# Detecting IoT Attacks Using an Ensemble Machine Learning Model
## 3 Proposed Approach  
Our objective is to use ensemble machine learning techniques for detecting attacks in an IoT system. This is because deep neural networks require substantial resources, such as memory. The goal is to come up with the best ensemble method and to apply it for real-time attack detection. Figure 2 outlines the proposed approach with three layers: thing, fog and cloud. It involves the following three steps (also shown in Figure 2): (1) data collection at the cloud layer, (2) running the ensemble algorithm on the cloud and selecting the best model, and (3) running the best selected algorithm in the cloud. The description of the above tasks is given below. 1. **Data collection at Cloud Layer** This step involves collecting data from the thing layer and passing it to the cloud layer. To accomplish this, data from the thing layer can first be transported to the fog layer. The fog layer can then transport it to the cloud layer. While transporting the data to the cloud layer, the fog layer can also filter data to decide which data to be transported to the cloud. IoT attacks can be predicted using the following attributes: (1) login details, (2) the fields of network data packets, such as fragment details, protocol type, source and destination address, (3) service type, (4) flags, and (5) duration. We provide detailed information about the data used in our simulation in the next section. 2. **Selecting a best model on the cloud** The objective of this step is to combine various basic machine learning classifiers (such as naive Bayes, KNN, and decision trees) with ensemble techniques (such as stacking, bagging, and voting) to obtain optimal results (accuracy, precision, execution time). As this is a time-consuming step, we recommend running it in the cloud. In addition, we simply apply the basic machine learning classifiers, as they require a short execution time. Figure 3 illustrates this step by including four layers: (1) the data layer, (2) the base layer, (3) the meta-layer, and (4) the method selection layer. In the data layer, collected data from the previous step is pre-processed and fed into the base layer. The base layer applies different combinations of base classifiers, such as naive Bayes (\(B_{1}\)), decision trees (\(B_{2}\)), and KNN (\(B_{3}\)). The results of these combinations are then fed into the meta layer, where ensemble methods, such as stacking (\(E_{1}\)), bagging (\(E_{2}\)), and voting (\(E_{3}\)), aggregate the outcomes. Each ensemble method is evaluated in terms of accuracy, precision, recall, and ROC and execution time. Further, the model with a combination of base classifiers and an ensemble method that yields the best results is selected. Algorithm 1 describes the above-proposed approach in detail. The input parameters of the algorithms are: (1) base classifiers (i.e., \(B=B_{1},B_{2},B_{3},\ \ldots\ B_{n}\)), (2) ensemble methods (i.e., \(E=E_{1},E_{2},E_{3},\ \ldots\ E_{m}\)), and (3) training dataset (D). At the first two lines of the algorithm, the output and the result (i.e., variable OUTPUT and Result in Algorithm 1) are initialized to \(NULL\). The third line initializes the execution time to the maximum value. In the fourth line, we store all the combinations of the base classifiers (i.e., using the function findAllCombinations) in variable \(C\). The proposed approach aims to determine the best combination and the best ensemble method. Therefore, in line 5, we iterate each of the combinations, and then, again, in line 7, each base classifier in the corresponding combination is iterated. Each base classifier is applied to the training dataset (D) with the outcome being stored in \(o\) (line 8). Line 10 involves an iteration of the ensemble methods and the application of each ensemble method to the outcome (\(o\)) at step 11. At line 12, the ensemble result is calculated in terms of accuracy, precision, recall, etc. Further, at line 13, the execution time of the combination of base classifiers and an ensemble method is calculated.