TRUSTLab dataset: a real-world CICFlowMeter dataset for IoT/edge intrusion detection

Project publication · Frontiers in Computer Science

Summary

The article presents TRUST Lab, a CICFlowMeter dataset for evaluating intrusion detection systems in IoT and edge scenarios with unambiguous labels.

Topología del banco de pruebas del conjunto de datos TRUST Lab
Figure 1. TRUST Lab testbed and traffic capture and labelling pipeline. Source: Frontiers in Computer Science; reproduced with attribution under CC BY 4.0.

Main contribution

The main contribution is a capture methodology based on single-class sessions, with benign traffic or one isolated attack family in each window. The result includes 4.6 million bi-flows and 15 attack families, avoiding temporal contamination between classes.

Resultados y alcance

El conjunto TRUSTLab separa de forma explícita tráfico benigno y malicioso y ofrece flujos CICFlowMeter obtenidos en un entorno operativo reproducible. Las pruebas de clasificación muestran su utilidad para evaluar IDS de IoT y borde, al tiempo que el alcance queda limitado a los servicios, ataques y condiciones de red incluidos en el banco de ensayos.

Link with BoND1

For BoND1, the work strengthens the security and trust dimension in advanced IoT infrastructures. The dataset makes it easier to compare lightweight IDS models deployable at the edge, a useful element for non-cellular and B6G networks with autonomous-operation requirements.

DOIUPCT dataset

Project publication · Frontiers in Computer Science

Summary

The paper presents TRUST Lab, a CICFlowMeter dataset for evaluating intrusion detection systems in IoT and edge scenarios with unambiguous labels.

TRUST Lab Dataset Testbed Topology
Figure 1. Topology of the TRUST Lab testbed and capture and labeling process. Source: Frontiers in Computer Science; reproduced with attribution under CC BY 4.0.

Bibliometric indicators

JCR quartileQ3
Impact factor3.4
Google Scholar citations6
JCR area
Computer Science, Interdisciplinary Applications
JCR year
2025
Scholar query
26 October 2026

Main contribution

The main contribution is a single-class session-based capture methodology, with benign traffic or an isolated attack family in each window. The result brings together 4.6 million biflows and 15 attack families, avoiding temporary contamination between classes.

Results and scope

The TRUSTLab suite explicitly separates benign and malicious traffic and provides CICFlowMeter flows obtained in a reproducible operating environment. Classification tests are useful for evaluating IoT and edge IDS, while limiting the scope to the services, attacks, and network conditions included in the testbed.

Link with BoND1

For BoND1, the work reinforces the dimension of security and trust in advanced IoT infrastructures. The dataset makes it easy to compare lightweight and edge-deployable IDS models, a useful piece for non-cellular and B6G networks with autonomous operation requirements.

DOIUPCT Dataset

UPCT Repository: https://hdl.handle.net/10317/24191

Scroll al inicio