## 3 Materials and Methods
### The DNN-EdgeIoT Dataset  
The proposed CNN-based intrusion detection system was evaluated using the DNN-EdgeIIoT dataset [7], a comprehensive benchmark generated from a specialized IoT/IIoT testbed. This testbed incorporates diverse devices and protocols, including low-cost digital sensors (e.g., temperature, humidity, ultrasonic, water level, soil moisture, heart rate, and flame sensors), actuators, and edge/cloud configurations. The dataset comprises 2,219,201 connection samples, representing both normal communication traffic (72.8%) and 14 attack types (27.2%) relevant to IoT/IIoT environments. These attacks are categorized into five primary threat groups: DoS/DDoS, Man-in-the-Middle (MITM), injection, malware, and scanning-based attacks, with further sub-types such as DDoS_UDP, SQL_injection, and ransomware.  
1. _Dataset Structure and Features_: Each sample corresponds to a unique traffic flow characterized by 63 features extracted using Zeek 4.0.1 and TShark 3.4.4 protocol analyzers. These features include the following: * _Protocol-specific attributes_: Packet rates, connection duration, protocol type (e.g., MQTT, HTTP, DNS), payload size, and flow state flags. * _Statistical metrics_: Mean/standard deviation of packet intervals, bytes transmitted, and system resource usage (CPU, memory). * _Behavioral indicators_: Alerts triggered during communication (e.g., suspicious port access, malformed packets).
2. _Labels and Classification Tasks_: The dataset includes the following two labels: * _Attack label_: Binary classification (0 = normal, 1 = attack). * _Attack type_: Multiclass classification, specifying the exact attack type (e.g., DDoS_ICMP, XSS). This allows the problem to be approached as binary (2-class), grouped (6-class), or fine-grained (15-class) classification, with distributions detailed in Tables 1-3.
3. _Data Splitting and Attack Identification_: To ensure balanced evaluation, the dataset was partitioned using stratified random sampling, as follows: * Training set: A total of 1,775,361 samples (80%--1,615,643 normal, 603,558 attacks). * Test set: A total of 443,840 samples (20%--272,800 normal, 109,134 attacks).  
Each traffic flow is self-contained, enabling real-time intrusion detection without requiring sequential analysis. For instance, DDoS attacks are identifiable through abrupt packet rate spikes, while SQL injections are flagged via anomalous payload patterns.  
This dataset's realism, protocol diversity, and granular feature engineering make it uniquely suited for evaluating spatial and temporal attack behaviors in IoT/IIoT networks.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Classes** & **Samples** \\ \hline
**Normal** & 1,615,643 \\ \hline
**Attack** & 603,558 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Distribution of 2-class samples.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Classes** & **Samples** \\ \hline Normal & 1,615,643 \\ \hline DDoS-based attack & 337,977 \\ \hline Injection-based attack & 51,203 \\ \hline MITM-based attack & 1214 \\ \hline Malware-based attack & 10,925 \\ \hline Scanning-based attack & 22,564 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Distribution of 6-class samples.