{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T15:33:44Z","timestamp":1774539224934,"version":"3.50.1"},"reference-count":45,"publisher":"MDPI AG","issue":"13","license":[{"start":{"date-parts":[[2020,7,4]],"date-time":"2020-07-04T00:00:00Z","timestamp":1593820800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100010801","name":"Xunta de Galicia","doi-asserted-by":"publisher","award":["ED431G\/01"],"award-info":[{"award-number":["ED431G\/01"]}],"id":[{"id":"10.13039\/501100010801","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The relative simplicity of IoT networks extends service vulnerabilities and possibilities to different network failures exhibiting system weaknesses. Therefore, having a dataset with a sufficient number of samples, labeled and with a systematic analysis, is essential in order to understand how these networks behave and detect traffic anomalies. This work presents DAD: a complete and labeled IoT dataset containing a reproduction of certain real-world behaviors as seen from the network. To approximate the dataset to a real environment, the data were obtained from a physical data center, with temperature sensors based on NFC smart passive sensor technology. Having carried out different approaches, performing mathematical modeling using time series was finally chosen. The virtual infrastructure necessary for the creation of the dataset is formed by five virtual machines, a MQTT broker and four client nodes, each of them with four sensors of the refrigeration units connected to the internal IoT network. DAD presents a seven day network activity with three types of anomalies: duplication, interception and modification on the MQTT message, spread over 5 days. Finally, a feature description is performed, so it can be used for the application of the various techniques of prediction or automatic classification.<\/jats:p>","DOI":"10.3390\/s20133745","type":"journal-article","created":{"date-parts":[[2020,7,6]],"date-time":"2020-07-06T09:49:11Z","timestamp":1594028951000},"page":"3745","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":20,"title":["Annotated Dataset for Anomaly Detection in a Data Center with IoT Sensors"],"prefix":"10.3390","volume":"20","author":[{"given":"Laura","family":"Vigoya","sequence":"first","affiliation":[{"name":"Centre for Information and Communications Technology Research (CITIC), Campus de Elvi\u00f1a s\/n, 15071 A Coru\u00f1a, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6577-8951","authenticated-orcid":false,"given":"Diego","family":"Fernandez","sequence":"additional","affiliation":[{"name":"Centre for Information and Communications Technology Research (CITIC), Campus de Elvi\u00f1a s\/n, 15071 A Coru\u00f1a, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7536-9422","authenticated-orcid":false,"given":"Victor","family":"Carneiro","sequence":"additional","affiliation":[{"name":"Centre for Information and Communications Technology Research (CITIC), Campus de Elvi\u00f1a s\/n, 15071 A Coru\u00f1a, Spain"}]},{"given":"Fidel","family":"Cacheda","sequence":"additional","affiliation":[{"name":"Centre for Information and Communications Technology Research (CITIC), Campus de Elvi\u00f1a s\/n, 15071 A Coru\u00f1a, Spain"}]}],"member":"1968","published-online":{"date-parts":[[2020,7,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1267","DOI":"10.1016\/j.future.2018.04.019","article-title":"Design and analysis of authenticated key agreement scheme in cloud-assisted cyber\u2013physical systems","volume":"108","author":"Challa","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1109\/MC.2011.291","article-title":"Securing the Internet of Things","volume":"44","author":"Roman","year":"2011","journal-title":"Computer"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"2191","DOI":"10.1109\/TSP.2003.814797","article-title":"Anomaly Detection in IP Networks","volume":"51","author":"Thottan","year":"2003","journal-title":"IEEE Trans. Signal Process."},{"key":"ref_4","unstructured":"Salman, T., and Jain, R. (arXiv, 2019). A Survey of Protocols and Standards for Internet of Things, arXiv."},{"key":"ref_5","unstructured":"MQTT (2020, January 30). Available online: http:\/\/mqtt.org\/."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"102496","DOI":"10.1016\/j.jnca.2019.102496","article-title":"LAM-CIoT: Lightweight authentication mechanism in cloud-based IoT environment","volume":"150","author":"Wazid","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"2481","DOI":"10.1007\/s11276-014-0761-7","article-title":"Security of the Internet of Things: Perspectives and challenges","volume":"20","author":"Jing","year":"2014","journal-title":"Wirel. Netw."