# Detection and Prevention of DDoS Attacks on the IoT
## 1 Introduction  
In recent years, the Internet of Things (IoT) [1] based on Wireless Sensor Networks (WSNs) has become more and more developed. The purpose of the IoT is to access data from each other through the remote connection of machine to machine (M2M) without human operation. The architecture of the IoT can be divided into three layers, named the sensing layer, network layer, and application layer. To meet the heterogeneous network architecture in the IoT system, most people choose to add a network layer gateway for heterogeneous network processing and upload the processed information to the cloud. Most gateways only process the heterogeneous network information and configure sufficient minimum storage capacity. The limitation of storage capacity makes it impossible for users to install anti-virus software on IoT devices, resulting in many potential loopholes. With the rapid development of network technology, the speed of data exchange between devices is getting faster and faster. In the case of vulnerabilities in the system software or firmware, attackers can not only steal the data collected from the device for selling personal data, phishing, spreading spam, etc., but can even launch distributed denial of service (DDoS) attacks against other targets by controlling the device [2]. It is difficult for common users to detect the device being attacked or controlled for the first time until network resources or system resources are affected and network services are temporarily delayed or interrupted. Therefore, we hope to make future IoT devices more secure by analyzing network packets to prevent blocking attacks. There is already much literature proposing a variety of methods to lessen the effect of DDoS on IoT [3, 4, 5, 6]. In addition, with the development of artificial intelligence, various algorithms have been applied in different fields. Deep Learning is a framework belongingto artificial intelligence, which is derived from the Neural Network (NN) framework improved by [PERSON] et al. in 2006 [PERSON] et al. (2006). It can analyze sequential data and has been applied to many fields, such as speech recognition, image recognition, natural language processing, etc. Through [PERSON] et al. (2006); [PERSON] et al. (2006); [PERSON] et al. (2006); [PERSON] et al. (2007); [PERSON] et al. (2008), it can be demonstrated that deep learning can be applied to intrusion detection systems and can effectively improve the efficiency of network information security detection. However, the identification results on the edge computer when measured under different conditions, in which Feature is the identification result of the feature model, and Flow means the identification result of the traffic model. Therefore, we conducted our research using the related neural network approach. The proposed architecture of edge computing with a trained CNN model will make correct identifications under the normal transmission, SYN flood attack, UDP flood attack, ICMP flood attack, and MIX flood attack, respectively. In this proposal, we would like to maximize the use of information about changes in related characteristics when packets are transmitted in the system, which can effectively improve the accuracy of recognition and make up for the shortcomings of using a single model for judgment. Some relevant pieces of literature about machine learning (ML) based methods to mitigate DDoS attacks in IoT systems in recent years will be reviewed below. An evaluation of using a Random Neural Network (RNN) trained by normal traffic data compared to the Long-Short Term Memory (LSTM) to detect SYN flood DDoS attacks was provided in [PERSON] et al. (2007). It shows better results in RNN than LSTM, but its accuracy was almost 81% and not considered better enough to rely on. In [PERSON] et al. (2007), a new deep neural network to identify the network flows being normal or abnormal was presented.