# Anomaly Detection for IOT Systems Using Active Learning
## 3 Data Collection
### Data Description  
Network intrusion detection often uses the UNSW-NB15 dataset as a labeled dataset [36]. It is frequently used to assess how well intrusion detection systems are performing. On the other hand, the data on network traffic is produced in the simulated network environment that makes up the dataset. This dataset contains both common operational tasks and a range of network assaults. The dataset is made up of both raw and processed data that has been given various network traffic indicators. As shown in Table 2, these metrics consist of protocol, source, and destination IP addresses, port numbers, and packet and byte counts. A total of 2,540,044 occurrences have been recorded and categorized into ten distinct classifications of network traffic, encompassing both routine traffic and nine distinct forms of attacks. The subsequent classifications represent a selection of attacks:  
* Fuzzers;
* Exploits;
* Generic;
* Reconnaissance;
* Shellcode;
* Worms;
* Analysis;
* Backdoors;
* DoS. The dataset comprises 45 variables, with the last two categorized as multi- and binary target variables. The initial 43 elements encompass a diverse range of characteristics, with the potential for certain ones to be omitted while others have significant importance. The subsequent section provides a comprehensive account of each variable in the training dataset. The variables of the UNSW-NB15 dataset are delineated in the following list:  
* id: a unique label for each flow. * Dur: the flow's time frame, measured in seconds. * Proto: the flow's protocol (such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or ICMP). * Service: the flow's associated service (if any), such as HTTP, SSH, or FTP. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \(\text{ct\_hw\_http\_mthd}\) & \(\text{ct\_src\_1 tm}\) & \(\text{ct\_srv\_dst}\) & \(\text{is\_sm\_ips\_ports}\) & \(\text{attack\_cat}\) & **Label** \\ \hline
0 & 1 & 2 & 0 & Normal & 0 \\
0 & 1 & 3 & 0 & Normal & 0 \\
0 & 2 & 3 & 0 & Normal & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: UNSW testing data frame. * State: the flow's current condition, such as FIN-WAIT-1 or ESTABLISHED. * spkts: the total number of packets the source host transmitted throughout the flow. * dpkts: the total number of packets the destination host transmitted throughout the flow. * sbytes: the total amount of data the source host transmits throughout the flow. * dbytes: the total amount of data the destination host transmits throughout the flow. * Rate: the flow's average packet sending speed, expressed in packets per second. * sttl: the value of the flow's initial packet's source Time to Live (TTL). * dtttl: the first packet in the flow's destination TTL value. * Sload: the rate in bytes per second at which the source host sends data during a flow. * Dload: the rate in bytes per second at which the destination host sends data during the flow. * Sloss: the total number of packets the source host lost along the flow. * Dloss: the number of packets the destination host dropped along the flow. * sinpkt: the number of seconds that pass on average during the flow between each packet that the source host sends. * dinpkt: the number of seconds that pass on average during the flow between each packet that the destination host sends. * Sjit: the standard deviation of the flow's source host's packet transmission interval, expressed in seconds. * Djit: the standard deviation of the flow's destination host's packet transmission intervals, expressed in seconds. * SWIN: the largest window size that the source host will advertise during the flow. * stcpb: the total amount of bytes transmitted by the source host in TCP packets during the flow. * dtcpb: total bytes transmitted by the destination host in TCP packets during the flow. * DWIN: the largest window size that the destination host will advertise while the flow is in progress. * tcprtt: the TCP packets in the flow's round-trip time, expressed in seconds.