# Detecting IoT Attacks Using an Ensemble Machine Learning Model
## 2 Background and Related Work
### ML-Specific Related Work on Security and Privacy  
A comparison of related work on ML-specific attack detection can be seen in Table 1, including the ML (machine learning)/DL (deep learning) used, the pre-processing features, and performance analysis performed. During the pre-processing step, encoding (E), scaling (S), normalization (N), and dimensionality reductions (D) are taken into account. Furthermore, as part of the performance analysis, accuracy, receiver operating characteristic (ROC) curve, F-score, Matthews correlation coefficient (MCC), and detection rate (DR) are considered. In [13; 19; 20], decision trees and rule induction are used to explain under what conditions a specific type of attack (DoS, authentication attacks, and probe attacks) occurs on a network. In this approach, encoding is used as a pre-processing technique, while accuracy is used to evaluate the effectiveness of the method. Although this is a valuable state-of-the-art approach, it cannot guarantee that any rules from decision trees will be applicable for large sets of data because overfitting poses the greatest risks. Further, in [21], principal component analysis (PCA) is utilized with a decision tree to detect and investigate the reason of the anomalies. The previous works of [7; 8; 13; 22; 23] show that attacks can be predicted with high accuracy by using deep learning neural networks, either as a standalone technology [7; 8] or in combination with optimization [22; 23] or machine learning algorithms [9; 13]. More precisely, [9; 13] combine artificial neural networks (ANNs) with support vector machines (SVMs), which provide significantly higher detection rates than standalone deep learning or machine learning algorithms. Particularly, [13] develops the hybridization by including the SVM with ANN but also combining that fusion with a genetic algorithm (GA) and particle swarm optimization (PSO). This hybridization achieves a 99.3% accuracy rate. The dimensionality reduction factor is also explored in a wide variety of works. The studies of [10] and refs. [11; 12] used principal component analysis (PCA) with ANN and showed an efficacy of 91 percent F1-scores. Researchers from [28] have also explored dimensionality reduction with one-hot encoder and combined outlier analysis, which increased performance by 2.96 percent and 4.12 percent higher than CNN and RNN. This approach to dimensionality reduction with machine learning yields a mix of higher and average results. In addition, it is still unclear how many dimensionality reduction algorithms will fit within a single model to provide an optimal outcome. A combination of latent Dirichlet allocation (LDA) and a genetic algorithm is used in [24], which provides a below-average accuracy rate of 88.5 percent and a false positive rate of 6 percent. The results are improved even more by techniques such as logistic regression and autoencoder. The study of [25] uses an autoencoder with LSTM and carries out experiments on a number of autoencoders, hitting the AUC score of 96 percent. Multinomial logistic regression provided a 99 percent ROC for finding anomalies in [26]. The idea of ensemble learning has also been explored by several authors. One of the appealing results, with 99.6 AUC, is provided by using XGBoost in [27]. The literature review covered almost all taxonomies of machine learning, from decision trees to neural networks, and from regression (logistic) techniques to ensemble learning. Following an extensive assessment, it was determined that a deep neural network with some optimization algorithm or ensemble learning could provide an impressive detection rate and the least false alarm rate of attacks. Additionally, feature engineering is also required to improve this model.