## 3 Key Findings
### RQ2: What Kinds of Learning Algorithms Are Being Deployed Towards the Security of IIoT?
#### 3.2.4 RQ2-2: Set of Available Datasets Used by Learning Models for IIoTsec
* WUSTL-IIoT-2018  
In 2018, [PERSON] and his team created an IIoT-centric dataset named WUSTL-IIOT-2018 using a SCADA system testbed [84]. The research team used the system testbed in the water treatment and distribution system's water storage tank (WST) to have a real-life replica. The network traffic was under the surveillance of the audit record generation and utilization system (ARGUS) tool. A total data size of 627 MB was captured for 25 h, while 7,049,989 observations were made. The observations showed 93.93% and 6.07% of benign and malicious traffic, respectively. When cleaned of missing values, corrupted values, and outliers, the data were reduced to 7,037,983 samples. The 25 features of WUSTL-IIOT-2018 include source port, total packets, total bytes, source packets, destination packets, and source bytes, thereby making their observed features vary during benign and malicious traffic. Likewise, some of the attacks made on the testbed include port scanners, address scanners, device identifiers, and exploits. * WUSTL-IIoT-2021  
WUSTL-IIoT-2021 is a network-driven IIoT-based data. It has no traffic, data, or assaults from any IoT-based devices. Thus, it is more suitable for exclusively IIoT-based scenarios. Benign and malicious data through various IIoT and industrial devices are the main sources of these dataset [48]. The dataset aims to mimic real-life industrial systems alongside likely real-life cyberattacks. WUSTL-IIoT-2021 has a total data size of 2.7 GB when captured for about 53 h. Then, a preprocessing was performed to clean the data of missing values, extreme outliers, and invalid entries. The preprocessing activity reduced the total size by one-seventh to ease the intrusion detection model. The total observations then become 1,194,164, containing 1,107,448 and 87,016 samples as benign and malicious observations, respectively. The testbed was executed on an average data rate of 419 kbit/s and an average packet size of 76.75 bytes. The dataset has approximately 90% of the attacks focusing on DoS attacks, on the assumption that DoS attacks are traffic resourceful compared to other attacks, that even convey a small amount of traffic. * X-IIoTID  
X-IIoTID dataset is another example of real-life IIoT data captured by [PERSON] et al. [85] at the University of New South Wales (UNSW) in Canberra, to reveal both the host and network processes in safe and unsafe environments. For this dataset, statistical, ML, and DL techniques were utilized to identify and detect assault strategies. The X-IIoTID dataset has 421,417 benign and 399,417 assault observations, totaling a total instance of 820,834 with 59 features. The features were extracted from log files and network traffic using device resources and public IDS logs in an Industrial Internet Reference Architecture (IIRA) model-based laboratory architecture. Three class label levels were implemented to represent the attack scenario of the dataset. Class 1 depicted a binary category. Class 2 revealed a benign and 18 sub-categories of attack, while Class 3 also had a benign but 10 sub-sub attack categories. * Edge-IIoTset  
Edge-IIoTset is a new comprehensive cyber security dataset for IoT and IIoT applications [86]. The dataset was prepared mainly for cyber security researchers to evaluate ML-based IDS. The dataset is organized into seven layers, namely the cloud computing layer, the NFV Layer, the blockchain network layer, the fog computing layer, the SDN layer,the edge computing layer, and the IoT and IIoT perception layer. The dataset was generated from different 10 device sensors. In total, 14 attacks were identified and categorized under five threats, while 61 features are proposed for use. The dataset was validated using a primary exploratory data analysis with the performance of ML and DL approaches in both centralized and federated learning modes. Other IIoT-based datasets specifically used for AI-centric cyber security applications are the ICS generated WST dataset [87], and the GP dataset.