## 3 IoT Attack Classification Mechanism
### Dataset Collection  
The BoT-IoT dataset [24] was created by designing a real network environment in the Cyber Range Lab of UNSW Canberra. The network environment includes four attack virtual servers and one normal virtual server to present normal traffic and botnet traffic. IoT devices use Node-red [25], a visual programming language development tool based on process programming, to connect to normal servers and transmit data traffic through message queuing telemetry transport (MQTT). Data traffic is simulated using Ostinato [26]. The number of records in each class in the BoT-IoT dataset is shown in Table 2. There are five classes in the dataset, namely denial of service attack, distributed denial of service attack, reconnaissance attack, theft attack, and normal. The first four are attack categories, and the last one is a normal category. \begin{table}
\begin{tabular}{c c c c c} \hline
**Reference** & **Dataset** & **Method** & **Accuracy \({}^{*}\)** & **Remark** \\ \hline
[14] & UNSW-NB15 & LSTM*2 & 96.3\% (B) & Based on the two datasets, the DDoS and DoS attack categories of the TCP protocol are captured and merged into new data, and the output is alert, DDoS, and DoS. \\
[15] & CIC DDoS-2019 & LSTM & LSTM: 99.46\% (B) & Based on different LSTM layers, the impact of binary classification and multivariate classification is analyzed. \\
[16] & CIC DDoS-2019 & GRU & 99.7\% (M) & Analyze different DDoS attack categories based on GRU. \\
[17] & WSN-DS & & WSN-DS: 97.91\% (B) & Zero-day attack binary classification analysis based on bidirectional GRU analysis. \\
[17] & UNSW-NB15 & GRU & UNSW-NB15: 98.92\% (B) & Analysts based on bidirectional GRU analysis. \\  & KDD CUP99 & & KDD CUP99: 98.23\% (B) & LightGBM: binary classification of categories. \\
[18] & CSE-CIC-IDS2018 & LightGBM + CNN & 99.896\% (M) & CNN: First perform IR-SMOTE on the data to balance the categories of the multivariate classification. \\
[20] & BoT-IoT & GANs + AE & AE: 92.97\% (B) & Anomaly detection is based on the merger of GANs and AE. \\  & KDD99 & & AE + GAN: 97.11\% (B) & Based on the CGAN architecture, data augmentation of imbalanced data is performed, and then FNN is used for multivariate classification. \\
[21] & NSL-KDD & & NSL-KDD: 95.46\% (M) & \\  & Bot-IoT-IoT & & Bot-IoT: 77.01\% (M) & Based on the CGAN architecture, data augmentation of imbalanced data is performed, and then FNN is used for multivariate classification. \\
[21] & IOT Network Intrusion & CGANs + FNN & IOT Network Intrusion: 97.21\% (M) & Based on the CGAN architecture, data augmentation of imbalanced data is performed, and then FNN is used for multivariate classification. \\  & MQTT-IOT-IDS2020 & & MQTT-IOT-IDS2020: 93.40 (M) & \\  & MQTT set & & MQTT set: 97.30\% (M) & \\  & IOT-23 & 64.17\% (M) & \\  & USW-NB15 & WGAN + DNN & & GSNs based on Wasserstein distance are used to improve imbalanced data and are used together with AE to analyze and evaluate the performance of each model. \\
[22] & NSL-KDD & & USNW NB15: 87\% (M) & \\  & CTU-IoT & WGAN + LSTM & NSL-KDD: 93.2\% (M) & \\  & Real-word data & DNN + AE & & \\  & & CNN + AE & & GAN-based methods can generate features similar to real data and compare them with MLP models in deep learning, reducing the training time of large amounts of data in the past. \\
[23] & BoT-IoT & GAN + MLP & 82.25\% (M) & \\  & & & & \\ \hline \end{tabular} \({}^{*}\) (B)\({}^{*}\) is binary classification; \({}^{*}\)(M)\({}^{*}\) is multivariate classification.  
\end{table} 
Table 1: _Cont._* Denial of service (DoS) attack [1]: A DoS attack is a malicious attempt to disrupt the normal functioning of a network, system, or online service by overwhelming it with a flood of illegitimate traffic or requests. The primary objective of a DoS attack is to make the targeted resource unavailable to its intended users, causing a denial of service. The two key characteristics of DoS attacks are overloaded resources and various attack vectors.