# Network Attack Classification in IoT Using Support Vector Machines +
## 1 Introduction  
The Internet of Things (IoT) is increasingly becoming a bigger part of our everyday routine. Smart heterogeneous IoT devices are now connected to each other, forming their own network that can be accessed remotely. IoT applications include smart cities, intelligent transportation, responsive environments, and many more, which rely on timely and reliable data to achieve their full potential. Lack of, or compromised data, due to device failure or malicious intrusion within the IoT, may result in unfortunate and unforeseen outcomes. Early detection of misbehavior and early response to the intrusion or device failure can preserve and maintain the application's goal. Establishing a secure and reliable network partially depends on preventing and anticipating possible threats. Threats can be environmental, physical, but also intentional. Environmental and physical threats can be prevented, to some extend, by ensuring that proper infrastructure security is applied. Malicious disruptions of the IoT network data flow may also be prevented for some of the known threats. The device connecting the IoTnetwork to the Internet (called the Gateway or Sink node) can prevent malicious threats from acting on the network based on a predefined set of rules that allow or disallow communications. The set of rules is usually applied through the use of a firewall. Nevertheless, there exist new threats and/or variations of old threats, which cannot be anticipated and can penetrate the prevention security measures and attack the network. Detection of intrusions at an early stage can prevent attacks from causing irreversible damage. There are two major detection methods in intrusion detection systems (IDS): the pattern detection-based mechanism and anomaly detection-based mechanism [1]. The former relies on knowledge of existing attacks and their patterns; whereas the latter can capture never before seen attacks by identifying abnormalities within the network. Despite the maturity of IDS technology for traditional networks, current solutions are inadequate for wireless sensor network (WSN) and IoT systems, because of IDS computational and memory requirements. The processing and storage capacity of network nodes that host IDS agents is an important issue. In traditional networks, the IDS agents are deployed in high computational and memory capacity devices. The IoT networks are usually composed of nodes with resource constraints in which finding nodes with the ability to support IDS agents is harder. Furthermore, the IoT network architecture plays a decisive role in the selection of security measures to be employed. In traditional networks, end systems are directly connected to specific nodes (e.g., wireless access points, switches, and routers) that are responsible for forwarding the packets to the destination. WSN and IoT networks, on the other hand, are usually formed in wireless mesh topologies, using multi-hop communication to reach the gateways and/or the destination. The WSN and IoT use network protocols to establish multi-hop communication that are not employed in traditional networks, bringing new security challenges. Network routing protocols such as IPv6 over Low-power Wireless Personal Area Network (6 LoWPAN), IEEE 802.15.4, and Pv6 Routing Protocol for Low-Power and Lossy Networks (RPL) are some of the protocols that are being used. The selection of routing protocol relies on, among others, the IoT application and device specifications making each IoT network specific enough to the application and less compliant to the standard security measures. The current work evaluates supervised learning techniques as anomaly detection techniques using actual network traffic and concludes that using activity from a compromised setting has better results. The main anomaly profiling techniques can be categorized as applying thresholds, game theory, fuzzy logic, machine learning, and biologically inspired techniques.