# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 5 Overview of Reviewed Datasets for ML-Powered IDS  
Different datasets are necessary to train and test the machine learning algorithms, which are the foundation of this literature review. This chapter aims to examine the data more closely, highlighting the most used datasets, exploring them in more detail, and identifying some common patterns and differences between them. All papers in this survey were reviewed, and different insights came from this research. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Paper** & **Network Type** & **Deployment Strategy** & **Data Source** & **IDS Detection Location** & **Response Timing** \\ \hline
[45] & BIN & Fog cloud IDS & Nodes + Blockchain host & on site & instant \\
[46] & BIN & Separate blockchain network & Nodes + Blockchain host & on site & instant \\
[47] & BIN & Transactions in blockchain blocks & Blockchain network & on site & instant \\
[48] & BIN & Gateway with blockchain network access & Gateway traffic & on site & instant \\
[49] & BIN, smart city & Device+network & Blockchain Authentication & on site & instant \\
[39] & Edge–IIoT & Flow controller Edge server & Edge–IoT devices & on site & instant \\
[40] & Edge, Sensors & IDS installed on cloud servers & Sensors & off site & after analysis \\
[43] & Edge–IIoT, & Sensor traffic-based & Sensors & off site & after analysis \\
[28] & General & Fog layer & IoT/non-IoT & - & - \\
[29] & General & Fog computing & - & - & - \\
[59] & General & Network firewall & - & - & - \\
[60] & General & Dedicated ML server & - & - & - \\
[30] & General & Fog/cloud layer+IoT gateway & Gateway traffic & on site & instant \\
[57] & General & Cloud layer ML training via Spark & IDS in edge layer & on site & instant \\
[52] & IOV & Intra/inter-vehicle data & Combined & - & - \\
[53] & IOV & VANET servers & Dataset based & - & - \\
[51] & medium-sized network & Monitoring server separately & Monitoring server & off site & after analysis \\
[50] & medium-sized network & Monitoring server separately & Monitoring server & off site & after analysis \\
[44] & WSN, MQTT & Integrated IDS & IoT devices & on site & after analysis + instant \\ protocol & & & & \\
[32] & SDN WISE & SDN WISE controller & SDN traffic data & on site & instant \\
[10] & SDN & SDN data + application plane & SDN traffic data & on site & instant \\
[36] & SDN & SDN control + application layer & SDN traffic data & on site & instant \\
[31] & SDN & SDN control plane & SDN traffic data & on site & instant \\
[33] & SDN & SDN control plane & SDN traffic data & on site & instant \\
[37] & SDN & SDN application layer & SDN traffic data & on site & instant \\
[34] & SDN WISE & SDN WISE control plane & SDN traffic data & on site & instant \\
[35] & ON & Decentralized IDS + SDN data plane & SDN traffic data & on site & instant \\
[38] & ON, Edge & Edge servers & Gateway traffic & on site & instant \\
[54] & WSN, Home & IoT gateway & Gateway traffic & on site & instant \\  & built & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Studies assessed by their IDS deployment (only including ones that focused, or made remarks about, infrastructure). Datasets are usually made up of one or more files that may represent a specific file or attack type. The most common file types are pcap, csv, and txt. These files may have the same number of features, records, and benign/attack flows, constituting a balanced dataset; however, unbalanced datasets are far more common. From our research, only the Edge_IIoT dataset [83] came close to being considered balanced, the sole one out of the eight most popular datasets used according to Figure 1. Using imbalanced datasets may lead to biased trained models, though depending on the specifics of the ML algorithm and data preprocessing, this does not have to be the case. Generally, datasets can be divided into public and private, that is, those one can openly access and use and those one cannot. Figure 2 showcases how many papers utilized public or private datasets, excluding the papers that only include literature reviews.