**5. Proposed model**

This section explains the methods and techniques that we apply to the tasks in the tasks of the proposed model in **Figure 1**.

#### **5.1 Data pre-processing**

Collecting a large amount of attack traffic and normal traffic in a large real-time network is time and money-consuming. It needs significant resources, a diversity of normal IoT traffic, and a diversity of attack traffic. Instead, there are publicly available network traffic datasets, which can be used for this task. We analyze some of the available datasets based on the following:


The CICIDS2019 includes inbound and outbound traffic of the most advanced DoS and DDoS attacks. It contains lots of network flow-related characteristics and different types of current DoS and DDoS IoT attacks traffic collected over real-time networks.