},{"key":"ref_8","unstructured":"(2020, January 30). Centro de Investigaci\u00f3n en Tecnolox\u00edas da Informaci\u00f3n e as Comunicaci\u00f3ns de Galicia. Available online: https:\/\/www.citic-research.org\/."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Alrawi, O., Lever, C., Antonakakis, M., and Monrose, F. (2019, January 19\u201323). SoK: Security Evaluation of Home-Based IoT Deployments. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2019.00013"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_11","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (arXiv, 1802). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection, arXiv."},{"key":"ref_12","unstructured":"Kang, H., Ahn, D.H., Lee, G.M., Yoo, J.D., Park, K.H., and Kim, H.K. (2019, September 27). IoT Network Intrusion Dataset. Available online: https:\/\/ieee-dataport.org\/open-access\/iot-network-intrusion-dataset."},{"key":"ref_13","first-page":"683","article-title":"Towards Generating Real-life Datasets for Network Intrusion Detection","volume":"17","author":"Bhuyan","year":"2015","journal-title":"IJ Netw. Secur."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1145\/846183.846204","article-title":"KDD-Cup 99: Knowledge Discovery in a Charitable Organization\u2019s Donor Database","volume":"1","author":"Rosset","year":"2000","journal-title":"SIGKDD Explor. Newsl."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Paulauskas, N., and Auskalnis, J. (2017, January 27). Analysis of data pre-processing influence on intrusion detection using NSL-KDD dataset. Proceedings of the 2017 Open Conference of Electrical, Electronic and Information Sciences (eStream), Vilnius, Lithuania.","DOI":"10.1109\/eStream.2017.7950325"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201319). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_17","unstructured":"(2020, January 01). DARPA Intrusion Detection Evaluation. Available online: https:\/\/archive.ll.mit.edu\/ideval\/data\/2000data.html."},{"key":"ref_18","first-page":"1848","article-title":"A Detailed Analysis on NSL-KDD Dataset Using Various Machine Learning Techniques for Intrusion Detection","volume":"2","author":"Revathi","year":"2013","journal-title":"Int. J. Eng. Res. Technol. (IJERT)"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Panwar, S.S., and Raiwani, Y. (2020). Performance Analysis of NSL-KDD Dataset Using Classification Algorithms with Different Feature Selection Algorithms and Supervised Filter Discretization. Intelligent Communication, Control and Devices, Springer.","DOI":"10.1007\/978-981-13-8618-3_52"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"262","DOI":"10.1145\/382912.382923","article-title":"Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Laboratory","volume":"3","author":"McHugh","year":"2000","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_21","unstructured":"(2020, January 01). Malware Capture Facility Project. Available online: https:\/\/mcfp.weebly.com\/."},{"key":"ref_22","unstructured":"(2020, January 01). UNIBS: Data Sharing. Available online: http:\/\/netweb.ing.unibs.it\/~ntw\/tools\/traces\/."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","article-title":"Toward Developing a Systematic Approach to Generate Benchmark Datasets for Intrusion Detection","volume":"31","author":"Shiravi","year":"2012","journal-title":"Comput. Secur."},{"key":"ref_24","unstructured":"Song, J., Takakura, H., and Okabe, Y. (2016, March 15). Description of Kyoto University Benchmark Data. Available online: http:\/\/www.takakura.com\/Kyoto_data\/BenchmarkData-Description-v5.pdf."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_26","unstructured":"Timcenko, V., and Gajin, S. (2018, January 11\u201314). Machine Learning based Network Anomaly Detection for IoT environments. Proceedings of the 8th International Conference on Information Society and Techology (ICIST 2018), Kopaonik, Serbia."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"4815","DOI":"10.1109\/JIOT.2018.2871719","article-title":"An Ensemble Intrusion Detection Technique Based on Proposed Statistical Flow Features for Protecting Network Traffic of Internet of Things","volume":"6","author":"Moustafa","year":"2019","journal-title":"IEEE Int. Things J."