With the rise in smart devices, the Internet of Things (IoT) has been established as one of the preferred emerging platforms to fulfil their need for simple interconnections. The use of specific protocols such as constrained application protocol (CoAP) has demonstrated improvements in the performance of the networks. However, power-, bandwidth-, and memory-constrained sensing devices constitute a weakness in the security of the system. One way to mitigate these security problems is through anomaly-based intrusion detection systems, which aim to estimate the behaviour of the systems based on their “normal” nature. Thus, to develop anomaly-based intrusion detection systems, it is necessary to have a suitable dataset that allows for their analysis. Due to the lack of a public dataset in the CoAP-IoT environment, this work aims to present a complete and labelled CoAP-IoT anomaly detection dataset (CIDAD) based on real-world traffic, with a sufficient trace size and diverse anomalous scenarios. The modelled data were implemented in a virtual sensor environment, including three types of anomalies in the CoAP data. The validation of the dataset was carried out using five shallow machine learning techniques: logistic regression, naive Bayes, random forest, AdaBoost, and support vector machine. Detailed analyses of the dataset, data conditioning, feature engineering, and hyperparameter tuning are presented. The evaluation metrics used in the performance comparison are accuracy, precision, recall, F1 score, and kappa score. The system achieved 99.9% accuracy for decision tree models. Random forest established itself as the best model, obtaining a 99.9% precision and F1 score, 100% recall, and a Cohen’s kappa statistic of 0.99.

With advancements in engineering and science, the application of smart systems is increasing, generating a faster growth of the IoT network traffic. The limitations due to IoT restricted power and computing devices also raise concerns about security vulnerabilities. Machine learning-based techniques have recently gained credibility in a successful application for the detection of network anomalies, including IoT networks. However, machine learning techniques cannot work without representative data. Given the scarcity of IoT datasets, the DAD emerged as an instrument for knowing the behavior of dedicated IoT-MQTT networks. This paper aims to validate the DAD dataset by applying Logistic Regression, Naive Bayes, Random Forest, AdaBoost, and Support Vector Machine to detect traffic anomalies in IoT. To obtain the best results, techniques for handling unbalanced data, feature selection, and grid search for hyperparameter optimization have been used. The experimental results show that the proposed dataset can achieve a high detection rate in all the experiments, providing the best mean accuracy of 0.99 for the tree-based models, with a low false-positive rate, ensuring effective anomaly detection.

The relative simplicity of IoT networks extends service vulnerabilities and possibilities to different network failures exhibiting system weaknesses. Therefore, having a dataset with a sufficient number of samples, labeled and with a systematic analysis, is essential in order to understand how these networks behave and detect traffic anomalies. This work presents DAD: a complete and labeled IoT dataset containing a reproduction of certain real-world behaviors as seen from the network. To approximate the dataset to a real environment, the data were obtained from a physical data center, with temperature sensors based on NFC smart passive sensor technology. Having carried out different approaches, performing mathematical modeling using time series was finally chosen. The virtual infrastructure necessary for the creation of the dataset is formed by five virtual machines, a MQTT broker and four client nodes, each of them with four sensors of the refrigeration units connected to the internal IoT network. DAD presents a seven day network activity with three types of anomalies: duplication, interception and modification on the MQTT message, spread over 5 days. Finally, a feature description is performed, so it can be used for the application of the various techniques of prediction or automatic classification.

In this paper a systematic analysis of a public intrusion detection dataset has been developed in order to understand how the traffic behaves in this particular context. This analysis is used for avoiding common pitfalls introduced because of a misunderstanding of data peculiarities and for selecting and tailoring correctly the algorithms. Specifically, we have employed machine learning algorithms to classify the traffic into normal and attack flows. In addition, it is important to decide what features should be evaluated. Typically, standard metrics do not take into account time spent in the classification, what is essential in an intrusion detection system. This is the reason why we introduce a metric that considers both the accuracy and the delay to make the decision and that is employed for evaluating machine learning algorithms in other domains. The conclusions obtained from our dataset analysis can be used to develop new models that could fit the data better than existing approaches.

Nowadays, the Internet of things (IoT) network, as system of interrelated computing devices with the ability to transfer data over a network, is present in many scenarios of everyday life. Understanding how traffic behaves can be done more easily if the real environment is replicated to a virtualized environment. In this paper, we propose a methodology to develop a systematic approach to dataset analysis for detecting traffic anomalies in an IoT network. The reader will become familiar with the specific techniques and tools that are used. The methodology will have five stages: definition of the scenario, injection of anomalous packages, dataset analysis, implementation of classification algorithms for anomaly detection and conclusions.

Enterococci are part of the normal intestinal flora of humans and animals. They have long been recognized as important human pathogens and are increasing. Enterococcus faecalis and Enterococcus faecium are the most prevalent species cultured from humans, accounting for more than 90 % of clinical isolates. Due to their ubiquity in human feces and persistence in the environment, enterococci have been adopted as indicators of human fecal pollution in water. One of the methods used in water quality control is the membrane filtration technique (Membrane Filtration — MF) (ISO7899-2). This method requires the cultivation of bacteria (enterococci), which is a great disadvantage because the time required to obtain the final result is between 24 and 48 hours. This work proposes a design of a system that detects, with optical sensors, the presence of simulated bacterial colonies in the early stages of the cultures (14–24 h). An image processing system (ZooMat) has been developed with Matlab to detect simulated colonies at early stages, which allows you to process the image before counting. To obtain detection and a count of bacterial colonies on each image, we integrate NICE (an open source, free software) to our system, to gather the results. The entire system allows detection of particles at about 60 μm.