## 5 Conclusions and Further Research  
The proposed methodology can generate a synthetic dataset that researchers and security professionals can use to detect and prevent attacks like APT. Additionally, the method can also help solve the challenge of collecting data from a system and storing them in large storage devices, which is a challenging task when dealing with attacks in low-resource IoT environments. The experimental results showed that we could replace the generated dataset with a real dataset. This replacement would not affect the system's accuracy and might even improve it, as shown by the Naive Bayes classifier. This could have important implications for future research as it would allow researchers to use more confidential data while maintaining high accuracy levels, and they can utilize this method to promote the efficiency of the IDS using large amounts of data. The findings of the TSTR and statistical metrics, KS test, MAE, and RMSE suggest that CTGAN is a promising tool for generating a synthetic dataset that is similar to the real dataset. Additionally, it generates a balanced dataset by increasing the number of attacks with fewer instances.  
Applying classifier efficiency metrics reveals that CTGAN synthetic datasets can be used for classification tasks. As the results indicated, using RF and decision trees provided high accuracies of 1.0 and 0.99, respectively. Moreover, as described in the second section, many existing studies have focused primarily on the performance of classification algorithms while neglecting other important factors, such as classification time. Thus, the results indicated that using the filter-based feature selection method reduced the training and test times to fit lightweight IoT devices without affecting accuracy. This study mainly involves generating a dataset for IoT devices that are applied in smart cities, which face difficulties in collecting a training dataset for machine learning algorithms. In future studies, the generated dataset could be tested in a real-world IoT network and compared with real-world datasets. Moreover, further investigation could be performed using multiclass classification to evaluate the performance of each attack. The limitation of CTGAN is that it has not been compared with advanced large language models like GPT-4. In addition, it does not include all attack scenarios that occur in IoT environments, and it is not assessed for zero-day attacks.  
Conceptualization, S.A. and Y.S.; methodology, S.A.; software, S.A.; validation, S.A.; formal analysis, S.A.; investigation, S.A.; resources, S.A.; data curation, S.A.; writing--original draft preparation, S.A.; writing--review and editing, Y.-T.K., A.S. and Y.S.; visualization, S.A., Y.-T.K. and A.S.; supervision, Y.S.; project administration, Y.S.; funding acquisition, Y.S. All authors have read and agreed to the published version of the manuscript.  
This work was supported by the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (No. 2020R1A2C1013296, No. 2018R1A5A7023490), in part by the MSIT (Ministry of Science and ICT), Korea, under the ITRC (Information Technology Research Center) support program (IITP-2023-2020-0-01789) supervised by the IITP (Institute for Information and Communications Technology Planning and Evaluation).  
Data Availability Statement: Data sharing not applicable.  
The authors declare no conflict of interest.