## 6 Discussion on the Generated Datasets  
The generated benign and malicious \"pwrtrace\" datasets, presented in Sections 4.1.2 and 5.1.2, respectively, include information about raw features (e.g., all_cpu, all_lpm, all_transmit, all_listen) which can be used to derive new features more informative, in terms of the behaviour of each mode, and non-redundant. These new features are intended to constitute valuable features for training and evaluating AIDS for IoT/IIoT networks. Towards this direction, the total energy consumption of a more in an IoT/IIoT network can be considered as a valuable feature for detection of a UDP flooding attack and its source as the compromised mode carrying out the attack is characterised by high total energy consumption, as demonstrated below. Based on [29; 30], the total energy consumption of each mode, at the reading (i.e., record) \(i\), is given by the sum of (a) the energy consumption in the CPU state; (b) the energy consumption in the LPM state; (c) the energy consumption in the Tx state; and the average power consumption Listen state, at the reading (i.e., record) \(i\), as shown in the equation below:  
\[\begin{array}{ll}\mathrm{E_{total_{i}}(mj)}&=\mathrm{E_{cpu_{total_{i}}}+E_{ lpm_{total_{i}}}+E_{rc_{total_{i}}}+E_{rc_{total_{i}}}=}\\ &=\left(\mathrm{I_{cpu}}\ \times\mathrm{V_{cpu}}\times\mathrm{T_{cpu_{i}}} \right)+\left(\mathrm{I_{lpm}}\ \times\mathrm{V_{lpm}}\ \times\mathrm{T_{lpm_{i}}} \right)+\left(\mathrm{I_{tx}}\times\mathrm{V_{tx}}\times\mathrm{T_{tx_{i}}} \right)+\left(\mathrm{I_{rx}}\times\mathrm{V_{rx}}\times\mathrm{T_{rx_{i}}} \right)\\ &\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad\qquad \qquad\qquad\qquad\  
V\({}_{\text{lpm}}\): the nominal voltage in the LPM state;  
V\({}_{\text{hc}}\): the nominal voltage in the TX state;  
V\({}_{\text{rx}}\): the nominal voltage in the RX state;  
\(T_{cpu_{i}}=\frac{cpu_{i}\left(\#\ ticks\right)}{RTIMER_{\_ARCH\_SECOND}}=\frac{cpu _{i}\left(\#\ ticks\right)}{32,768}\)  
\(T_{lpm_{i}}=\frac{lpm_{i}\left(\#\ ticks\right)}{RTIMER_{\_ARCH\_SECOND}}=\frac{ lpm_{i}\left(\#\ ticks\right)}{32,768}\)  
\(T_{tx_{i}}=\frac{tx_{i}\left(\#\ ticks\right)}{RTIMER_{\_ARCH\_SECOND}}=\frac{ tx_{i}\left(\#\ ticks\right)}{32,768}\)  
\(T_{rx_{i}}=\frac{rx_{i}\left(\#\ ticks\right)}{RTIMER_{\_ARCH\_SECOND}}=\frac{ rx_{i}\left(\#\ ticks\right)}{32,768}\)  
Based on Equation (1) and Table 2 that provides the typical operating conditions for a Tmote Sky mote, the total energy consumption, at the reading (i.e., record) i, is given by Equation (2):  
\[ \begin{array}{rcl}\text{E}_{\text{total}}(\text{mj})&=&1.8\ \times 3\times\ \left(\frac{\text{cpu}_{i}\left(\#\ ticks\right)}{32,768}\right)\\ &+&0.0545\ \times 3\ \times\ \left(\frac{\text{lpm}\left(\#\ ticks\right)}{32,768} \right)\\ &+19.5\ \times 3\ \times\ \left(\frac{\text{tx}_{i}\left(\#\ ticks\right)}{32,768} \right)\\ &+&21.8\ \times 3\times\left(\frac{\text{rx}_{i}\left(\#\ ticks\right)}{32,768} \right)\end{array}  \tag{2}\]  
Based on Equation (2) and the following features, from the generated benign \"power-trace\" dataset, for each mote: (a) all_cpu; (b) all_lpm; (c) all_transmit; and (d) all_listen, the total energy consumption by each mote, during the simulation time (i.e., 60 min = 3600 s) is shown below in Figure 37.  
On the other hand, based on Equation (2) and the same features (i.e., all_cpu, all_lpm, all_transmit; and all_listen) for each mote, from the generated malicious \"powertrace\" dataset, the total energy consumption by each mote, during the simulation time (i.e., 60 min = 3600 s) is shown below. As shown in Figure 38, mote6, which is the compromised client that carried out the UDP flooding attack, consumed much more energy than any other legitimate client and the legitimate server in the UDP flooding attack scenario.