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1080\/19393555.2015.1125974","article-title":"The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set","volume":"25","author":"Moustafa","year":"2016","journal-title":"Inf. Secur. J. Glob. Perspect."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"2","DOI":"10.1016\/j.cose.2013.04.007","article-title":"Botnet detection based on traffic behavior analysis and flow intervals","volume":"39","author":"Zhao","year":"2013","journal-title":"Comput. Secur."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Biglar Beigi, E., Hadian Jazi, H., Stakhanova, N., and Ghorbani, A.A. (2014, January 29\u201331). Towards effective feature selection in machine learning-based botnet detection approaches. Proceedings of the 2014 IEEE Conference on Communications and Network Security, San Francisco, CA, USA.","DOI":"10.1109\/CNS.2014.6997492"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Saad, S., Traore, I., Ghorbani, A., Sayed, B., Zhao, D., Lu, W., Felix, J., and Hakimian, P. (2011, January 19\u201321). Detecting P2P botnets through network behavior analysis and machine learning. Proceedings of the 2011 Ninth Annual International Conference on Privacy, Security and Trust, Montreal, QC, Canada.","DOI":"10.1109\/PST.2011.5971980"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Fernandez, D., Vigoya, L., Cacheda, F., Novoa, F.J., Lopez-Vizcaino, M.F., and Carneiro, V. (2018, January 1\u20133). A Practical Application of a Dataset Analysis in an Intrusion Detection System. Proceedings of the 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA.","DOI":"10.1109\/NCA.2018.8548316"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-BaIoT\u2014Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_34","unstructured":"Nikolova, B., Nikolov, G.T., and Todorov, M.H. (2009). Curve Fitting of Sensors\u2019 Characteristics. Ann. J. Electron., Available online: https:\/\/pdfs.semanticscholar.org\/bcf8\/8fe27a33950066f8a6916eb6ff1a045fce4e.pdf."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1886","DOI":"10.1016\/j.biortech.2007.03.061","article-title":"A statistical method for the analysis of nonlinear temperature time series from compost","volume":"99","author":"Yu","year":"2008","journal-title":"Bioresour. Technol."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"57","DOI":"10.1049\/iet-wss.2012.0073","article-title":"Statistical analysis of wireless sensor network Gaussian range estimation errors","volume":"3","author":"Rasool","year":"2013","journal-title":"IET Wirel. Sens. Syst."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Bhandari, S., Bergmann, N., Jurdak, R., and Kusy, B. (2017). Time Series Data Analysis of Wireless Sensor Network Measurements of Temperature. Sensors, 17.","DOI":"10.3390\/s17061221"},{"key":"ref_38","first-page":"3","article-title":"STL: A seasonal-trend decomposition procedure based on loess (with discussion)","volume":"6","author":"Cleveland","year":"1990","journal-title":"J. Off. Stat."},{"key":"ref_39","unstructured":"Hyndman, R., and Athanasopoulos, G. (2014). Forecasting: Principles and Practice, OTexts."},{"key":"ref_40","unstructured":"Mosquitto (2020, January 01). Available online: https:\/\/mosquitto.org\/."},{"key":"ref_41","unstructured":"TCPDUMP (2020, January 01). Available online: https:\/\/www.tcpdump.org\/."},{"key":"ref_42","unstructured":"Scapy (2020, January 01). Available online: https:\/\/scapy.net\/."},{"key":"ref_43","unstructured":"(2020, March 03). DAD: Dataset for Anomaly Detection. Available online: https:\/\/github.com\/dad-repository\/dad."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"2037","DOI":"10.1109\/COMST.2014.2321898","article-title":"Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX","volume":"16","author":"Hofstede","year":"2014","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_45","first-page":"248","article-title":"Detecting Denial of Service Attack Using Principal Component Analysis with Random Forest Classifier","volume":"5","author":"Revathi","year":"2014","journal-title":"Int. J. Comput. Sci. Eng. Technol. (IJCSET)"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/13\/3745\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T09:47:19Z","timestamp":1760176039000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/13\/3745"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,7,4]]},"references-count":45,"journal-issue":{"issue":"13","published-online":{"date-parts":[[2020,7]]}},"alternative-id":["s20133745"],"URL":"https:\/\/doi.org\/10.3390\/s20133745","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,7,4]]}}}