The paper discusses a data science competition centered around the development of an anomaly detection system for IoT devices.The competition utilized a unique environment that allowed for the operation and monitoring of real IoT devices, including scheduling of attacks on these devices.The environment was used to collect the data, which included both normal and attack-induced behavior of IoT devices.The paper presents the background of the competition, the top models submitted, and the competition results.The paper also includes a discussion about restrictions related to the use of synthetic attack data as input for constructing anomaly detection systems.

As the IoT industry strongly extends there is a need for better security and threat detection tools. Many approaches are possible but the tendency is to detect attacks externally by using network traffic analysis. Network based intrusion detection could lead to satisfactory results however it is uncertain if host based methods would not give better results as IoT devices usually have repeatable and predictable behavior. Unfortunately host based detection methods can neither be directly compared against each other nor be compared to network based systems as there are no publicly available data sets with IoT device operating system traces. In this paper we propose and describe a framework which allows for emulation of IoT devices, simulation of random attacks and gathering of the operating system traces for Linux based IoT devices. We also publish the first gathered data set and we plan to release new extended data sets in near future.

In this paper we present three virtualization devices (Xen server, NetFPGA and EZ appliance) which have been used for implementation of data plane functionality in a Future Internet architecture, the IIP System. We give general description of these devices and present implementation of the IIP System node on each device.