## 1 Introduction  
The IoT comprises a selection of physical devices including sensors and microprocessors connected over a network and exchanging information. Depending on the application and setup, IoT devices can be found in a variety of places, such as homes, offices, industrial plants, and many other environments. These devices are deployed in a specific environment to provide several services, such as controlling home appliances in a smart home, remotely monitoring temperature and humidity in an agricultural farm, and supervising the operation of robots in manufacturing and production plants. This wide range of applications requires a variety of specific services, making ubiquity and inconspicuousness two important characteristics of these devices [1]. It is estimated that over 50 billion IoT devices will be connected in the next few years [2]. The simplicity of setting up an IoT system and the ease of extracting the needed information make it suitable for a lot of needed services. At the same time, this allows attackers to target these devices to take advantage of the information and services provided. Similarly, the recent literature shows that the number of Distributed Denial of Service (DDoS) attacks has significantly increased in the last decade. One of the reasons for this increase is that more devices are connected to the internet every day. Thus, it is easy for the attacker to attack the weakly configured IoT devices and take them over in a form of enslavement in order to launch DDoS attacks. Therefore, sophisticated security mechanisms are needed to provide enough security to these devices. The aim of a security mechanism is to protect the IoT devices in a smart home setup from enslavement, where a bot program--malware--is installed by the attacker on one of the devices connected to the home network. The bot program can operate as a bot master infecting other devices on the same network. It will turn infected appliances into zombie devices and will perform malicious actions, such as flooding attacks i.e., DDoS attacks. Several solutions to protect IoT devices from DDoS attacks are described in the literature. Some security mechanisms employ deep learning models to train a neural network that will be used to detect malicious activity patterns in the network traffic originating from IoT devices. However, such solutions are only favorable in those situations when the IoT devices are provided with high processing power and enough memory [3]. Another proposed solution is to use a cluster of Raspberry Pis to control the entire home IoT network [4; 5]. However, in this case, the management of the cluster would be challenging to maintain. Lightweight security is a favorable solution for protecting IoT devices from enslavement. One of the reasons for this is that IoT devices have limited memory and processing power, making lightweight security protocols a better option [6; 7]. This solution is designed for IoT devices that require extra management on the network layer. Therefore, modifying the network layer protocols requires supplementary work and management. The work presented in this article proposes a security framework for a home environment. The proposed solution scheme is described in a two-part experimental scenario. First, an attack is launched to enslave an IoT device by installing malicious code. The enslaved IoT device will be transformed into a bot that will infect the other connected IoT devices with the same malicious code. The infected devices turned into bots will launch a staged DDoS attack on the targeted server. Second, a security mechanism is devised to monitor traffic and detect the unusual traffic activity on the edge router from the IoT devices now turned into bots. The edge router is programmed to block unusual traffic from the bots. Then all open ports on the IoT devices will be blocked to prevent future malicious connections. Finally, the edge router will distribute the information about the unusual traffic to the rest of the routers on the same network.