Generating a Distributed Network Attack Dataset Based on Weather Station IoT Cyber Physical Systems
David W. Johnson, Kaushik Roy · 2024
There has been a large increase in Internet of Things (IoT) devices used in many parts of life. These devices, also called edge devices, have been known to be vulnerable to attackers and to be used as a medium for network attacks. A simple IoT device uses one or more sensors to read data from the real world and performs a simple action based on the sensor readings, such as a motion sensor in a home turning on the lights when motion is detected. Building a dataset to model real-world network traffic, along with pseudo-realistic uses of network attacks is essential for creating an intrusion detection system (IDS). In this paper, we develop an IoT network anomaly dataset using synthetic and real-world network attacks. Virtual machines with Ubuntu 22.04 were used to contain the network data in a sandboxed environment. For our edge devices, we use Le Potato by Libre Computers as an alternative to Raspberry Pi 3, which is a popular single board computer used for home automation and hobbyist projects where the Raspberry Pi acts as the computer for the smart device. Each device has Waveshare Weather Sensor attached to it, which reads climate data such as temperature, humidity, and barometric pressure. The edge devices are located within the Cyber Defense and AI lab at North Carolina Agriculture and Technology State University. Real network attack tools were used to generate traffic to label the current data as attack data, along with the attack type. In the absence of the attack tools in use, the network traffic is labeled normal, or benign. The dataset is comprised of homogeneous data using environmental sensors that measure local climate data. In this study, we use XGBoost, LSTM+CNN, and Multilayer Perceptron along with various resampling methods to evaluate our synthetic dataset. In our results, we find that XGBoost produces the best performance at classifying attacks when using RandomUndersampler.