Although the Internet of Things (IoT) can increase efficiency and productivity through intelligent and remote management, it also increases the risk of cyber-attacks. The potential threats to IoT applications and the need to reduce risk have recently become an interesting research topic. It is crucial that effective Intrusion Detection Systems (IDSs) tailored to IoT applications be developed. Such IDSs require an updated and representative IoT dataset for training and evaluation. However, there is a lack of benchmark IoT and IIoT datasets for assessing IDSs-enabled IoT systems. This paper addresses this issue and proposes a new data-driven IoT/IIoT dataset with the ground truth that incorporates a label feature indicating normal and attack classes, as well as a type feature indicating the sub-classes of attacks targeting IoT/IIoT applications for multi-classification problems. The proposed dataset, which is named TON_IoT, includes Telemetry data of IoT/IIoT services, as well as Operating Systems logs and Network traffic of IoT network, collected from a realistic representation of a medium-scale network at the Cyber Range and IoT Labs at the UNSW Canberra (Australia). This paper also describes the proposed dataset of the Telemetry data of IoT/IIoT services and their characteristics. TON_IoT has various advantages that are currently lacking in the state-of-the-art datasets: i) it has various normal and attack events for different IoT/IIoT services, and ii) it includes heterogeneous data sources. We evaluated the performance of several popular Machine Learning (ML) methods and a Deep Learning model in both binary and multi-class classification problems for intrusion detection purposes using the proposed Telemetry dataset.

中文翻译：

---

TON_IoT 遥测数据集：用于数据驱动的入侵检测系统的新一代 IoT 和 IIoT 数据集

虽然物联网 (IoT) 可以通过智能和远程管理提高效率和生产力，但它也增加了网络攻击的风险。物联网应用的潜在威胁和降低风险的需要最近成为一个有趣的研究课题。开发适用于物联网应用的有效入侵检测系统 (IDS) 至关重要。此类 IDS 需要更新且具有代表性的 IoT 数据集进行培训和评估。但是，缺乏用于评估启用 IDS 的物联网系统的基准物联网和工业物联网数据集。本文解决了这个问题，并提出了一个新的数据驱动的 IoT/IIoT 数据集，其中包含一个标签特征，指示正常和攻击类别，以及指示针对物联网/工业物联网应用程序进行多分类问题的攻击子类的类型特征。提议的数据集名为 TON_IoT，包括 IoT/IIoT 服务的遥测数据，以及 IoT 网络的操作系统日志和网络流量，这些数据是从 Cyber​​ Range 和 IoT Labs 的中型网络的真实表示中收集的新南威尔士大学堪培拉（澳大利亚）。本文还描述了物联网/工业物联网服务遥测数据的拟议数据集及其特征。TON_IoT 具有当前最先进数据集所缺乏的各种优势：i）它具有针对不同 IoT/IIoT 服务的各种正常和攻击事件，以及 ii）它包括异构数据源。