KNXnet/IP Intrusion Detection Dataset

The recent developments in the field of the Internet of Things (IoT) bring alongside them quite a few advantages. Examples include real-time condition monitoring, remote control and operation and sometimes even remote fault remediation. Still, despite bringing invaluable benefits, IoT-enriched entities inherently suffer from security and privacy issues. This is partially due to the utilization of insecure communication protocols such as the KNXnet/IP protocol. KNXnet/IP is an application-layer communication protocol that allows KNX infrastructure to be integrated into the Ethernet-based TCP/IP network. Through a KNX IP interface, clients from the TCP/IP network can seamlessly access and query the devices of the KNX bus, obtaining measurements and device status or programming the KNX devices to implement complex automations. However, KNXnet/IP is often deployed without encryption or authentication, thus enabling threat actors to exploit vulnerabilities and affect the availability and integrity of the KNX systems. In the context of the AI4CYBER project (funded by the European Union – Grant Agreement No 101070450), a set of cyberattacks were investigated and developed against a KNXnet/IP infrastructure. Based on these attacks, the KNXnet-IP Intrusion Detection Dataset was created, aiming to support the development of Artificial Intelligence (AI)-powered Intrusion Detection Systems (IDS) that use Machine Learning (ML), Deep Learning (DL) and Federated Learning (FL) techniques. The goal of this report is to describe this dataset.