File Characteristics

The AWID dataset is comprised from a large set of packets (F) and a smaller one (R).

These two versions are not related i.e., the smaller one has not been produced from the larger. Actually, they have been captured at different times, with different equipment and in different environments.

Each version has a training set (denoted as Trn) and a test set (denoted as Tst). The test version has not been produced from the corresponding training set.

Finally, a version where labels that correspond to different attacks (ATK), as well as a version where the attack labels are organized into 3 major classes (CLS) are provided. In that case the datasets only differ in the label.

Name Classes Size Type Records Hours
AWID-ATK-F-Trn 10 Full Train 162,375,247 96
AWID-ATK-F-Tst 17 Full Test 48,524,866 12
AWID-CLS-F-Trn 4 Full Train 162,375,247 96
AWID-CLS-F-Tst 4 Full Test 48,524,866 12
AWID-ATK-R-Trn 10 Reduced Train 1,795,575 1
AWID-ATK-R-Tst 15 Reduced Test 575,643 1/3
AWID-CLS-R-Trn 4 Reduced Train 1,795,575 1
AWID-CLS-R-Tst 4 Reduced Test 530,643 1/3

Attributes

Each record includes 155 attributes, including the class attribute which denotes whether the record is normal or transmited during an attack.

Out of these attributes some are usefull for detecting attacks, some are just noise while some may prove misleading.

If an attribute does not apply to a specific record then value "?" is used.

The list of attributes can be seen here. For a full reference of the attributes please visit: https://www.wireshark.org/docs/dfref/f/frame.html


Class Distribution

Full Set
AWID-ATK-F-Trn AWID-ATK-F-Tst AWID-CLS-F-Trn AWID-CLS-F-Tst
12416 amok
1529284 arp
93011 authentication_request
170826 beacon
1860780 cafe_latte
817954 deauthentication
23598 evil_twin
1089 fragmentation
157749037 normal
117252 probe_response
3856 amok
500823 arp
34833 authentication_request
5498 beacon
16719 cafe_latte
22879 chop_chop
38359 cts
33870 deauthentication
34871 disassociation
27045 evil_twin
240 fragmentation
433750 hirte
47325477 normal
13551 power
10981 probe_request
8578 probe_response
13536 rts
1211459 flooding
1884378 impersonation
1530373 injection
157749037 normal
197933 flooding
477514 impersonation
523942 injection
47325477 normal


Reduced Set
AWID-ATK-R-Trn AWID-ATK-R-Tst AWID-CLS-R-Trn AWID-CLS-R-Tst
31180 amok
64609 arp
3500 authentication_request
1799 beacon
45889 cafe_latte
10447 deauthentication
2633 evil_twin
770 fragmentation
1633190 normal
1558 probe_response
477 amok
13644 arp
599 beacon
379 cafe_latte
2871 chop_chop
1759 cts
4445 deauthentication
84 disassociation
611 evil_twin
167 fragmentation
19089 hirte
530785 normal
165 power_saving
369 probe_request
199 rts
48484 flooding
48522 impersonation
65379 injection
1633190 normal
8097 flooding
20079 impersonation
16682 injection
530785 normal