# Multi-Class Intrusion Detection Based on Transformer for IoT Networks Using CIC-IoT-2023 Dataset
## 2 Methodology
### Cic-IoT-2023  
As of 2023, CIC-IoT-2023 stands out as the largest IoT dataset [16], derived from real IoT devices. The dataset contains data from 105 IoT devices, documenting 33 recorded attacks. Notably, these attacks were launched by malicious IoT devices targeting other IoT devices. In addition, CIC-IoT-2023 also contains multiple attack types that do not exist in other IoT datasets  
Table 2 provides the number of each label containing benign traffic. This dataset contains a total of 46 features and 1 label. Different from the 84 features of CSE-CIC-IDS2018, CIC-IoT-2023 has 37 fewer features. In this experiment, no specific feature screening was performed, and all features were used directly to conduct the experiment.  
\begin{table}
\begin{tabular}{c c c c c} \hline
**Paper** & **Dataset** & **Classification** & **DL Method** & **Accuracy** & **Inference Time 1** \\ \hline
[9] & CIC-IoT-2023 & Multi-class & Deep Reinforcement Learning & 95.60\% & \\
[10] & CIC-IoT-2023 & Multi-class & LTSM & 98.75\% & \\
[11] & CIC-IoT-2023 & Not Mentioned & Gradient Boost, MLP, Logistic Regression, and KNN & 95.00\% & \\
[13] & CIC-IoT-2023 & Binary, Multi-class & DNN, Autoencoder, FCN & Multi-Class \\
[8] & KD999 & Multi-class & RNN, U-Net, TCN, and TCN + LSTM & 97.7\% & CNN: 5 (min/epoch) \\ \hline \end{tabular}  
* 1 Inference time is copy from references.  
\end{table}
Table 1: _Cont._  
Figure 1: Architecture diagram of this paper.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Label** & **Quantiys** & **Label** & **Quantiys** & **Label** & **Quantiys** \\ \hline DDoS-ICMP\_Flood & 7,200,504 & Mirai-greeth\_flood & 991,866 & DoS-HTTP\_Flood & 71,864 \\ DDoS-UDP\_Flood & 5,412,287 & Mirai-udpplain & 890,576 & Vulnerability Scan & 37,382 \\ DDoS-TCP\_Flood & 4,497,667 & Mirai-greip\_flood & 751,682 & DDoS-SlowLoris & 23,246 \\ DDoS- & & DDoS- & & \\ PSHACK\_Flood & 4,094,755 & ICOMP\_Fragmentation & 452,489 & DictionaryBruteForce & 13,064 \\ DDoS-SYN\_Flood & 4,059,190 & MITM-ArpSpooding & 307,593 & BrowserHijacking & 5859 \\ DDoS-RSTFINFolood & 4,045,190 & DDoS- & 286,925 & CommandInjection & 5409 \\ DDoS- & & DDoS- & & \\ SynonymousIP\_Flood & 3,598,138 & ACK\_Fragmentation & 285,104 & SQL Injection & 5245 \\ DoS-UDP\_Flood & 3,318,595 & Recon-HostDiscovery & 178,911 & XSS & 3946 \\ DoS-TCP\_Flood & 2,671,445 & Recon-OSScan & 134,378 & Backdoor\_Malware & 3218 \\ DoS-SYN\_Flood & 2,028,834 & Recon-PortScan & 98,259 & Recon-PingSweep & 2262 \\ Benign & 1,098,195 & DDoS-HTTP\_Flood & 71,864 & Uploading\_Attack & 1252 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The number of each label containing benign traffic.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Feature** & **Name** \\ \hline
1 & Flow duration \\
2 & Header Length \\
3 & Protocol \\
4 & Type \\
5 & Duration \\
6 & Rate Mrate Date \\
7 & fin flag number \\
8 & syn flag number \\
9 & rst flag number \\
10 & psh flag number \\
11 & ack flag number \\
12 & ecc flag number \\
13 & cwr flag number \\
14 & ack count \\
15 & syn count \\
16 & fin count \\
17 & urg count \\
18 & rst count \\
19 & HTTP \\
20 & HTTPS \\
21 & DNS \\
22 & Telnet \\
23 & SMTP \\
24 & SSH \\
25 & IRC \\
26 & TCP \\
27 & UDP \\
28 & DHCP \\
29 & ARP \\
30 & ICMP \\
31 & IPv \\
32 & LLC \\
33 & Tot sum \\
34 & Min \\
35 & Max \\ \hline \hline \end{tabular}
\end{table}
Table 3: The features used in CIC-IoT-2023.  
We chose all the above features because all of these features lack redundancy. This method ensures better accuracy.