# SEHIDS: Self Evolving Host-Based Intrusion Detection System for IoT Networks
## 3 Datasets  
The accuracy of a proposed intrusion detection/prevention systems is usually determined by evaluating their capabilities to identify different types of attacks provided in one or more benchmark datasets. Therefore, several institutions and research centres have endeavoured to provide enormous datasets that vary in terms of size, availability, recording environment, types of attacks and coverage of protocols, etc. From the multitude of available datasets, this study sets out two conditions for the selection of benchmark datasets: firstly, the selected dataset must contain modern attack types that have taken place in IoT networks. Second, the selected datasets must have been generated from a real network and be provided in the format that can be used to reproduce them at the raw packet level. The key advantage of imposing these two conditions is that they allow a thorough evaluation of our proposal against real-world scenarios. Accordingly, this study uses the following three datasets: BoT-IoT [31], TON-IoT [32], and IoTID20 [33]. Figure 1 illustrates the distributions of classes and subclasses of these datasets, whereas brief descriptions for them are given in the remaining of this section.  
The BoT-IoT [31] dataset was created at the IoT lab of the University of New South Wales (UNSW) at Canberra using a realistic network environment. This dataset comprises 72 million records of benign and different cyberattacks, including Denial of Service (DoS), Distributed Denial of Service (DDOS), reconnaissance, and ransomware. The captured raw packets that are generated from this network are made available in the pcap field format of size 16.7 Gigabits. In addition to the pcap files, the UNSW provides processed versions of the IoT-BoT dataset in two formats: firstly, the argus format in which the packets are grouped into flows based on a vector of features, and secondly, the Comma Separated Values (CSV) format which contains the packets' features and their corresponding classes.  
The second dataset used in this study is TON-IoT [32], which stands for Telemetry datasets of IoT services, Operating systems datasets of Windows and Linux, as well as datasets of the Network. TON-IoT was introduced by the creators of the BoT-IoT dataset with the aim of providing a more comprehensive dataset, including normal and various types of attacks that threaten the industrial IoT (IIOT). TON-IoT is generated from a real testbed that includes some modern technologies such as Fog, Edge, and multiple clouding layers. This allows the TON-IoT to encompass the rudimentary attacks in conjunction with campaign correlation hacking that takes place in a heterogeneous environment with both IoT and IIoT. The TON-IoT repository contains 22,339,021 records available in the pcap, Argus, and CSV formats.  
IoTID20 [33] is the third dataset used in this study to evaluate the performance of the proposed model. This dataset was created by constructing a smart home network that includes multiple IoT devices connected to the Internet through a border router. Interestingly, this dataset employs one of the widely used botnet infrastructures (i.e., the Mirai botnet) to develop various types of attacks, including host discovery, Telnet brute force, UDP flooding, ACK flooding, and HTTP flooding. The number of records in the IoTID20 dataset is 2,985,994, distributed amongst benign and six main classes of attacks.