## 7 Conclusions and Future Work  
This paper proposes an intrusion detection approach for a recent IoT dataset named IoTID20. The proposed approach and the value settings can be summarized as follows:  
* \(k\)-means clustering of the training data to three clusters
* Clusters reduction by 10% and then aggregation of the three reduced clusters
* Oversampling the aggregated data into an enlarged one using the SVM-SMOTE oversampling technique with an oversampling ratio value of 0.9
* Generating the classification model of the oversampled data by SLFN classification technique
* Evaluating the model using the testing data in terms of ACC, PREC, REC, and GM  
The effects of the data reduction with clustering, different oversampling techniques, and the selection of the classification technique were tested by the proposed technique. The aim of the reduction with clustering stage is to provide a mechanism to maintain a representative dataset but with reduced number of instances while minimizing the processing volume of the computation. On the other hand, the aim of the oversampling stage is to solve the problem of imbalanced dataset. Finally, the classification stage generates the classification model to classify instances into intrusion and normal activities. The results show that the combination of clustering the dataset with \(k\)-means++ into three clusters with a reduction by 10% and an oversampling by a ratio value of 0.9 with SVM-SMOTE technique is the best approach for producing high-quality results, and this approach outperforms the other approaches on the selected IoTID20 dataset.  
For future work, the other two labels presented by the dataset can be considered to detect the intrusion activity type and the sub type. Other unsupervised and supervised learning approaches can also be considered. In addition, different IoT intrusion detection datasets can be tested by the proposed approach.  
Conceptualization, H.F. and R.Q.; Methodology, H.F. and R.Q.; Validation, R.Q. and A.M.A.-Z.; Data curation, R.Q.; Writing--original draft preparation, R.Q., A.M.A.-Z., and I.A.; Writing--review and editing, R.Q., A.M.A.-Z., H.F., and I.A.; Supervision H.F.; and Project administration, I.A. and H.F. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding. The APC is funded by Prince Sultan University.  
Not applicable.  
Data Availability Statement: Data available in a publicly accessible repository at [[https://sites.google.com/view/iot-network-intrusion-dataset/home](https://sites.google.com/view/iot-network-intrusion-dataset/home)]([https://sites.google.com/view/iot-network-intrusion-dataset/home](https://sites.google.com/view/iot-network-intrusion-dataset/home)) (accessed on 26 March 2021). The data presented in this study are openly available at [[https://doi.org/10.1007/978-3-030-47358-7_52](https://doi.org/10.1007/978-3-030-47358-7_52)]([https://doi.org/10.1007/978-3-030-47358-7_52](https://doi.org/10.1007/978-3-030-47358-7_52)) (accessed on 26 March 2021) [29].  
**Acknowledgments:** The authors would like to acknowledge the support of Prince Sultan University for paying the Article Processing Charges (APC) of this publication.