# An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks
## 3 Materials and Methods
### Dataset
The datasets and their detailed descriptions are presented in Tables 1-7. The seven (7) datasets have login dates for the IoT Telemetry data, login times for the IoT Telemetry data, and the record of the binary label of normal and attacks, where '0' represents normal and '1' represents attacks. \begin{table}
\begin{tabular}{l l l} \hline
**Features** & **Data Type** & **Description** \\ \hline \multicolumn{4}{c}{Thermostat dataset description} \\ current\_temperature & Float & The present temperature value recorded by the network-connected thermostat sensor gadget \\ thermostat\_status & Boolean & The thermostat sensor device’s condition could either be ‘on’ or ‘off’. \\ \hline \multicolumn{4}{c}{Weather dataset description} \\ temperature & Float & The temperature values recorded based on the weather sensor apparatus attached to the network \\ pressure & Float & The pressure values recorded by the network-connected weather sensor device \\ humidity & Float & The humidity values recorded, as determined by the network-connected weather sensor device \\ \hline \end{tabular}
\end{table} 
Table 1: _Cont._ \begin{table}
\begin{tabular}{c c c c c c c c c} \hline
**Dataset** & **Backdoor** & **Injection** & **DDoS** & **Password** & **Ransomware** & **Scanning** & **XSS** & **Normal** & **Total** \\ \hline \multicolumn{1}{c}{Fridge} & 35,568 & 7079 & 10,233 & 28,425 & 2902 & 2042 & - & 500,827 & 587,076 \\ Garage\_door & 35,568 & 6331 & 10,230 & 19,287 & 2902 & 529 & 1156 & 515,443 & 591,446 \\ GPS\_Tracker & 35,571 & 6904 & 10,226 & 25,176 & 2833 & 550 & 577 & 513,849 & 595,686 \\ Motion-Light & 28,209 & 5595 & 8121 & 17,521 & 2264 & 1775 & 449 & 388,328 & 452,262 \\ Moldbul & 40,036 & 7079 & - & 24,269 & - & 529 & 577 & 405,904 & 454,124 \\ Thermostat & 35,568 & 9498 & - & 8435 & 2264 & 61 & 449 & 385,953 & 442,228 \\ Weather & 35,641 & 9726 & 15,182 & 25,715 & 2865 & 529 & 866 & 539,718 & 630,242 \\ \hline \end{tabular}
\end{table} 
Table 2: Record of the multi-class label of various actual attacks and normal. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Models** & **Accuracy** & **Precision** & **Recall** & **F1\_Score** \\ \hline \multirow{4}{*}{**Dataset**} & Bagging & 0.9832 & 0.9779 & 0.9829 & 0.9804 \\  & XGBoost & 0.9869 & 0.9780 & 0.9895 & 0.9836 \\ \cline{1-1}  & RF & 0.9813 & 0.9771 & 0.9838 & 0.9804 \\ \cline{1-1}  & ET & 0.9766 & 0.9756 & 0.9753 & 0.9754 \\ \cline{1-1}  & Ada & 0.4738 & 0.0592 & 0.1250 & 0.0804 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: The classification report for the IIoT GPS_Tracker dataset. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Dataset** & **Models** & **Accuracy** & **Precision** & **Recall** & **F1\_Score** \\ \hline \multirow{4}{*}{**Dataset**} & Bagging & 0.9890 & 0.9870 & 0.9878 & 0.9874 \\  & XGBoost & 0.9913 & 0.9864 & 0.9895 & 0.9879 \\ \cline{1-1}  & RF & 0.9878 & 0.9861 & 0.9793 & 0.9827 \\ \cline{1-1}  & ET & 0.9870 & 0.9843 & 0.9730 & 0.9785 \\ \cline{1-1}  & Ada & 0.6292 & 0.1049 & 0.1667 & 0.1287 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: The classification report for the Modbus dataset. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Dataset** & **Models** & **Accuracy** & **Precision** & **Recall** & **F1\_Score** \\ \hline \multirow{4}{*}{**Dataset**} & Bagging & 0.9856 & 0.9795 & 0.9908 & 0.9850 \\  & XGBoost & 0.9873 & 0.9801 & 0.9942 & 0.9869 \\ \cline{1-1}  & RF & 0.9843 & 0.9777 & 0.9912 & 0.9843 \\ \cline{1-1}  & ET & 0.9801 & 0.9754 & 0.9861 & 0.9806 \\ \cline{1-1}  & Ada & 0.4809 & 0.1299 & 0.2589 & 0.1728 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The classification report for the IIoT Fridge sensor device dataset.