# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 5 Overview of Reviewed Datasets for ML-Powered IDS
As is noted, in one case [32], no dataset was specified whatsoever. The 53 papers that included public datasets are listed in Table 4, alongside their year of publishing, the number of both records and features, as claimed by the authors, and whether DDoS was included as an attack. What must be noted is that due to the high variance in the way these datasets are structured and created, some values in the table may represent an approximation of such values. Furthermore, among the papers that included public datasets, on three occasions [38; 39; 54], the paper also made use of self-generated or private datasets on top of the public one to enhance or diversify the data or for testing purposes. In the cases where self-generated or private datasets were used, the description of how these datasets were acquired varied heavily. For example, Ref. [84] creates a tool that is a network traffic generator for IoT devices and tests the proposed tool as well as the generated malicious and benign data in the paper. In other cases [37; 38], the paper describes which existing tools were used to gather the data points and gives a general idea of the number of flows, features, and/or traffic types that are a part of the dataset. The overwhelming majority of papers carried out some form of data processing, e.g., feature filtering or extraction, as the typical first step. In general, the papers chose a subset of both the features and flows available in the dataset. In fact, this step seems to be the foundation in the entire domain of ML-based IDSs, as several papers [40; 78] were primarily written with the purpose of proposing improved data preprocessing. One particular paper [72] stands out from the rest as a standard dataset was used, but the network traffic data were turned into images, and computer vision ML was utilised to identify DDoS attacks. Figure 1: Dataset distribution among reviewed papers. Among the papers, there were several common themes repeated. Firstly, we found that multiple noted the general lack of publicly available, quality IoT datasets to be used in their research. The stated reason for lacking datasets was privacy, as large companies tend to not wish to share their data with researchers [85]. In particular, in cases where an industry-specific IoT device network traffic was necessary, the papers claimed there to be no available datasets, which typically resulted in them creating and publishing their own, as was the case for MedBIoT [51], or self-generating a private dataset, as the paper with a focus on smart agriculture did [86]. Further concerns were noted regarding unbalanced datasets that may have an uneven benign-to-attack traffic ratio or unlabeled datasets. While the majority of the reviewed datasets explicitly included DDoS attacks, a small subset did not specify their presence, instead relying on DoS or other flooding attacks that may serve as proxies for DDoS. As shown in Table 4, most studies in our survey utilized datasets that explicitly feature DDoS attacks. In contrast, a few older or industry-specific datasets, such as X-IIoTID [87], MedBIoT [51], and KDDCUP 1999 [88]--which are also relatively infrequent in the literature--either lacked explicit DDoS attack labels or did not provide sufficient information to confirm their inclusion. From Figure 1, we observe the most popular datasets to be BoT-IoT [26], TON_IoT [85], and CIC-IDS2017 [89]. Other CIC datasets are also seen among the most popular datasets. For the sake of brevity and clarity, TON_IoT and Bot-IoT will be described in greater detail alongside the CIC datasets, with a special focus on CIC-IDS2017.