DataSense: CIC IIoT dataset 2025

A Real-Time Sensor-Based Benchmark Dataset for Attack Analysis in IIoT with Multi-Objective Feature Selection

The focus of this research is on creating a realistic IIoT dataset enriched with synchronized sensor and network data, complemented by a novel feature selection method to enhance anomaly detection accuracy while minimizing resource usage—bringing academic advances closer to practical IIoT security solutions.

Main contributions:

• Designed and implemented a realistic IIoT testbed with diverse industrial sensors, IoT devices, and network infrastructure.
• Collected synchronized time-series sensor data and network traffic streams to enable holistic security analysis.
• Executed and recorded 50 distinct attack types across seven categories to capture diverse, realistic threat scenarios.
• Proposed and validated a novel multi-objective feature selection method that enhances detection accuracy and reduces resource usage.
• Developed a benchmark integrating ML and DL methods for real-time detection and classification of cyberattacks.
• Conducted extensive experiments profiling detection performance and resource utilization under various operational conditions.

CIC IoT/IIoT lab

Developing a realistic IIoT testbed is a complex undertaking due to the heterogeneity of devices, communication protocols, and the substantial financial and technical resources required. Simulations or small-scale setups often fail to reflect the nuanced behaviors of real deployments. To address this gap, the Canadian Institute for Cybersecurity (CIC) established a dedicated IoT and IIoT laboratory featuring a sophisticated network infrastructure and 40 interconnected devices. These include over 15 types of industrial sensors built from scratch using Arduino boards alongside real industrial sensors, as well as network equipment, IoT devices, edge devices, and attacker systems—together providing a rich environment for experimentation.

The proposed testbed architecture is composed of five primary layers: the IoT/IIoT Layer, Network Infrastructure, Edge Layer, Cloud Layer, and Attacker Layer. By integrating diverse device types across these interconnected layers, the testbed replicates the complexity and heterogeneity of industrial environments, supporting comprehensive research into anomaly detection, intrusion detection, and resilience mechanisms in IIoT systems.

Testbed setup         Attack framework

Data descriptions

Number of packets for each attack scenario

Number of logs for each attack scenario

Number of packets/logs per category

Acknowledgments

The authors would like to thank the Canadian Institute for Cybersecurity (CIC) for its financial and educational support.

Citation

Firouzi, A.; Dadkhah, S.; Maret, S.A.; Ghorbani, A.A. "DataSense: A Real-Time Sensor-Based Benchmark Dataset for Attack Analysis in IIoT with Multi-Objective Feature Selection." Electronics, 14, 4095, 2025.

Download the dataset