## 2 Background and Related Work
In another work, the authors compared the known testbeds to the one that is used to create the IoT-Bot dataset, which is a simulated network environment that simulates real-world traffic [15]. A variety of datasets have been presented in the literature to assist researchers in modeling botnet operations and generating attack traffic statistics [16; 17; 18; 19]. These datasets were generated using a variety of testbeds. [PERSON] et al. [17] built the DDoS Botnet traffic testbed using a high-tier server and virtual machine. The number of bots in their testbed was larger, but their produced botnet activities were restricted to HTTP DDoS attacks exclusively. They did not use machine learning algorithms. The data generated by this network testbed was intended to provide evidence of malicious activity on the internet. However, it is difficult to verify any results due to the lack of comprehensive network packet capture. The amount of data that can be retrieved and analyzed is also limited by network traces. [PERSON] et al. [19] built their testbed using real devices connected to a local network in a different way. They used Botloader and IP-Aliasing, two pieces of specialist software, to replicate flash events and other DDoS attacks on their testbed. The decision to use physical computers instead of a virtualized testbed has some drawbacks. It is more expensive, more difficult to install, and does not offer the same level of robustness as a virtualized environment. However, their methodology also encompasses a wider range of botnet operations, including port scanning using machine learning methods. In another study, [PERSON] et al. [20] developed two independent testbeds based on physical computers. One testbed was for the network of the victim, and the other was for the network of the attacks. The authors chose to use the Ubuntu/Kali Linux platform for malware detection, and they used a wide range of popular operating systems in their approach. [PERSON] et al. [15] built their UNSW-NB15 dataset using IXIA's Perfect Storm testbed to create both normal and malicious network traces. The researchers used IXIA to set up three virtual servers, two of which generated regular traffic and the third of which carried out attacks on the other two. Most of the existing work in this area has been addressing DoS/DDoS and IoT. However, there are fewer works that address the applicability of SDN to smart cities. [PERSON] et al. [21] proposed a novel intrusion detection and prevention system to prevent DDoS attacks. The authors introduced a long short-term memory (LSTM) and graded rated unit (GRU) deep learning model as the \"block-attack\" model, where the LSTM and GRU contribute to enhancing the rate of accuracy in detecting DDoS attacks in an SDN environment. They used the CICDDoS2019 dataset for the experiments. They achieved 98.5% accuracy in detecting and preventing the DDoS attacks and 95.5% accuracy for the SVM-based method. Recently, [PERSON] et al. [22] introduced a lightweight model for botnet attack detection in software-defined network-orchestrated IoT. The aim of this model is to enhance the security framework of IoT by harnessing the capabilities of IoT devices to efficiently thwart botnet malware attacks. By dynamically allocating computational resources, the model achieves rapid response times. Notably, empirical evaluation showcases the model's exceptional performance, yielding remarkable metrics such as 99% precision, recall, and F1 score, in conjunction with an impressive accuracy rate of 99.4%. Furthermore, the model's size, a mere 118 KB, coupled with its minimal parameter count of 19,414, contributes to its agile execution time of a mere 0.108 milliseconds. A comparative analysis of the existing work is presented in Table 1.