[17]Auto-Encoder, random forest (RF), naïve Bayes (NB), Linear/Quadratic Discriminator CICIDS201783 Features/
2,830,540 recordsDistributed DoS (DDoS), Heartbleed, structured query language (SQL) Injection, Botnet.[18]Particle Swarm (PSO),
XG Boost, RFIoTID2083 Features/
450,00 recordsMirai, DoS, Scan, MITM[19]Auto-Encoders (AEs)NSL-KDD/IoTID20/
N-BaIoT43 Features/140,000
83 Features/450,000
114 Features/612,000Norm, DoS, Probe, R2L, U2R
/Mirai, DoS, Scan, MITM
/Normal, Bashlite, Mirai[20]Convolutional neural network (CNN), long short-term memory (LSTM), CNN-LSTMNSL-KDD/IoTID20/43 Features/140,000
83 Features/450,000Norm, DoS, Probe, root to local (R2L), user to root (U2R), /Mirai, DoS, Scan, MITM[21]LightGBM, Optimized Adaptive and Sliding Windowing (OASW)NSL-KDD/IoTID20/43 Features/140,000
83 Features/450,000Norm, DoS, Probe, R2L, U2R
/Mirai, DoS, Scan, MITM[22]Shallow CNNNSL-KDD43 Features/
150,000 RecordsNorm, DoS, Probe, R2L, U2R[23]Bagging, J48, KNN, Multilayer Perceptron (MLP), Ensemble.NSL-KDD/
IoTID2011–60 Features/
150,00–450,00Norm, DoS, Probe, R2L, U2R
/Mirai, DoS, Scan, MITM[24]Adaboost, DTKDDCUP99, UNSW-NB15, NSL-KDD, CICIDS201743–100 Features/
140,000–612,000DDoS, flooding, U2R, Jamming[25]Gradient Boosting Machines, RF, NB, Deep Neural Networks (DNN)ToN_IoT7 Features/
1,300,000 recordsNormal, DoS, DDoS, Injection, MITM, Password, Scan, Cross-site scripting (XSS), Backdoor, Ransome.[26]SVM, NB, SNN, RFN_BaIoT, Bot_IoT114 Features/
612,000 recordsNormal, Bashlite, Mirai[27]Adaboost, RusBoost,
Bagging, EnsembleWUSTL_IIOT-2018, N_BaIoT, and Bot_IoT100–114 Features/
100,000–612,000Normal, Bashlite, Mirai, Port/Address Scanner.[28]AdaBoostCICIDS 2019.88 Features/
4,201,795 RecordsDDoS, Heartbleed, SQL Injection, Botnet.[29]SNN, SVM, NB, RF, Self-organizing mapNSL-KDD, KDDCup99, ADFA-LD12, UNSWNB1543–100 Features/
140,000–612,000DDoS, flooding, U2R, Jamming[30]Ensembles:(Boosted DT, Subspace kNN, RUSBoosted DT), SNN, Bilayered NN, Logistic Regression KernelDistilled-Kitsune-2018/NSL-KDD dataset43 Features/
145,00–150,000Mirai, operating system (OS) Scan, Fuzzing, Video Injection, Address Resolution Protocol (ARP), Wiretap, simple service discovery protocol (SSDP), Synchronous DoS, secure sockets layer(SSL)/DoS, Probe, R2L, U2R[31]Beta Mixture ModelBoT-IoT 2112 Features/
3,000,000 recordsDoS, DDoS, Keylogging, OS and Service Scan, and Data exfiltration attacks[32]AdaBoost DTTON_IoT_2020 datasets7 Features/
1,300,000DoS, DDoS, Injection Attacks, MITM, Password Attacks, Scanning, XSS Attacks, Backdoor attacks, and Ransomware attacks.