Moustafa, Nour. "New generations of internet of things datasets for cybersecurity applications based machine learning: TON_IoT datasets." In Proceedings of the eResearch Australasia Conference, Brisbane, Australia, pp. 21-25. 2019.

• Anomoly/Intrusion Detection:

There are several techniques useful in classifying the Anomoly as in general the detection problems are always depends on the classification of the datapoints from the given dataset. The Datapoints are classified with multiple labels of the Datapoints in the Dataset. The detection problem is always a classification due to it's quantitatively bounded labeling towards a classfier. Hence, Classfification ML techniques like

Support Vector Machine (SVM), Regression(Linear,Logistical,Sine/Cosine/Tanh non-linear functions etc...), Bayesian probabilistic method(Naive Bayes Algorithm), K - Nearest Neighbour methods are useful here.

• Feature Engineering Principles:

Identifying the Featrues that significantly impacts Detection outcome/results could be an efficient way of building a Machine Learning model. There are many feature engineering principles aids to normalize the Machine Learning models. The list includes,

1. Statistical Inferences like Finding Covariance, Cofactors, Mean, Median

and Mode along with Standard Deviation makes the samples normalized.

2. The regularization priciples from Machine learning data analysis feature

engineering techniques could improvise the dataset prior to use it for

Training the model.

3. Quantifying the data with Qualitative analysis and both categorical,

numerical variables and incorporating them into finding probabilities of

existence in Gaussian functions.

4. PCA (Principle componenet Analysis) to distribute entire datasamples

towards two axile of the multidimensional space and making sure the

data points are centralized towards the larger axis and roate the smaller

axis by 90 degree to the right. Once, the axis is with data spread towards

the larger axis and smaller axis in the oposite direction with data samples

on it could be send to higher dimensionality for further understanding

about the data and shrniking back with less number of features to smaller

dimenional planes(like a 2-D rectangular plane).

5. Finding Inter Quartile range of the dataset with five pointer values like

minimum, maximum, IQR(Q3-Q1), Mean and Median could give the better

idea about the datasample to distribute it towards the normal

standardized samples.

• Tried combining multiple sources (e.g., telemetry + network + logs):

Use python libraries of nd.array/tensorflow to combine multiple sources

data. If you are intereseted in R Dataframe helps in gathering data from

different sources to a CSV and merge them into a Dataframe for easy

usage with in the Machine Learning Statistical approaches.

Here is one of the IOT research article from Google Scholar would help.

M. Panda, A. A. A. Mousa and A. E. Hassanien, "Developing an Efficient Feature Engineering and Machine Learning Model for Detecting IoT-Botnet Cyber Attacks," in IEEE Access, vol. 9, pp. 91038-91052, 2021, doi: 10.1109/ACCESS.2021.3092054.

keywords: {Feature extraction;Botnet;Convolutional neural networks;Training;Support vector machines;Malware;Network intrusions;IoT;botnet;K-Medoids;scatter search;DMLP;A2DE;JChaid*;CNN;K-means clustering;genetic algorithm;macro precision;macro recall;macro F1-score;UNSW-NB15 dataset},