three abstraction levels: packet features, unidirectional flow features, and bidirectional flow features. The CSV files are intended for machine-learning usage.

Column Schema

Key Statistics

• Total Records: Multiple PCAP and CSV feature files
• Features: Packet, unidirectional-flow, and bidirectional-flow feature sets
• File Format: PCAP, CSV
• File Size: Not specified on the public metadata page
• Time Period: Data produced June 23, 2020; made available February 2, 2021
• Scenarios: 5 traffic scenarios

Use Cases

• MQTT-specific IoT intrusion detection
• Brute-force and scanning attack classification
• Packet-level versus flow-level feature comparison
• Lightweight protocol security analysis for IoT networks

Source & Attribution

Created by Hanan Hindy and Xavier Bellekens, with Christos Tachtatzis, Robert Atkinson, and Ethan Bayne listed in the dataset metadata. Published through IEEE DataPort and indexed by the University of Strathclyde with DOI 10.21227/bhxy-ep04.