## 2 Related Work
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref** & **Cyber Threats** & **Algorithm** & **Data Sources** & **Accuracy** & **FPR** \\ \hline
[24] & DDoS & Restricted Boltzmann machine and FFNN & Simulated smart water system dataset & 97.5\% & - \\ \hline
[21] & Information theft, reconnaissance, and DDoS & J48 & BoT-IoT UNSW & - & 0.41 \\ \hline
[26] & Information theft, reconnaissance, and DDoS & FFNN & BoT-IoT UNSW & - & - \\ \hline
[19] & DDoS, DoS, data exfiltration, keylogging, OS fingerprinting, and service scan & K-nearest neighbors (K-NN) & BoT-IoT UNSW & 99.00\% & - \\ \hline
[27] & DDoS, DoS, keylogging, and reconnaissance & C5-SVM & BoT-IoT UNSW & 99.97\% & 0.001 \\ \hline
[28] & DDoS, DoS, data exfiltration, keylogging, OS fingerprinting, and service scan & Decision tree-RF & BoT-IoT UNSW & 99.80\% & - \\ \hline
[29] & Remote car control & Recursive Bayesian estimation & Route data for connected cars & - & - \\ \hline
[30] & DoS, probe, R2L, and U2R & FCNN, CNN, and LSTM & Network events & 94.7\% & 0.049 \\ \hline  & & & UNB-CIC TOR Network Traffic dataset & 100 & 0 \\ \hline
[31] &
\begin{tabular}{c} Worms, DoS, backdoors, reconnaissance, exploits, analysis, generic, fuzzers, and shellcode \\ \end{tabular} & C4.5, Multilayer perceptron (MLP), SVM, and linear discriminant analysis (LDA) & UNSW-NB15 & 97.84\% & 0.23 \\ \hline
[32] & Injection, Flooding, Impersonation & Stacked auto-encoder (SAE) & AWID-CLS-R & 98.66\% & - \\ \hline
[33] & DoS, probe, R2L, and U2R & GWO-CNN & DARPA1998 & 97.92\% & 3.60 \\ \hline
[34] &
\begin{tabular}{c} Worms, DoS, backdoors, reconnaissance, exploits, analysis, generic, fuzzers, and shellcode \\ \end{tabular} & CNN-LSTM & UNSW-NB15 & 98.43\% & - \\ \hline
[35] & DoS, probe, R2L, and U2R & CNN-LSTM & KDD CUP 99 & 98.7\% & 0.005 \\ \hline
[36] &
\begin{tabular}{c} DoS, probe, R2L, U2R, \\ BruteForce SSH, DDoS, and infiltrating \\ \end{tabular} & CNN-LSTM & KDC2012 & 99.69\% & 0.22 \\ \hline
[20] &
\begin{tabular}{c} Worms, DoS, backdoors, reconnaissance, exploits, analysis, generic, fuzzers, and shellcode \\ \end{tabular} & CNN-LSTM & DARPA1998 & 99.68\% & 0.07 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison between proposed attack classification methods. various researchers. Data theft threats include reconnaissance, information theft, probe, R2L, and U2R, which may lead to the exposure of various vulnerabilities that can help in launching data theft attacks such as sniffing passwords and unauthorized access. Some of the proposed models for smart cites set a fixed threshold to detect attacks, which is not effective and can raise a lot of false alarms that affect the power consumption of the connected systems. In smart cities, the normal behavior of a system can change due to the increasing number of connected devices, so some researchers have achieved high accuracy but bad performance in terms of FPR. Even though different researchers have proposed models to enhance threat classification for IoT environments, many aspects still require improvement. One of the limitations that is common between different methods is performance time. Low-level IoCs that are collected from network traffic have been used to analyze the threats in various papers to provide timely information to the CTI knowledge base and update the detection and prevention information for all systems connected to the CTI. However, to enhance classification performance, various models have multiple stacked ML model layers. Therefore, it may take time to train a model and classify threats while not taking advantage of these IoCs. Secondly, when some models are not provided with enough data for each type of threat, threat traffic cannot be profiled and modeled well enough. Consequently, ML models can have high FPRs. Furthermore, some models only provide accurate results when their system has precise details of threats. Consequently, the system is not able to recognize threats that do not have enough data for model training, which affects classification accuracy.