# A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection +
## 2 Related Work
### Work on N-BaloT Dataset  
In [3], an IoT micro-security add-on is presented. The model comprises two key security mechanisms working cooperatively, namely: (i) a distributed convolutional neural network (DCNN) model for detecting phishing and application layer DDoS attacks, and (ii) a cloud-based temporal long short-term memory (LSTM) network model for detecting botnet attacks and ingesting CNN embeddings to detect distributed phishing attacks across multiple IoT devices. The N-BaloT dataset is used for training the backend LSTM model. The work closest to our proposal is Kitsune [24], an unsupervised learning approach to detect attacks online. Kitsune's core algorithm is KitNet, which uses a collection of autoencoder neural networks to distinguish between normative and abnormal traffic. The approach involves the integration of multiple autoencoders into a classifier. The experimental results show that Kitsune is effective with different attacks, and its performance isas outstanding as offline detectors. Similarly, the authors in [2] propose a network-based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. It is worth pointing out that the aforementioned methods, differently from our approach, create individual models per IoT device [2] or per attack [3], which are not suited to the ever-evolving IoT environments and security threats. Moreover, authors of [25] show that a single AE can obtain classification accuracy comparable to the ones published in the research literature for supervised networks and for more complex designs built around one or several AEs. In [26], the authors propose an ML-based method for efficient botnet detection in IoT networks. The approach uses a hybrid model which pipelines a trained variational autoencoder (VAE) for meaningful latent feature extraction, and a one-class classifier OCC to classify network traffic from the IoT devices. The experimental results on the N-BaloT dataset show that the latent representations generated from VAE help the OCC to perform better for botnet detection in terms of AUC metric with an acceptable detection time. Reference [27] proposes a federated-based approach which uses a deep autoencoder to detect botnet attacks using on-device decentralized traffic data. The proposed model, evaluated by means of the N-BaloT dataset, differentiates benign patterns of behavior from malicious activities by means of decentralized on-device data at the edge layer. In [28], the authors present a novel deep ensemble learning model framework called DeL-IoT for IoT anomaly detection. They use the deep and stacked autoencoders to extract features for stacking into an ensemble of probabilistic neural networks (PNNs) learning model for performance improvement while addressing the data imbalance problem. The N-BaloT dataset is used as a benchmark dataset. The approach can detect anomalies with 0.99 detection rate for this dataset. In [29], the authors propose nested Log-Poly, a communicationally efficient model for distributed density estimation in naive Bayes classification. The method is evaluated on the N-BaloT dataset. [PERSON] et al. present in [30] a botnet detection mechanism based on a one-class support vector machine (OCSVM). The approach incorporates an unsupervised evolutionary IoT botnet detection method using a grey wolf optimization (GWO) algorithm to optimize the hyperparameters of the OCSVM and simultaneously identify features that best describe the IoT botnet problem. The system is tested using the N-BaloT dataset and shows the best recall for the Samsung SHN 1011 N webcam device. Finally, [PERSON] et al. [31] propose an adaptive particle swarm optimization convolutional neural network (APSO-CNN) to detect intrusions in the IoT networks. The model achieves the best accuracy on the N-BaloT dataset if compared with three popular algorithms such as SVM, FNN and R-CNN.