## 3 Dataset Descriptions  
### ToN-IoT Dataset  
The ToN-IoT dataset [25] is intended to collect and analyze mixed data sources from the IoT and IIoT, and it contains heterogeneous data collected from different sources, including telemetry data from connected devices, Windows and Linux system logs, and system network traffic. The Internet of things is compiled from a realistic network. To evaluate the accuracy and efficiency of various cybersecurity applications based on artificial intelligence, the ToN-IoT dataset is designed to connect many virtual machines, cloud layers, blur, edges, and physical systems. It dynamically bulletins these interactions using NVF, SDN technology, and service coordination. It also contains simultaneous sets of legitimate and offensive events in network systems, operating systems, and IoT services. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Auth** & **Dataset** & **Algorithm** & **Accuracy** & **Description** \\ \hline PKumar [14] & TON-IoT & ANN & 99.44\% & The SDIoT-Fog data are shielded using the SAE approach from inference assaults that can be produced using system-based ML techniques. \\ \hline [PERSON]. [PERSON] et al. [15] & TON-IoT & TP2 SF & 98.84\% & The data are transformed into a new reduced shape for thwarting inference and poisoning assaults using a Blockchain-based enhanced proof-of-work (ePoW) technique and principal component analysis (PCA). \\ \hline [PERSON]. [16] & UNSW-NB1 & DL & 99.59\% & The authors combined the entire UNSW-NB1 dataset into a single CSV file so that DL models could be tested once rather than separately for each file. \\ \hline [PERSON] [17] & UNSW-NB15 & - & 84.24\% & The authors used the ICRF-RFE hybrid feature selection method to identify MLP-based intrusion detection algorithms. \\ \hline [PERSON] [18] & UNSW-NB15 & RF & 93.21\%, & To protect the IoT, XGBoost, k-nearest neighbours, and Gaussian naive Bayes are combined as individual learners. Random forests then use the obtained prediction results. \\ \hline [PERSON] [19] & TON-IoT & Densely-Resnet & Win? 92.99\% Network 99.93\% & Connected three virtual layers (fog, edge, and cloud layers) as a whole to discover external attacks more comprehensively. \\ \hline [PERSON] [20] & TON-IoT & DFF, RF & 96.10\% & The authors proposed a detailed analysis of feature sets that were ideal in terms of relevance and predictive power using chi-squared, correlation, and information gain. \\ \hline [PERSON] [21] & TON-IoT Linux & AI & — & The authors used the validation method of AI-based cybersecurity tools for malware detection, intrusion detection, and privacy protection. \\ \hline [PERSON]. [PERSON] [22] & Edge-IIoT & DNN & 94.67\% & A new cybersecurity dataset for IoT and IoT applications—called Edge-IIoT—was proposed for use in ML-based intrusion-detection systems. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of previous studies. Furthermore, the ToN-IoT dataset is represented in CSV format with a categorized column representing the attack or normal behaviour and the type of attack subclass, which refers to nine different kinds of attacks (XSS, DDoS, DoS, password cracking attacks, reconnaissance or verification, MITM, ransomware, backdoors, and injection attacks) [12; 23]. Because the data are imbalanced, we use class weights, as they give all classes approximately equal priority in gradient changes no matter how many samples we have from each class in the training data. The numbers and types of records in the ToN-IoT dataset are illustrated in Table 2.  
ToN-IoT Dataset Statistics Windows 7, Windows 10, Network, Win10-Network, and IoT datasets contain many normal and attack types. The Windows 7 dataset has 28,366 records and 132 features, whereas the Windows 10 dataset contains 35,975 records and 124 features, Network has 21,978,632 records and 42 features, and Win10-Network has 1,073,754 records of normal and attack observations. These datasets cover training and testing machine learning models, as shown in Table 3.