Table 1 Distribution of attack types in five datasets.

From: An IoT intrusion detection framework based on feature selection and large language models fine-tuning

NF-CSE-CIC-IDS2018-v2

NF-ToN-IoT-v2

CIC-ToN-IoT

NF-UNSW-NB15-v2

NF-BoT-IoT-v2

Class

Count

Class

Count

Class

Count

Class

Count

Class

Count

DDOS attack-HOIC

1,080,858

Benign

6,099,469

Benign

2,515,236

Analysis

2299

Benign

135,037

DoS attacks-Hulk

432,648

Scanning

3,781,419

Backdoor

27,145

Backdoor

2169

DDoS

18,331,847

DDoS attacks-LOIC-HTTP

307,300

xss

2,455,020

dos

145

Benign

2,295,222

DoS

16,673,183

Infilteration

116,361

ddos

2,026,234

ddos

202

DoS

5,794

Theft

2,431

SSH-Bruteforce

94,979

Password

1,153,323

Injection

277,696

Exploits

31,551

Reconnaissance

2,620,999

Bot

143,097

dos

712,609

mitm

517

Fuzzers

22,310

  

DoS attacks-GoldenEye

27,723

Injection

684,465

Password

340,208

Generic

16,560

  

FTP-BruteForce

25,933

Backdoor

16,809

Ransomware

5098

Reconnaissance

12,779

  

DoS attacks-SlowHTTPTest

14,116

mitm

7723

Scanning

36,205

Worms

164

  

DoS attacks-Slowloris

9512

Ransomware

3425

xss

2,149,308

Shellcode

1427

  

Brute Force -Web

2143

        

DDOS attack-LOIC-UDP

2112

        

Brute Force -XSS

927

        

SQL Injection

432

        

Benign

16,635,567

        

Total

18,893,708

Total

16,940,496

Total

5,351,760

Total

2,390,275

Total

37,763,497