## 3 Generating a Lightweight IoT Dataset
### Dataset Generation  
This study used the CTGAN model to generate synthetic data that resemble real data. The CTGAN model is a powerful tool for deep learning. It estimates a generative model using an adversarial approach. It has shown promising results in the generation of text, images, and tables. It uses two neural networks, a generator and a discriminator, which operate together to produce outputs of improved quality. The generators were trained using real-world data to produce synthetic data that resembled real data. The discriminators checked the generated data to determine whether they were real. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Reference**} & \multicolumn{4}{c}{**Applied ML Algorithms**} & \multirow{2}{*}{**Datasets**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Training/ Testing Time** **(Seconds)**} \\ \cline{2-2} \cline{6-6}  & & **Preprocessing** & & & & & \\  & & **Selection** & & & & \\ \hline [PERSON] & Normalization, balancing, and & & Multi-layer & AWID & 0.97 & 73.52/n/a \\ et al. [17] & numerical transforming & IG & perceptron (MLP) & NSL-KDD & 0.99 & 36.28/n/a \\ [PERSON] et al. [16] & Normalization, balancing, and & CFS-BA-ensemble & Forest & AWID & 0.99 & 92.62/n/a \\  & filtration & ensemble & PA-ensemble & CIC-IDS2017 & 0.99 & 98.42/n/a \\ [PERSON] et al. [15] & n/a & CST-GR & J48 & Bot-IoT & 0.99 & 8.61/0.81 \\ [PERSON] & Nominal to numerical, log & Modified & & & & \\ et al. [20] & normalization & rank-based & SVM & NSL-KDD & 0.99 & 56.603/2.094 \\ [PERSON] & Cleaning, visualization, feature & IG & Stacking & UNSW-NB15 & 0.96 & 25.6/5.70 \\ et al. [21] & engineering, and vectorization & IG & ensemble & CIC-IDS2017 & 0.99 & 27.09/4.19 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summarization of ML-based IDS studies that considered the model’s time performance, with ’n/a’ indicating studies that did not evaluate testing time. CTGAN is represented in the SDV open-source library [36]. Proposed by [34], CTGAN is a deep learning model that uses a conditional generator to generate synthesized tabular datasets that are similar to real datasets. To validate the performance of the dataset generated by CTGAN, classifier efficiency metrics, which are represented by SDV [37] as a single table metric, are used to reveal whether the generated dataset can be used to replace the real dataset. CTGAN was employed on a comprehensive IoT attack dataset to generate a new intrusion dataset. The comprehensive IoT attack dataset is a collection of the TON-IoT, MQTT-IoT-IDS2020, and Bot-IoT datasets and covers more attack stages. The TON-IoT is a dataset collected from a realistic IoT environment. This dataset was presented by UNSW Canberra Labs to solve IoT dataset challenges for an efficient IDS [38]. The MQTT-IoT-IDS2020 dataset focuses on the MQTT protocol, which is widely adopted by IoT environments. The dataset contains MQTT-based attacks, which comprise aggressive scan (Scan A), user datagram protocol (UDP) scan (Scan sU), Sparta SSH brute force (Sparta), and MQTT brute-force attack (MQTT BF) [10]. The last dataset used is Bot-IoT, which is collected from legitimate and simulated IoT network traffic. It includes information gathering, denial of service, and information theft attacks [39]. The features extracted from the raw PCAP format files of these datasets were analyzed using \"tshark,\" which is a tool for capturing and reading network packets [40]. This tool allows each feature to be defined individually in order to identify commonalities. The selected features were universalized among several datasets; therefore, the detection performance was not limited to one specific dataset [11]. Then, the CTGAN model was trained using 50 to 100 epochs to select the highest test score according to the statistical verification metric to generate a dataset that contains several attacks and stages, and it represents the real dataset. The generator and discriminator's learning rate was set to 20,000 and their dimensions were (256, 256) (Table 2).