ZBDS2023: A multi location Zigbee dataset to build innovative IoT Intrusion Detection Systems
Olivier Lourme, Gilles Grimaud, Michaël Hauspie · 2023
The emergence of the Internet of Things (IoT) model featuring different types of wireless networks made of many different constrained devices conducts researchers to face new security challenges to protect these networks. Indeed, they need to build and evaluate dedicated monitoring tools and Intrusion Detection Systems (IDSs). To succeed in these goals, quality datasets including benign and under attack situations are necessary for all IoT protocols. However, if we consider for instance the smart-home sub-market dominated by Wi-Fi, Zigbee and BLE, only complete Wi-Fi datasets can easily be found today. To specifically overcome the lack of Zigbee datasets and contribute to the development of related IDSs, this paper presents ZBDS2023, a 10-day realistic Zigbee dataset made publicly available. Fully documented with metadata, it has been collected from a real populated smart home equipped with 10 recent Zigbee lighting devices. Some periods of capture are free of attack, allowing to build normality models, and some include various labelled attacks, enabling the evaluation of different intrusion detection strategies. Also, as an original second contribution, each emitted frame is captured by one to four demodulating passive probes distributed in the house. Besides providing redundancy concerning MAC layer data, the corresponding values of Received Signal Strength Indicator (RSSI) have also been made available. Being a physical feature, RSSI cannot be easily impersonated and as such, it is a priori a good candidate for participating in fingerprints feeding spoofing detection systems. Moreover, its extraction is uncostly and available in many wireless technologies. However, exploitation of RSSI time series is not trivial, especially in populated buildings. A third contribution using our dataset evaluates a naive attack detection system to serve as a baseline for future works.