## 5 Data  
In light of the compelling diversity found in its collection environment, paralleling the complexity inherent in the Internet of Things (IoT) milieu, this study employs the ISOT Cloud Intrusion Detection Dataset (ISOT-CID) for IIoT data.  
The distinguished ISOT Cloud Intrusion Detection Dataset, as expounded by [PERSON] et al. [39; 40], is a richly diverse assemblage of data accrued in two separate stages. This data repository embodies a wide spectrum of cloud strata, such as guest hosts, hypervisors, and networks, embodying an array of data types culled from a variety of sources. These sources comprise system logs, resource (for instance, CPU) utilizations, network traffic, system call traces, and memory dumps. It accommodates traces of an array of attacks, including masquerade, denial of service, stealth operations, irregular user actions, and both external and internal data assaults. The principal aim of assembling this dataset was to foster the creation and appraisal of an extensive variety of intrusion detection system (IDS) models. The dataset is methodically categorized, embracing a fusion of both normal and malevolent activities.  
As referenced earlier, the ISOT-CID dataset enfolds a wide array of attacks recognized as principal threats in the sphere of cloud computing. These onslaughts, which transpired across both the application and network layers, sprouted from both within and outside the cloud. They encompass key categories such as breaches of authentication, denial of service (DOS), backdoors, remote-to-local (R2L), input validation, probing, and information disclosure.  
Considering the primary focus of this study is on the IoT network, the network traffic of the ISOT-CID dataset was conscientiously chosen for evaluating the proposed methodologies. The dataset integrates three distinctive network flows: local traffic, internal, and external. The external signifies the communication between the virtual machine and an external machine (referred to as \"instance-outside\" traffic). The internal traffic represents the interaction between one computation unit and another, denoted as \"hypervisor-hypervisor\" traffic, while the local traffic stands for the exchange of information between two instances situated on an identical compute node, which is termed as \"instance-instance\" traffic. The network traffic encapsulates a sum total of 22,372,418 network packets for the initial phase, out of which 22,356,769 packets are harmless, with 15,649 deemed harmful. In the second phase, the dataset subsumes an aggregate of 11,509,254 network packets, with 9,502,872 packets being innocuous and 2,006,382 identified as harmful.  
For the sake of simplicity and to facilitate the implementation of the proposed solution, only a subset of the data features was considered. These included those indicative of the primary network properties of the flows, such as the IP addresses and port numbers of flow source and destination, along with the type of the communication protocol. Additionally, the time and date marking the start and end of the flow burst were included, as well as the total number of transmitted and received data packets. Each instance of the dataset is labeled with a value representing its class.