###### Abstract  
Networks within the Internet of Things (IoT) have some of the most targeted devices due to their lightweight design and the sensitive data exchanged through smart city networks. One way to protect a system from an attack is to use machine learning (ML)-based intrusion detection systems (IDSs), significantly improving classification tasks. Training ML algorithms require a large network traffic dataset; however, large storage and months of recording are required to capture the attacks, which is costly for IoT environments. This study proposes an ML pipeline using the conditional tabular generative adversarial network (CTGAN) model to generate a synthetic dataset. Then, the synthetic dataset was evaluated using several types of statistical and ML metrics. Using a decision tree, the accuracy of the generated dataset reached 0.99, and its lower complexity reached 0.05 s training and 0.004 s test times. The results show that synthetic data accurately reflect real data and are less complex, making them suitable for IoT environments and smart city applications. Thus, the generated synthetic dataset can further train models to secure IoT networks and applications. intrusion detection system; machine learning; information security; IoT; CTGAN; advanced persistent threat +
Footnote †: journal:  
MQTT has weak authentication by default; usernames and passwords are sent in plain text. The network can intercept this format and then subscribe to any topic on the MQTT server. Another challenge faced by IoT devices is malware, which uses the configuration weakness of the MQTT protocol to subscribe to all messages and send them to a third party. IoT devices contain essential resources that are exchanged among networks. Researchers must improve protection methods and develop processes to protect these systems [3]. Several connected devices and the amount of data transmission in the IoT environment can be exploited by advanced persistent threat (APT) groups to hide inside an IoT network and avoid detection [4]. In an insider attack scenario, the APT gains control of an authorized device via social engineering, scanning, and brute forcing (see Figure 1). The multistage nature of an APT attack leads to difficulties in capturing the complete stages of intrusion datasets [5]. These attacks aim to maintain long-term access inside the network, control the system, and gain information in the long term [6]. Consequently, security and privacy solutions for IoT, particularly ML algorithms, need further investigation to overcome the multistage nature of APT attacks. The selection of proper ML algorithm pipelines and fine-tuning parameters is essential for achieving maximum data exchange protection in IoT networks. Although researchers know that some ML algorithm pipelines are superior in intrusion detection accuracy, these algorithms require more training and testing time on large datasets. Moreover, researchers have documented that model-building time is a crucial aspect of predicting real-life intrusions [7]. A delay in the IDS can compromise IoT networks over a lengthy period before raising an alert. Therefore, timely classification is vital to guarantee the rapid detection of attacks and ensure that the IDS has a fast data stream monitoring capability. Time plays a crucial role in detecting attacks on high-speed IoT networks with large volumes of data. Thus, a practical real-time IDS is desirable for detecting intrusion. The scientific literature has presented several effective ML algorithm pipelines for protecting networks, including search methods, feature reduction, selection methods, and classifiers [8; 9]. The MQTT protocol is generally adopted for smart IoT networks. The MQTT dataset can be used to train ML algorithms to protect IoT networks [10]. Combining IoT datasets can identify an appropriate ML algorithm pipeline that is fully designed to protect smart IoT networks in simulation and real-life scenarios.