## 2 Related Works
In the decades since its release, the dataset has garnered much criticism; for example, in [14], the authors present the argument that excess redundant and duplicate records are some critical shortfalls of the KDD dataset. In 2009, they created NSL-KDD, a shorter and more curated version of the KDD dataset. They achieved this by removing duplicate records or, more precisely, records that seemed like duplicates, which were generated during the creation process of the KDD dataset. Notably, in the creation process of the KDD dataset, the start time of connection, source, and destination IP addresses and source and destination ports were stripped from \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Type of Data** & **Year Published** & \
\begin{tabular}{c} **Recent Studies on** \\ **This Dataset** \\ \end{tabular} &
\begin{tabular}{c} **Percentage Usage** \\ **Observed in [9]** \\ \end{tabular} \\ \hline KDD CUP 99 [10; 11] & Network Packets & 1999 & [12; 13] & 9\% \\ \hline NSL-KDD [14] & Network Packets & 2009 & [15; 16; 17; 18] & 12\% \\ \hline UNSW15-NB15 [19] & Network Packets & 2015 & [20; 21; 22] & N/A \\ \hline N-BaloT [23] & Network Packets & 2018 & [24; 25; 26; 27] & 9\% \\ \hline ToN-IoT [28] & Telemetry data of IoT Services and Network Packets & 2020 & [29; 30] & 2\% \\ \hline IoT 23 [31] & Network Packets & 2020 & [32; 33; 34] & N/A \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Popular IoT datasets and recent works. the internet packets. Thus, many traffic flows, such as ICMP, resulted in what appeared to be duplicated and redundant traffic flows, as they were missing these five key pieces of information that could distinguish them. In 2016, ref. [17] proposed a hybrid approach to IoT security. A proposed framework based on the MapReduce architecture was developed with the goal of distributed detection capabilities. Importantly, this framework considered IoT security from two key perspectives: internet traffic and wireless sensor network (WSN) traffic. The proposed framework featured both misuse-based and anomaly-based methodologies, utilising optimum path forest models. Based on the RPL routing protocol, a WSN was created to simulate the 6 LoWPAN traffic. For the internet traffic aspect of the framework, the NSL-KDD dataset was implemented. The proposed hybrid approach achieved detection rates (DRs) of 80.95% and 96.20% for the anomaly detection and misuse-based modules, respectively. These modules also achieved false alarm rates (FARs) of 5.92% and 1.44%, respectively. Notably, the misuse-based model focused on internet traffic, while the anomaly detection model focused on the generated WSN traffic. In 2017, ref. [16] proposed an unsupervised conditional variational autoencoder (CVAE) IoT network-IDS (NIDS) trained on the NSL-KDD dataset. The architecture integrates intrusion labels within the decoder layers, and the approach boasts better performance than other unsupervised approaches, with a multi-class accuracy of 80.10%, all while being less complex. An essential aspect of the proposed architecture is the ability to reconstruct features from incomplete training sets, in particular, the protocol, flag, and service features, with accuracies of 99.02%, 92.84% and 71.42%, respectively. This is an important feature for the KDD and NSL-KDD datasets, which lost much information when the KDD dataset was created from the DARPA dataset. This framework introduced the first algorithm capable of performing feature recovery while also being the first work to present a CVAE in network intrusion detection. To combat the lack of comprehensive network-based datasets, UNSW-NB15 [19] was created. Previous benchmarks, DARPA98, KDD99, and NSL-KDD09, had become significantly outdated. Thus, UNSW-NB15 was generated to provide a dataset representing modern network traffic, information regarding the depth structure of the network, and minimal footprint intrusion. UNSW-NB15 contains real normal network traffic mixed with synthesised attack traffic. In 2021, ref.