## 3 Generating a Lightweight IoT Dataset
### Machine Learning Classification  
The generated dataset was validated based on accuracy and training/testing times using several widely used ML classification methods, decision trees, Naive Bayes, RF, MLP, gradient boost, XGBoost, and LightGBM. Considering the hyperparameters of the classifiers, a default configuration setting was applied for RF, decision tree, XGBoost, LightGBM, and Gaussian Naive Bayes. For gradient boost, it is configured with a maximum estimator of 20. The MLP classifier had 130 max iterations and a batch size of 1000; \"relu\" was used for the activation function, and \"adam\" was used as the solver. The system configuration \begin{table}
\begin{tabular}{c c} \hline \hline
**CTGAN Parameters** & **Values** \\ \hline Epochs & 50 to 100 \\ Generator learning rate & 0.0002 \\ Discriminator learning rate & 0.0002 \\ Generator dimension & (256, 256) \\ Discriminator dimension & (256, 256) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: CTGAN parameters configurations. was 2.20 GHz Intel(R) Xeon(R) and 13 GB of RAM. The training and testing times were calculated as the mean values of five classification runs, as presented in Algorithm 1. Each classifier was trained individually, and the performance metrics used were accuracy, which shows the total performance of correct predictions by the classifier; the F1 score, which is a combination of precision and recall; and training and testing times in seconds, which implies the complexity of the classification process. The description of the performance metrics is as follows: true positive (TP), which comprises the attack instances that are detected correctly as an attack; true negative (TN), which comprises the normal instances that are detected correctly as normal; false positive (FP), which comprises the normal instances incorrectly recognized as an attack; and false negative (FN), which comprises the attack instances that are incorrectly identified as normal. The performance metrics can be determined using the following formulas:  
\[Accuracy=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{FN}+\text{FP}+\text{TN}} \tag{2}\]  
\[F1\;score=\frac{2\text{TP}}{2\text{TP}+\text{FP}+\text{FN}} \tag{3}\]  
Considering the time performance, training time is the time of fitting the train data in the classifier, and the testing time is the time of using the classifier to predict the labels using the test data. Additionally, to further improve the classification performance in terms of training and testing times, lightweight IoT devices were fitted by reducing the complexity of training and testing and by obtaining a dataset containing only important features. Thus, a filter-based feature selection method was applied to the dataset, which can be used without compromising classification accuracy [43]. The filter-based feature selection used was an information gain method, and SelectkBest was used for the search method [44]. Figure 3 shows the importance score for the best 15 features according to filter-based correlation. In this research study, 5, 10, and 15 of the best features were evaluated to study the change in using the different number of features. Figure 3: Importance score of the best 15 features according to feature selection. Figure 4 summarizes and visualizes the steps of the methodology. Diverse datasets were selected to cover a broader number of attacks from the TON_IoT, MQTT-IoT-IDS2020, and Bot-IoT datasets, with 12 attacks and normal traffic. Then, feature extraction was performed using the raw PCAP files and the \"tshark\" tool. The features were defined and labeled in the dataset according to the IP addresses of the attackers. Next, a filter-based feature selection method was used to universalize the features among the selected datasets. The three datasets were linked to one dataset using the \"concatenating\" data-combining method, and the total number of instances was 335,170.