# Anomaly Detection for IOT Systems Using Active Learning
## 3 Data Collection  
The UNSW-NB15 dataset, used in the research papers [7,8] was curated by the Network Security Research Lab (NSRL) of the University of New South Wales (UNSW) in Sydney, Australia [33,34]. The dataset was created by simulating a real-world network environment, complete with numerous IoT devices, threats, and network traffic. The dataset comprises 2.5 million network flows containing both legitimate and criminal activities. The data was collected by monitoring a testbed network comprising three physical computers hosting diverse network services alongside twelve virtual machines running different operating systems. Virtual machines utilized various services and protocols, including the Hypertext Transfer Protocol (HTTP), Simple Mail Transfer Protocol (SMTP), Domain Name System (DNS), File Transfer Protocol (FTP), Secure Shell (SSH), Telecommunication Network (Telnet), Internet Control Message Protocol (ICMP), and TCP.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Dataset/Parameters** & **Methodology** & **Limitations** & **Results** \\ \hline \multirow{10}{*}{-} & \multirow{6}{*}{-} & & - & The research paper does not compare the performance of the machine learning algorithms with feature selection using the CNN-NB15 dataset is used. & - & Accuracy of CNN-98.28\%. \\  & & & Performance metrics include precision, & - & Accuracy of detection datasets. & NB: 76.59\%. \\  & & & Precision, & - & The paper focuses on the evaluation of the machine learning algorithms’ & - & Accuracy of RF: 99.5\%. \\  & & & Accuracy. & - & The paper focuses on the evaluation of the machine learning algorithms’ & - & Accuracy of RF: 99.5\%. \\  & & & Accuracy. & - & selection but does not provide an in-depth analysis of the interpretability of the selected features. & & \\ \hline \multirow{10}{*}{-} & \multirow{6}{*}{-} & \multirow{6}{*}{-} & - & The research paper does not provide a comprehensive comparison of the performance analysis of the IDS using different feature selection methods or other datasets. & - & The research paper does not provide a comprehensive comparison of the performance analysis of the IDS using different feature selection methods or other datasets. & - & With 42 features, SVM precision is 94.3\%. DT has a 94.3\%. DT has a 96.5\%. \\  & & & & - & The lack of practical implications restricts the usefulness of the research paper for practitioners looking for actionable insights to improve the efficiency and effectiveness of their IDS systems in real-world scenarios. & - & In this a precision of 98.9\%. \\ \cline{1-1}  & & & & - & Their dataset may have limitations in terms of representing a diverse and comprehensive collection of real-world IoT network traffic data. & - & RF has an accuracy of 98.7\%. \\ \cline{1-1}  & & & - & Chosen ML algorithms might not be suitable for detecting emerging or previously & - & SVM has an accuracy of 97.7\%. \\ \cline{1-1}  & & & - & - & ANN has an unseen intrusion patterns. & - & ANN has an accuracy of 94.7\%. \\ \cline{1-1}  & & & - & Reliance on these specific layers may overlook potential attacks at other layers, leading to potential vulnerabilities in the IoT system. & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: \(Cont.\)The Wireshark packet capture tool was employed to record the network traffic [35]. Subsequently, the data was pre-processed to eliminate relevant information for anomaly identification.  
* UNSW-NB15_1_csv, UNSW-NB15_2_csv, UNSW-NB15_3_csv, and UNSW-NB15_4_csv are the four CSV files that make up the dataset. These files include 2,540,044 records overall.
* UNSW-NB15_LIST_EVENTS.csv is the file name for the list of events, and UNSW-NB15_GT.csv is the table name for the ground truth data.
* The UNSW_NB15_training-set.csv and UNSW_NB15_testing-set.csv portions of the dataset were utilized as the training and testing sets, respectively. A total of 175,341 records make up the training set, while 82,332 records from the attack and normal categories make up the testing set.