# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 6 ML Performance Review in IDS  
### ML Performance Comparison  
This chapter reviews various ML techniques for DDoS attack detection, comparing their performance across multiple datasets. The analysis aims to identify patterns and determine the most effective models for this task. For each paper reviewed, the analysis prioritized the highest-performing models as reported for a given dataset. When a model was evaluated across multiple datasets, preference was given to the dataset containing the largest number of records, as larger datasets often provide more reliable performance insights. Although the BoT-IoT dataset is frequently used in these studies, this review preferred the TON_IoT dataset. This choice reflects the higher number of classes in the TON_IoT dataset in comparison to BoT-IoT (Section 5). However, identifying the \"best\" model without a settled benchmark is not an easy task. The performance metrics used, such as accuracy, precision, and recall, often vary significantly depending on the dataset characteristics, evaluation methodologies, experimental setups, and preprocessing. Understanding the specific contexts and limitations of each dataset is crucial. These are discussed in detail in Section 5. It is also important to note that the optimal models for binary classification tasks are not always the best for multiclass classification, as these tasks aim for different objectives and face various dataset characteristics, e.g., Ref. [45] proposed XGBoost for binary classification and Random Forest (RF) for multiclass classification. Inconsistent reporting of evaluation metrics across studies (e.g., [78]) is another challenge, which complicates direct comparisons. DDoS detection can be approached as either binary (e.g., distinguishing between attack and normal traffic) or multiclass (e.g., identifying specific types of traffic or attack categories). To perform analysis, specific metrics were extracted from each study, including accuracy, precision, recall, and F1 score, whenever reported. These metrics were selected based on their usability for the task and their ability to provide an even measure of model performance, particularly in the event of class imbalances. Some studies, such as [31], were excluded from this comparison due to ambiguity or the absence of precise numerical metrics. The datasets employed in the reviewed studies were examined to provide context for interpreting the findings. This was followed by the construction of comprehensive performance Tables 5 and 6. These sorted tables, presented on the basis of accuracy for both binary and multiclass classification tasks, reveal several significant trends in the field. A particular observation here is the prevalence of above 90% accuracy in a majority of studies, except in two cases when performance dropped below this rate ([36,66]). Performance in these models often results from the use of sophisticated methods like feature engineering, dimensionality reduction, and algorithm-level optimizations that play a significant role in providing high performance in DDoS detection tasks. \begin{table}
\begin{tabular}{l c c c c l} \hline \hline
**Paper** & **Accuracy [\%]** & **Precision [\%]** & **Recall [\%]** & **F1 Score [\%]** & **Highest Accuracy ML Technique** & **Dataset** \\ \hline
[38] & 100 & 100 & - & 100 & GADAD-RF & TON\_IoT \\
[55] & 100 & 100 & 100 & 100 & RF & TON\_IoT \\
[69] & 100 & 100 & 100 & 100 & XGBoost & CSE-CICIDS2018 \\
[45] & 99.985 & 99.996 & - & 99.997 & RF & BoT-IoT \\
[52] & 99.97 & 99.98 & 99.97 & 99.98 & Hybrid Deep Learning (LSTM + DENS + GRU) & BoT-IoT \\
[76] & 99.95 & - & - & - & EnsembleVoting (RF DT ET & CIC DoS, CI-CIDS 2017, \\
[82] & 99.95 & 99.95 & 99.95 & 99.95 & RF & BoT-IoT \\
[61] & 99.9 & 99.9 & 99.9 & 99.9 & DT & TON\_IoT \\
[67] & 99.9 & 99.9 & 99.9 & 99.9 & RF & BoT-IoT \\
[81] & 99.89 & 99.95 & 99.92 & 99.94 & KNN & IoT23 \\
[30] & 99.8 & - & - & - & RF & BoT-IoT \\
[79] & 99.7 & - & - & - & DP-model & CIC-IDS2017 \\ \hline \hline \end{tabular}
\end{table}