## 3 Materials and Methods
### Implementation of Adversary for Real-Time Testing and IDSH Dataset Collection  
The ToN_IoT dataset contains thermostat data, including temperature, thermostat status, timestamp, date, label, and type. However, this dataset is not generalized and may not be suitable for smart home applications operating in different environmental conditions. In addition to sensor data, every data packet sent through a network by an IoT device contains additional information, such as connectivity and network protocols. This provides raw information about the internal and external activity of these IoT devices, complementing sensor data. In this study, we used network features, such as connection activity, statistical activity, and DNS activity, to train the IDS deployed on IoT devices. For IDS implementation on the IoT devices in our smart home, specifically, the smart thermostat, we generated our own dataset named the IDSH dataset, available on Kaggle [22]. This dataset combines sensor data, thermostat status, and network features (i.e., connection activity and statistical activity) for MITM, DoS, and normal traffic. The smart thermostat is designed to monitor the indoor temperature and humidity of the room and control the air conditioner by sending ON/OFF signals. The temperature and humidity are measured by the thermostat using a DHT22 sensor. These measurements are sent to a web application via an HTTP POST request, which receives the data and displays the indoor temperature on the webpage. Additionally, the user can control the air conditioner remotely through the web application by sending ON/OFF commands. In this work for testing the accuracy of an IDS deployed on a smart thermostat, the adversary is implemented with Kali Linux scripts running on Raspberry Pi 4. The attacker node generates the MITM, and DoS attacks on the smart thermostat communicating with the cloud server for data uploading and control signal input. The attacker node carried out MITM using Address Resolution Protocol (ARP) spoofing and DoS attacks on the smart thermostat by flooding them with the high volume of traffic and requests. The smart thermostat does not have access to packet analyzer tools like Wireshark and tcpdump for extracting network features. Therefore, we utilized the Esp32 IwIP library and socket library to extract real-time network parameters. The block diagram of the smart thermostat for collecting the dataset is shown in Figure 2. The parameters of the dataset collected at each step are shown in Figure 2.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**No. of Features** & **Selected Features** \\ \hline \multirow{2}{*}{10} & src\_port, dst\_port, src\_bytes, dst\_bytes, missed\_bytes, src\_ip\_bytes, \\  & dst\_ip\_bytes, dns\_query, dns\_qclass, http\_response\_body\_len, \\ \hline \multirow{2}{*}{15} & src\_port, dst\_port, service, duration, src\_bytes, dst\_bytes, missed\_bytes, \\  & src\_pkts, src\_ip\_bytes, dst\_pkts, dst\_ip\_bytes, dns\_query, dns\_qclass, dns\_qquery, dns\_qquery, dns\_qquery, dns\_qquery, dns\_qclosed, dns\_qquery, dns\_qThe steps involved in dataset collection are as follows:  
1. Setup the microcontroller by including header files for the lightweight IP and socket (lwip/socket.h). 2. Create, bind, and connect the server using the server IP and port. 3. Build a POST request and send the POST request to the web server. 4. The web server receives the POST request, displays the data, and responds to the smart thermostat with the status of the air conditioner (i.e., ON/OFF). 5. The smart thermostat receives the response and collects the features of the collected dataset as shown in Table 2.  
For MITM and DoS attacks, the adversary generates an MITM attack using the arpspoof command and a DoS attack using hping3. During the attack, we collected the dataset from the smart thermostat by following steps 1-5. We collected an IDSH dataset comprising 4144 samples, encompassing instances of normal traffic, DoS attacks, and MITM attacks.