# Network Attack Classification in IoT Using Support Vector Machines +
## 5 Related Work  
SVM has been used to detect attacks in network traffic, power grids, WSN, the IoT, and even detecting the physical presence of an intruder within the network's perimeter [9, 17, 22, 23, 24, 25, 26]. Based on the nature of the detection, the SVM's training vectors can be populated with data features, different class definitions and various number of classes. The work in [25] proposes SVM in combination with Linear Discriminant Analysis (LDA), the so-called SVM-L. They use network traffic HTTP requests to detect web attacks including SQL injection attack, cross-site scripting (XSS) attack, and directory traverse attack. The work in [26] detects abnormalities in the IoT using SVM and sensor readings in Industrial IoT to capture False Data Injection (FDI) attacks. The authors in [22] use SVM as one of the supervised machine learning detection algorithms to detect false data injection attacks (FDIA) in smart power grids. The SVM was trained with malicious and benign vector data and two detection models were created, each using either a linear or a Gaussian kernel. They concluded that the selection of the kernel can affect the performance of the SVM, specifically the Gaussian kernel outperformed the linear kernel in one of the testing systems, whereas in the rest of the systems they had the same performance. As with this work [22], we also concluded that Radial Basis Function (the Gaussian RBF kernel) performs better when used in Network routing layer attacks. The works in [17, 23] use multi-class SVM techniques for detecting malicious intervention for various attack types. The authors in [23] propose a multi-class SVM IDS approach and the authors in [17] propose multi-class least square SVM (LS-SVM) to evaluate traditional Internet traffic. Both use the KDD-99 dataset which includes traffic from a benign state of the system (no attack was present) and system activity from four types of attacks: the \"probe\", \"denial of service (DoS)\", \"user to root (U2R)\", and \"remote to local (R2L)\". They have shown that the SVM can be suitable for detecting malicious intervention. In the current work we are using a binary classification, thus we label the training data to either benign or malicious. Unlike [17, 23], in our work the training data was taken from a WSN and IoT network. The work in [24], proposes SVM IDS for the WSN as a decentralized security approach. Due to the resource-constrained nature of the WSN nodes, the SVM IDS model is created and updated outside the WSN network. The newly updated support vectors are transmitted to the cluster heads of the network which in turn monitor and detect network activity. As in the current work, the training data was classified as benign and malicious. However, the work was evaluated using the KDD-99 dataset; whereas, the current work is evaluated using routing layer parameters taken from constrained sensor nodes executing either a benign or a malicious application. The OC-SVM detection model has also been used to detect abnormal network flow in traditional networks and the presence of an intruder within a WSN [5, 27]. The work in [27] uses SVM as part of a Network Intrusion Detection System (NIDS) and trains the detectionmodel using malicious network activity. The OC-SVM achieved the highest results only when using two network flow characteristics; the TCP flags and information from the IP protocol. They managed to correctly identify all the benign activity and 98% of the malicious activity. The work of [5] is more closely related to the proposed work, as they create a detection model using OC-SVM with only one class label (the normal behavior activity). The activity was taken from benign WSN network activity and sensing data. The authors support that by creating a hyperplane using only benign behavior, any deviation from the hyperplane, caused by an unknown or known attack, will be detected. They propose a centralized detection approach, in which the central node (the Sink) has no memory and computational limitations.