Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

This repository contains research data for evaluating network-traffic-based classification of Philips Hue smart-home actions. The dataset provides packet-level captures for repeated light on/off commands and labeled packet-burst features for Hue security-state commands. It is intended to support reproducible experiments on IoT traffic analysis, command inference, and device-behavior fingerprinting.

Short Description

Research dataset of Philips Hue smart-home network traces for IoT traffic analysis. The repository contains 10,000 labeled on/off PCAP captures and labeled packet-burst features for arm/disarm security-state commands.

Dataset Contents

Repository/ -- armstate_labeled.csv -- Left_Spot_device_10ktrial.7z

On-Off

On-Off/Left_Spot_device_10ktrial.7z contains 10,000 PCAP files captured during repeated Philips Hue light-control actions for a smart-light device communicating with a Hue Bridge Pro. The archive contains 5,000 Turn_On captures and 5,000 Turn_Off captures. File names encode the trial number, timestamp, device label and action label.

Arm-Disarm

Arm-Disarm/armstate_labeled.csv contains 100 labeled packet-burst feature records for Hue security-state commands:

arm_home: 25 records

arm_away: 25 records

disarm: 50 records

The CSV uses the following columns:

label: command class label.

TO-lengths: ordered packet-length sequence for packets sent to the target device.

total-t: total burst duration in seconds.

IAT: mean inter-arrival time in seconds.

packet-amount: number of packets in the burst.

FAIR Data Statement

This dataset is structured to support the FAIR principles:

Findable: Files are organized by task (On-Off, Arm-Disarm) and named with explicit device/action labels.

Accessible: Data is provided in commonly supported formats: PCAP for packet captures, CSV for tabular features, and 7z for compressed distribution. Users can inspect the PCAP files with tools such as Wireshark, tshark, tcpdump, or Scapy.

Interoperable: Labels, timing features, packet counts, and packet-length sequences are represented using plain-text CSV fields. Packet captures use the standard PCAP format for compatibility with established network-analysis tools.

Reusable: The repository documents the dataset structure, labels, feature definitions, file naming scheme, license, and provisional citation guidance.

Suggested Citation

If you use this dataset, cite the accompanying paper and the archived dataset release. A final citation will be added once the publication metadata and persistent dataset identifier are available.

Until then, please cite this repository as:

Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic

Temporary BibTeX entry:

@dataset{hue_research_data_2026, title = {Traces in WAN Traffic: Inferring Alarm States and User Activity from Encrypted Smart Home Traffic}, author = {{Paul Mairinger et al.}}, year = {2026}, note = {Dataset repository. Final citation metadata to be added after publication.}, url = {TODO} }