## 3 Deep-Learning-Empowered Security Solutions for IoT Systems
### Detecting Threats and Taking Preventative Action  
It is possible to launch multiple layers of attacks against IoT systems, one of which is the hacking of discreet devices. For instance, major attacks, e.g., ransom attacks, can be launched on one layer, and further attacks, e.g., sophisticated attacks, can be launched on additional layers. The cryptographic primitives used by conventional attack mitigation and detection methods are imperfect and prone to false positives. Therefore, many methods have been attempted, e.g., K-NN, SVM, ANN, etc. Taking advantage of foggy conditions, [PERSON] and [PERSON] proposed a deep-learning-based attack detection algorithm for the IoT in [69]. The attack detection method is essentially launched in smart edge devices in a distributed manner. The proposed method aims to implement deep learning models as close to the network edge as much as possible such that the model can provide the output quickly and accurately. [PERSON] et al. [69] similarly proposed another distributed deep-learning-based attack detection mechanism for the IoT. Based on fog computing architecture, they put into place deep learning methods for attack detection. The proposed method places an emphasis on dialogue between the fog and the objects. For optimal resource utilization and minimal communication latency, a detection mechanism should be deployed in the fog layer, where the learning module is also activated. [PERSON] et al. [70] developed an anomaly identification method based on the combination of the clustering method and RNN models. With the help of deep learning, the method suggested in [71] can spot DGAs. In particular, a series of models, e.g., LSTM, GRU, and CNN, was applied in this study. For the purpose of multiparty computation and secure IoT devices, the research effort reported in [72] presented a federated architecture that operates using a deep learning technique. We provide a brief summary of the main studies included in this section in Table 2.  
Regarding the identification of a compromised IoT, [PERSON] et al. [75] presented a self-learning system called DToT, which was tested on a self-generated dataset. [PERSON] et al. [73] proposed the use of LSTM to search for Opcode-based IoT malware. To test the efficacy of the proposed framework, Opcodes for running IoT applications built on the ARM architecture were used. This approach uses text mining, a feature selection technique, to extract a useful feature vector from Opcode. In addition, [PERSON] et al. [69] incorporated both deep and shallow learning models to identify an intrusion in the IoT. [PERSON] et al. [62] identified a botnet by conducting an analysis on the statistic data of the communications among nodes in the IoT, e.g., packet info, transmission duration, etc. Using both content and metadata, [PERSON] et al. [78] presented an LSTM-based method to identify bots. Attacks on IoT devices can be identified by patterns in their operating codes (Opcodes), as demonstrated by [PERSON] et al. [79]. To distinguish between safe and harmful programs, they first converted the Opcodes into a vector space and input the vector to the deep learning model. In their study, a CNN with an Adaboost classifier was utilized as the algorithm. In addition, [PERSON] et al. [76] adopted packet information and employed a bidirectional LSTM to assess whether the packet was harmful. In particular, they used traffic information from both the botnet and regular IoT in their experiment. [PERSON] et al. [77], on the other hand, develop a Q-learning-based malware detection method for mobile devices that does not require any prior knowledge of the mobile device's trace generation and bandwidth. The author investigated the static malware detection game and its Nash equilibrium (NE) on a time-variant wireless network.