# An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks
## 3 Materials and Methods
### Dataset  
The study datasets include seven (7) ToN-IoT ([[https://cloudstor.aarnet.edu.au/plus/s/ds5](https://cloudstor.aarnet.edu.au/plus/s/ds5) zW91 vdgiEj9i?path=%2 FPprocessed_datasets%2 FPprocessed_Network_dataset]([https://cloudstor.aarnet.edu.au/plus/s/ds5](https://cloudstor.aarnet.edu.au/plus/s/ds5) zW91 vdgiEj9i?path=%2 FPprocessed_datasets%2 FPprocessed_Network_dataset) (accessed on 5 June 2022)) datasets obtained from Telemetry. The IoT/IIoT-based network testbed was used to generate various operating systems and Network data. These 7 datasets were generated from various IIoT-based devices, such as GPS_Tracker, Weather, Garage_Door, Modbus, Bridge, Thermostat, and Motion_Light. Table 1 presents all features of the seven (7) datasets, such as the smart fridge device, which measures the temperature and its adjustments below the on-demand. Based on a probabilistic input, the features of a remotely activated garage door when opened or closed. The components and features are based on the Global Positioning System (GPS) device, which tracks the geographical coordinates of a remote object. The features obtained are from the smart sense motion device. This uses a pseudo-randomly generated signal to either \"on\" or \"off\" the light. The features generated from the register in the Modbus service device are majorly used for industrial applications. These devices communicate via a master-slave arrangement. The characteristics of a smart thermostat regulate a system's temperature by controlling the heating/cooling system, such as the air conditioner. The dataset of a weather monitoring system creates features, such as temperature, air pressure, and humidity in the data. \begin{table}
\begin{tabular}{l c c} \hline \hline
These ToN-IoT datasets were commonly labeled into binary categories of 'normal' or under 'attack'. The 'attack' class is also further divided into seven (7) subclasses--Scanning, password, DDoS, injection, ransomware, Cross-site Scripting (XSS), and backdoor. The scanning class occurs at the initial stage, where the information about the target system is obtained by the attackers [8; 52] using a scanning tool, such as Nmap [53] or Nessus [54]. The DoS attack [8; 52] adopts the flooding strategy, where the attacker blasts off successive malicious attacks against a genuine user to disrupt their right to access service, while DDoS blasts off enormous successive connections to deplete the resources of the device memory, CPU, etc. These two similar attacks are usually blasted off by a vast network of hacked computers known as bots or botnets [8; 55]. The Ransomware attack [56] is a classical kind of malware that holds the access right of an authentic user to a system or service to ransom by encrypting their access and attempting to transfer the decryption key to restore the original user's access to the service or system. The Backdoor attack [57] is a passive attack that uses backdoor software to give an opponent unauthorized remote access. The competitor utilizes this backdoor to manage the infected IIoT devices and to incorporate them into botnets to launch a DDoS attack [57]. The Injection attack [57; 58] often attempts to execute vindictive codes or implant vindictive data into the IIoT network to disrupt normal operation. Cross-Site Scripting (XSS) [58] often tries to run vindictive commands on a seb server in the IIoT applications. The XSS lets the attacker insert random web scripts remotely into the IIoT system. The information and the authentication procedure between IIoT devices and the remote web server may be compromised by this attack. A typical Password Cracking Attack [59] occurs when a rival applies password-cracking techniques to figure out an IIoT device's passcode. The attacker will bypass the authentication system and compromise the IIoT devices [57]. A common network attack that might disrupt the communication link between two devices is the MiTM attack [13], which could alter their data. Examples of MiTM attacks include ICMP redirect, ARP Cache poisoning, and port theft [12].