Table 3 Datasets used for validating generalization of the proposed IDS.
Dataset name | Domain | Features | # Samples | Characteristics | Attack types |
|---|---|---|---|---|---|
CICIoMT2024 | IoMT | 45 | \(\sim\)9,000,000 | 40 devices (25 real + 15 simulated); Wi-Fi, MQTT, Bluetooth; realistic device profiling | DDoS, DoS, Recon, MQTT-based, Spoofing (18 attacks—14 evaluated for this study) |
WUSTL-EHMS | IoMT | 44 | 16,318 | Real-time EHMS testbed | Man-in-the-Middle (Spoofing, Data Injection, etc.) |
CICIoT2023 | IoT | 47 | 7,332,065 | 105 real IoT devices; 33 attack types in 7 attack categories | DDoS, DoS, Recon, Web-based, Brute Force, Spoofing, Botnets (Mirai) |
ECU-IoHT | IoHT | 6 | 111,207 | Clinical testbed aiming at IoHT components; publicly available dataset for IDS generalization | Recon, DoS, Spoofing |
DF_IoMT | IoMT | 50 | 188,694 | Best suited for cross-domain generalization | DoS, DDoS, Exfiltration, Stealth Scan, Port Scan, TCP reset floods, Fast/short malicious sessions |
