## 3 Datasets and Methods Used in SATIDS
### Database Description
#### 3.1.1 ToN-IoT Dataset  
The ToN-IoT dataset is obtained from a practical and large-scale network developed by the UNSW Canberra Cyber IoT Lab [11]. The dataset contains a range of routine and cyberattack events from IoT networks. A newer testbed was built at the same IoT lab to connect a range of virtual computers, physical tools, hacking systems, cloud and fog systems, and IoT sensors to simulate the functionality and scalability of the automotive  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Ref.** & **Technique** & **Dataset** & **Accuracy** \\ \hline
[8] & Trustworthy privacy-preserving secure framework for intelligent cities is presented using three modules: a trustworthiness module, a two-level privacy module, and an intrusion detection module & ToN-IoT & 98.84\% \\ \hline
[10] & Ensemble learning and fog-cloud architecture-driven cyberattack detection framework for IoMT networks & ToN-IoT & 99.99\% \\ \hline
[13] & Hyper approach based on LSTM autoencoder and one-class support vector machine to detect anomaly based attacks in an unbalanced dataset & InSDN & 96.3\% \\ \hline
[14] & Secured privacy-preserving framework (SP2F) for smart agricultural UAV & ToN-IoT & 99.77\% \\  & & IoT Botnet & 99.98\% \\ \hline
[15] & CNN technique with L2 regularization and the dropout methods to address the overfitting problem & InSDN & 90.5\% \\ \hline
[16] & Deep learning model for bot detection that uses a novel cascade forward back propagation neural network model with a subset of features using the correlation-based feature selection & NF-UNSW-NB15 NFToN-IoT - \\  & (CFS) technique & NF-CSE-CIC IDS2018 ToN-IoT-Windows & \\ \hline
[17] & A machine learning based block chain method is proposed for protecting IoT network & ToN-IoT & - \\ \hline
[18] & A newly developed intrusion detection system that relies on machine learning and deep learning techniques to identify new attacks in an IoT environment & ToN-IoT-Windows & 98.39\% medium neural network \\ \hline
[19] & The suggested model extracts the features of recurrent model hidden layers and then uses a kernel-based principal component analysis (KPCA) feature selection strategy to find the best features. Finally, the best features of the recurrent models are combined, and classification is performed with an ensemble meta-classifier & ToN-IoT-Windows & 98.22\% weighted KNN \\ \hline
[19] & The suggested model extracts the features of recurrent model hidden layers and then uses a kernel-based principal component analysis (KPCA) feature selection strategy to find the best features. Finally, the best features of the recurrent models are combined, and classification is performed with an ensemble meta-classifier & ToN-IoT-Windows & 99\% in network attacks detection \\ \hline \hline \end{tabular}
\end{table}
Table 1: Cont.  
IoT and Enterprise 4.0 networks. This generated dataset contains different recent smart city-based attacks such as DoS, DDoS, and ransomware. These attacks have been deployed against web applications, IoT gateways, and computer systems across the IoT network.  
This dataset contains 43 features with 461,043 total observations divided into 300,000 normal and 161,043 attack observations. The dataset was divided into 70% and 30% for train and test sets, respectively. Table 2 shows the statistic of normal traffic and different attack vectors as presented in the dataset [10].