A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets

Abstract

Abstract While there has been a significant interest in understanding the cyber threat landscape of Internet of Things (IoT) networks, and the design of Artificial Intelligence (AI)-based security approaches, there is a lack of distributed architecture led to generating heterogeneous datasets that contain the actual behaviours of real-world IoT networks and complex cyber threat scenarios to evaluate the credibility of the new systems. This paper presents a new realistic testbed architecture of IoT network deployed at the IoT lab of the University of New South Wales (UNSW) at Canberra. The platform NSX vCloud NFV was employed to facilitate the execution of Software-Defined Network (SDN), Network Function Virtualization (NFV) and Service Orchestration (SO) to offer dynamic testbed networks, which allow the interaction of edge, fog and cloud tiers. While deploying the architecture, real-world normal and attack scenarios are executed to collect labeled datasets. The datasets are referred to as “ToN_IoT”, as they comprise heterogeneous data sources collected from telemetry datasets of IoT services, Windows and Linux-based datasets, and datasets of network traffic. The ToN_IoT network dataset is validated using four machine learning-based anomaly detection algorithms of Gradient Boosting Machine, Random Forest, Naive Bayes, and Deep Neural Networks, revealing a high performance of detection accuracy using the set of training and testing. These new datasets provide a realistic testbed of design, a variety of normal and attack events, heterogeneous data sources, and a ground truth table of security events. A comparative summary of the ToN_IoT network dataset and other competing network datasets demonstrates its diverse legitimate and anomalous patterns that can be used to better validate new AI-based security solutions. The datasets can be publicly accessed from ADFA (2020) .