## 4 Experimental Approach  
To verify an IDS, testing data are required. Due to security and privacy issues, it is difficult to gain genuine interest in commercial products. Datasets such as KDD, DRPA, NDS-KDD, and ADFA-LD are accessible. Scientists often use them as guides. For this, we use the IoT-23 Dataset. The most recent dataset, IoT-23 [15], was constructed from real-world commercial IoT network data. The IoT component here represents the EVCS as an IoT system. Twenty malicious and three benign traffic samples from IoT devices are included in the collection. The Stratosphere Lab of the Czech Republic, with help from Avast Software of Prague, published the dataset in 2020. The twenty scenarios that make up the IoT-23 dataset are meant to represent the malicious traffic that might result from different attacks on the IoT network. There are labels for every possible outcome. The IoT-23 dataset also features three examples of regular (i.e., not infected) Internet of Things traffic. IoT-23 refers to the overall number of cases, which is twenty-three. On the other side, Machine Learning and Deep Learning have been widely employed recently to help find anomalies [22; 23]. The difficulty lies in deciding which algorithm is the most suitable. The goal is a precise solution with little computational overhead. This helps with real-time attack detection and stopping dangerous communications. Machine learning classifiers must be accurate even when trained with a small number of data \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Ref.** & \multicolumn{3}{c}{**Method Used**} & \multicolumn{3}{c}{**Dataset**} \\ \hline  & \begin{tabular}{c} **Machine** \\ **Learning** \\ \end{tabular} & \begin{tabular}{c} **Deep** \\ **Learning** \\ \end{tabular} & \begin{tabular}{c} **TON\_IOT** \\ \end{tabular} & \begin{tabular}{c} **CICIDS** \\ \end{tabular} & \
\begin{tabular}{c} **IOT-23** \\ \end{tabular} &
\begin{tabular}{c} **KDD CUP 99** \\ \end{tabular} \\ \hline
[11] & ✗ & ✓ & ✓ & ✗ & ✗ & ✗ \\ \hline
[12] & ✓ & ✓ & ✗ & ✗ & ✗ & ✗ \\ \hline
[13] & ✗ & ✓ & ✗ & ✓ & ✗ & ✗ \\ \hline
[14] & ✓ & ✗ & ✗ & ✗ & ✓ & ✗ \\ \hline
[15] & ✓ & ✗ & ✗ & ✗ & ✓ & ✗ \\ \hline
[16] & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline
[17] & ✓ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline
[18] & ✓ & ✗ & ✗ & ✓ & ✗ & ✗ \\ \hline
[19] & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline
[20] & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison between the different approaches and datasets used to secure IoT systems. Figure 4: Dataset distribution used in the literature for securing IoT systems. points, meaning that they can make the right judgment with minimal data. Unsupervised learning algorithms are widely used to counteract unknown attacks (zero-day attacks). However, one of the drawbacks of using unsupervised learning algorithms is that they have a high false alarm rate and a low detection rate. To the best of our knowledge, the highest performance obtained by unsupervised learning techniques does not exceed 90%, which is insufficient for defending against unknown attacks. Implementing supervised learning algorithms, on the other hand, can achieve a high performance of 99% or higher. The obtained performance is comparable to signature-based intrusion detection systems (e.g., snort). To overcome this problem, regularization techniques are the solution to this dilemma. They can be used to simplify the system and overcome the overfitting problem in supervised learning [24], and thus supervised learning algorithms can outperform unsupervised learning algorithms for the same problem. Different regularization techniques, namely L1 and L2 [25], have been used to address the issue of overfitting and improve the detection capability of network-based intrusion detection systems. When developing more comprehensive models, it is also important to avoid overfitting the data, which is why randomization of the data is required. To maintain uniformity, we subjected the same reshuffled dataset to two classification algorithms described hereafter.