## 3 Methods
### Dataset
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Features** & **Type** & **Descriptions** \\ \hline Mean Flow (mean) & Float & Average duration of the active flows \\ Source Port (Sport) & Integer & Source port number \\ Destination Port (Dport) & Integer & Destination port number \\ Source Packets (Spkts) & Integer & Source/Destination packet count \\ Destination Packets (Dpkts) & Integer & Destination/Source packet count \\ Total Packets (Tpkts) & Integer & Total transaction packet count \\ Source Bytes (Sbytes) & Integer & Source/Destination bytes count \\ Destination Bytes (Dbytes) & Integer & Destination/Source bytes count \\ Total Bytes (TBytes) & Integer & Total transaction bytes count \\ Source Load (Sload) & Float & Source bits per second \\ Destination Load (Dload) & Float & Destination bits per second \\ Total Load (Tload) & Float & Total bits per second \\ Source Rate (Srate) & Float & Source packets per second \\ Destination Rate (Drate) & Float & Destination packets per second \\ Total Rate (Trate) & Float & Total packets per second \\ Source Loss (Sloss) & Float & Source packets retransmitted/dropped \\ Destination Loss (Dloss) & Float & Destination packets retransmitted/dropped \\ Total Loss (Tloss) & Float & Total packets retransmitted/dropped \\ Total Percent Loss (Ploss) & Float & Percentage packets retransmitted/dropped \\ Source Jitter (ScrJitter) & Float & Source jitter in milliseconds \\ Destination Jitter (DrcJitter) & Float & Destination jitter in milliseconds \\ Source Interpacket (SlnPtkt) & Float & Source interpacket arrival time in milliseconds \\ Destination Interpacket (DlIntPkt) & Float & Destination interpacket arrival time in milliseconds \\ Protocol (Proto) & Char & Transaction protocol \\ Duration (Dur) & Integer & Record total duration \\ TCP RTT (TcpRtt) & Float & TCP connection setup round-trip time, sum of “synack” \\  & & and “ackdat.” \\  & & Time since the last packet activity. This value is useful in \\ Idle Time (Idle) & Float & real-time processing and is the current time-last time. \\ Sum (sum) & Integer & Total accumulated duration of aggregated records \\ Min (min) & Integer & Minimum duration of aggregated records \\ Max (max) & Integer & Maximum duration of aggregated records \\ Source Diff Serve Byte (sDSb) & Integer & Source different serve byte value \\ Source TTL (sTtl) & Float & Source \(\rightarrow\) Destination TTL value \\ Destination TTL (dTtl) & Float & Destination \(\rightarrow\) Source TTL value \\ Source App Byte (SAppBytes) & Integer & Source \(\rightarrow\) Destination application bytes \\ Destination App Byte (DAppBytes) & Integer & Destination \(\rightarrow\) Source application bytes \\ Total App Byte (TotAppByte) & Integer & Total application bytes \\ SYN\_Ack (SynAck) & Float & TCP connection setup time, the time between the SYN \\  & & and the SYN\_ACK packets \\  & & Total active flow run time. This value is generated \\ Run Time (RunTime) & Float & through aggregation and is the sum of the \\  & & record’s duration. \\ Source TOC (sTos) & Integer & Source TOS byte value \\ Source Jitter (SrcItAct) & Float & Source idle jitter (ms) \\ Destination Jitter (DstJitAct) & Float & Destination active jitter (ms) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Detailed description of the attributes of the dataset. traffic, DoS traffic, reconnaissance traffic, and backdoor traffic. Four of these are DoS attack types. Table 5 shows the data distribution by class. Additionally, Table 6 shows the count, mean, std, min, and max values of the dataset. In this study, evaluations were made using the WUSTL-IIoT-2021 dataset. This dataset was selected because it includes DoS attacks specific to IIoT. It has been preferred because it has recently been widely used in machine learning studies.