## 5 Dataset Analysis
### UDP/CoAP Description  
The CIDAD presents the UDP protocol at the transport layer and the CoAP at the application layer. The CoAP makes use of two message types, requests and responses, using a simple, binary-based header format. In the dataset, there are two types of CoAP messages; the packets marked as CoAP represent those requests made by the client and the CoAP data text line are the responses sent by each of the sensors. Therefore, the messages with the temperature data from the sensors will be housed in the payload of the CoAP data text line messages.  
Table 4 shows the number of packets for each type of CoAP message. As mentioned above, all anomaly packets are over UDP messages. The packets labelled as anomalies in the CoAP protocol on Tuesdays, Fridays, and Saturdays correspond to packets sent by the client that have not received a response and correspond to an interception anomaly. This anomaly is also reflected in the absence of a data text line CoAP. The modification and  
\begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Day**} & **Src** & **Dst** & **Src** & **Dst** & **ARP** & **IP** & **IPv6** & **UDP** & **Normal** & **Anomaly** \\  & **Bytes** & **Bytes** & **Packets** & **Packets** & **Protocol** & **Protocol** & **Protocol** & **Packets** & **Packets** \\ \hline Monday & 490,344 & 331,776 & 7040 & 4608 & 2312 & 9216 & 120 & 9216 & 11,648 & 0 \\ Tuesday & 529,942 & 331,818 & 7737 & 4609 & 3105 & 9123 & 118 & 9120 & 12,250 & 96 \\ Wednesday & 537,736 & 331,818 & 7836 & 4609 & 3105 & 9219 & 121 & 9216 & 12,349 & 96 \\ Thursday & 516,302 & 330,666 & 7464 & 4593 & 2702 & 9235 & 120 & 9232 & 11,961 & 96 \\ Friday & 633,196 & 331,902 & 9442 & 4611 & 4707 & 9225 & 121 & 9216 & 13,669 & 384 \\ Saturday & 633,056 & 331,902 & 9440 & 4611 & 4707 & 9225 & 119 & 9216 & 13,667 & 384 \\ Sunday & 489,796 & 331,776 & 7030 & 4608 & 2304 & 9216 & 118 & 9216 & 11,638 & 0 \\ \hline Total & 3,830,372 & 2,321,658 & 55,989 & 32,249 & 22,942 & 64,459 & 837 & 64,432 & 87,182 & 1056 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Dataset statistics.  
duplication anomalies are labelled over the CoAP data text line. In the case of Wednesday (modification anomaly), the number of packets remains unchanged, while on Thursday (duplication anomaly), there is a considerable increase in the number of packets. In cases where there is a mixture of anomalies (Friday and Saturday), the number of packets and their distribution is not an accurate indicator of the presence of anomalies.  
As a consequence of the simplicity of the structure handled by the CoAP protocol, the network presents a low, uniform, and homogeneous exchange of packets. This fact makes it necessary to find other types of features that allow to model network behaviour as normal or abnormal.  
All InRow sensors have the same IP address, but the URI-host field allows to determine the InRow to which it belongs, and the URI-path field allows to identify the sensor. The network has a total of 16 sensors and each sensor sent 288 packets per day to the client. The absence or presence of additional packets also gives us an initial indicator of the type of anomaly the InRow presents that day. The first evidence of removed packets in this kind of lightweight environment could be the lack of uniformity in traffic. Indeed, the packet reduction presented on Tuesday at InRow 13 is a strong indicator of the presence of an interception anomaly, in contrast to the excess of packets on Thursday, indicating a duplication anomaly. In the case of days in which there is a mixture of anomalies, such as Friday and Saturday, the presence of duplication and interception anomalies will not affect the homogeneity in the number of packets sent per day, but the number of anomalous packets will increase.