# Anomaly Detection for IOT Systems Using Active Learning
## 3 Data Collection
### Data Description
* Synack: the interval in seconds between Synchronize (SYN) and Acknowledgment (ACK) packets in the flow. * ackdat: the interval, in seconds, between the ACK and data packets in the flow. * Smean: the average number of bytes in the payload transmitted by the source host during the flow. * Dmean: the average number of bytes in the payload the destination host supplied throughout the flow. * trans_depth: the total amount of HTTP requests sent over the TCP connection. * response_body_len: the size of the HTTP response body in the flow. * ct_srv_src: the total number of connections made in the last two seconds to the same service and source IP address. * ct_state_ttl: the quantity of connections with the same state and TTL values during the last two seconds. * ct_dst_ltm: the number of connections made in the last two seconds to the same destination IP address. * ct_src_dport_ltm: the number of connections with the same source port and destination IP address during the last two seconds. * ct_dst_sport_ltm: measurement of several connections made in the last two seconds using the same source IP address and destination port. * ct_dst_src_ltm: the number of connections with the same source and destination IP addresses in the last two seconds. * is_ftp_login: indicates whether or not a login was used to access the FTP session. * ct_ftp_cmd: the flow's total number of FTP commands. * ct_flw_http_mthd: the number of HTTP methods used in the flow. * ct_src_ltm: the number of connections with the same source IP address in the past two seconds. * ct_srv_dst: the number of connections to the same service and destination IP address in the past two seconds. * is_sm_ips_ports: indicates if the source and destination IP addresses and ports belong to the same subnet. * attack_cat: the type of attack (e.g., DoS, Fuzzers, Shellcode) or normal traffic. * Label: indicates whether the traffic is benign (0) or malicious (1). The UNSW-NB15 dataset comprises network traffic traces that were collected within a controlled laboratory environment. The traffic consists of non-malicious traffic and traffic associated with different types of attack. The production of this traffic is facilitated by a diverse range of hardware and operating systems. Moreover, the traffic has the potential to originate from a wide range of network-connected devices, encompassing IoT devices, laptops, servers, routers, and switches, among others. Thus, the scope of IoT devices is not limited to any particular type. Within the UNSW-NB15 dataset, the designations \"source\" and \"destination\" refer to the specific Internet Protocol (IP) address and port number associated with the device that initiated the network communication and the machine that received the communication, respectively. For instance, when a computer possessing the IP address 192.168.1.2 transmits a message to a server with the IP address 10.0.0.1, the source and destination IP addresses would be 192.168.1.2 and 10.0.0.1, respectively. The source port refers to the computer's specific port for transmitting a message. In contrast, the destination port pertains to the port employed by the server to receive the message.