## 3 Datasets and Features
### Datasets  
The NB15 dataset [4] comprises 100 GB of raw network traffic, organized in over two million registered traffic records. It contains nine types of attacks and the _Benign_ traffic class that remarkably dominates over the harmful traffic classes. Apart from the original raw traffic data, the dataset contains 49 features for each traffic sample. The dataset has been used in many research projects related to both enterprise and industrial traffic.  
The IDS18 dataset [5] includes traffic generated by multiple devices, such as Windows, Linux, and MacOS-based machines, as well as various servers and client systems. The attacks are categorized into six different types. The dataset also includes regular, benign traffic representing typical user behavior in an enterprise network. The dataset initially included 80 features extracted from the captured traffic.  
The ToN dataset [7] is a collection of data for the evaluation of cybersecurity applications in the context of the Internet of Things (IoT) and Industrial IoT (IIoT). It is designed to assess the performance of various AI-based cybersecurity applications, including intrusion detection systems, malware detection, and threat intelligence. The dataset includes diverse data sources, such as network traffic data (captures the communication between devices in the IoT/IIoT network), telemetry data (logs from various IoT devices, capturing their operational states and activities), operating system logs (collected from systems involved in the IoT/IIoT environment, such as edge and cloud systems), and application logs (contains  
\begin{table}
\begin{tabular}{l c c c c} \hline
**Class** & **BoT** & **IDS18** & **NB15** & **ToN** \\ \hline Analysis & 0 & 0 & 0.1 & 0 \\ \hline
**Backdoor** & 0 & 0 & **0.09** & **0.1** \\ \hline
**Benign** & **0.36** & **88.05** & **96.02** & **36.01** \\ \hline Bot & 0 & 0.76 & 0 & 0 \\ \hline Brute Force & 0 & 0.66 & 0 & 0 \\ \hline
**DDoS** & **48.54** & **7.36** & 0 & **11.96** \\ \hline
**DoS** & **44.15** & **2.56** & **0.24** & **4.21** \\ \hline Exploits & 0 & 0 & 1.32 & 0 \\ \hline Fuzzers & 0 & 0 & 0.93 & 0 \\ \hline Generic & 0 & 0 & 0.69 & 0 \\ \hline Infilteration & 0 & 0.62 & 0 & 0 \\ \hline
**Reconnaissance** & **6.94** & 0 & **0.53** & 0 \\ \hline Shellcode & 0 & 0 & 0.06 & 0 \\ \hline Theft & \(<\)0.01 & 0 & 0 & 0 \\ \hline Worms & 0 & 0 & \(<\)0.01 & 0 \\ \hline Injection & 0 & \(<\)0.01 & 0 & 4.04 \\ \hline Mitm & 0 & 0 & 0 & 0.05 \\ \hline Password & 0 & 0 & 0 & 6.81 \\ \hline Ransomware & 0 & 0 & 0 & 0.02 \\ \hline Scanning & 0 & 0 & 0 & 22.32 \\ \hline XSS & 0 & 0 & 0 & 14.49 \\ \hline \end{tabular}
\end{table}
Table 1: Percentages of the total number of samples belonging to particular classes in each dataset (columns sum up to approx. 100% as tiny amounts are neglected, co-occurring classes in bold).  
data generated by applications running on IoT/IIoT devices). The dataset includes nine cyber-attacks that are relevant to IoT/IIoT environments.  
The BoT dataset [6], similarly to ToN, focusing on the IoT traffic, contains over 72 million records stored initially in pcap files. The testbed environment included typical IoT devices like smart lights, motion sensors, and other smart appliances. The dataset includes a range of cyber attacks relevant to IoT environments that are categorized into four main types and benign traffic. The dataset originally included 42 features extracted from the network traffic representing various aspects of network communication.