# Mitigation against DDoS Attacks on an IoT-Based Production Line Using Machine Learning
## 2 Materials and Methods
### Machine Learning  
Apache Spark ([[https://spark.apache.org/](https://spark.apache.org/)]([https://spark.apache.org/](https://spark.apache.org/)) (accessed on 18 February 2021)) is a unified analytics engine for large-scale data processing. Spark provides several possibilities for the implementation of machine learning, specifically in the Spark's machine learning library (MLLib), which is also suitable for the tested solution, because it meets the assumption of scalability [22]. A native SCALA language or a Python language could be chosen. The native SCALA language is characterized by performance and wide support. Python, which, according to the available data, is slightly less powerful, in turn, allows for easy integration of the components used. MLLib supports both of these options. Python API written in python to support Apache Spark (PySpark) and the MLLib library were used to validate the solution. The integration architecture is shown in Figure 3.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Column Name** & **Desc** & **Type** \\ \hline
**FLOWINDICATOR** & Type of FLOW agent & string \\
**AGENT\_ADRESS** & IP address of agent & IP4 address \\
**INPUT\_PORT** & Input port & Number \\
**OUTPUT\_PORT** & Output port & Number \\
**SOURCE\_MAC\_ADD** & Source MAC address & Hex value \\
**DEST\_MAC\_ADD** & Destination MAC address & Hex value \\
**ETHERNET\_TYPE** & Ether type of Ethernet frame & Two Octet \\
**IN\_VLAN** & Input virtual LAN & Number \\
**OUT\_VLAN** & Output virtual LAN & Number \\
**SRC\_IP** & Source IP address & IP4 address \\
**DST\_IP** & Destination IP address & IP4 address \\
**IP\_PROTOCOL** & Type of IP protocol & Number \\
**IP\_TOS** & IP type of service & One Octet \\
**IP\_TTL** & IP Time to live & Number \\
**SRC\_PRT\_OR\_ICMP\_TYPE** & Source Port IP, ICMP type & Number \\
**DST\_PRT\_OR\_ICMP\_COD** & Dest. Port IP, ICMP code & Number \\
**TCP\_FLAGS** & TCP flags & Hex value \\
**PACKET\_SIZE** & Packet Size & Number \\
**IP\_SIZE** & IP Size & Number \\
**SAMPLING\_RATE** & Sampling Rate of Agent & Number \\ \hline \hline \end{tabular}
\end{table}
Table 1: The output form of the data.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Ethernet Type** & **Description** \\ \hline
0 \(\times\) 0800 & Internet Protocol version 4 (IPv4) \\
0 \(\times\) 0806 & Address Resolution Protocol (ARP) \\
0 \(\times\) 86 dd & Internet Protocol version 6 (IPv6) \\
0 \(\times\) 8892 & PROFINET Protocol \\
0 \(\times\) 88 cc & Link Layer Discovery Protocol (LLDP) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Used communication protocols.  
The input data have undergone a process of normalization. A part of the transformation took place in the sFlow collector. The sFlow collector transformed the packet into structured data. Another necessary step was to further adjust the data to values that could be used for learning, testing, and subsequent neural network verification. Data that use hex and vinegar data types have to be transformed into numeric values. An extract, transformation, and loading are shown in Figure 4.  
The final transformation and validation were performed using pyspark.sql, where it is possible to operate with whole columns, and can relatively easily perform the necessary conversions and validation of values. NewDF was defined for the entire structure, which specifies the type for each column. Columns where Hex, Octa, or String were used were defined as String. For these parameters, it was necessary to do another conversion, but only at the time when the data was loaded into the dataset. This section overlaps in Figure 4 in the Data Transformation and Machine Readable Data sections. The Spark dataset only needs to be processed using the methods offered by pyspark.