# A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection +
## 5 Results
### All-in-One Autoencoding  
The use of an all-in-one detector--applied to the devices assessed with _no change_ to its architecture (layers, number of units and weights)--is more suited to large-scale and dynamic IoT environments. We evaluated the performance of the all-in-one AE, trained with the merged normal traffic of all IoT devices. Table 7 provides the evaluation metrics. It turns out that the detection performance of the all-in-one model with five hidden layers is in line with the figures obtained by the separate autoencoding solution. The best results in terms of recall (R = 0.9997) are obtained with the test sets of the Dannini doorbell, Ecobe thermostat, Philips B120W/10 baby monitor, Provision PT-838, SimpleHome XC57-1002-WHT and SimpleHome XC57-1003-WHT security cameras; the FPR is reasonably low--exactly 0.0 for the Provision PT-838 and Provision PT-737E security cameras--for most devices. The F1 score, instead, is 0.9996 for the Ennio doorbell, 0.9997 for the Samsung SNH 1011 N webcam, and 0.9998 for all the other devices. This confirms we reached an acceptable trade-off between precision and recall. \begin{table}
\begin{tabular}{l c c c c c} \hline
**IoT Device** & **Recall** & **Precision** & **FPR** & **F1 Score** & **Configuration** \\ \hline Dannini & 1.0 & 0.9999 & 0.0108 & 0.9999 & \(A\) \\ \hline Ecobee & 0.9999 & 0.9999 & 0.0417 & 0.9999 & \(A\) \\ \hline Ennio & 0.9998 & 0.9997 & 0.0114 & 0.9998 & \(A\) \\ \hline Philips B120N/10 & 0.9998 & 0.9999 & 0.0007 & 0.9999 & \(A\) \\ \hline Provision PT-737E & 0.9998 & 0.9999 & 0.0002 & 0.9999 & \(B\) \\ \hline Provision PT-838 & 0.9999 & 0.9998 & 0.0088 & 0.9998 & \(B\) \\ \hline Samsung SNH 1011 N & 0.9995 & 0.9999 & 0.0006 & 0.9997 & \(A\) \\ \hline SimpleHome XCS7-1002-WHT & 0.9999 & 0.9999 & 0.0007 & 0.9999 & \(A\) \\ \hline SimpleHome XCS7-1003-WHT & 0.9998 & 0.9999 & 0.0187 & 0.9998 & \(A\) \\ \hline \end{tabular}
\end{table} 
Table 6: Separate autoencoding: evaluation metrics (_Configuration A_: \(N\)-48-6-48-\(N\); _Configuration B_: \(N\)-64-6-64-\(N\)). For the sake of completeness, we also show in Table 8 the evaluation metrics for one \"smaller\" configuration, the aforementioned _Configuration A_, which was mostly outstanding in the separate autoencoding experiment; however, it performs worse in the all-in-one test. For example, the recall drops to 0.3549 for the Samsung SNH 1011 N webcam device and to 0.3506 for the Ennio doorbell device. This indicates that with respect to the problem addressed and the data in hand, _deepening_ and _widening_ the autoencoder can improve intrusion detection in the all-in-one setting. Regarding the effects of the deeper and wider configuration on processing times, we found that for the \(N\)-64-24-6-24-64-\(N\), the detection latency per record is reasonable (about 1 microsecond per record). **Finding:** The cross-device training method assures remarkable detection figures when compared to the separate autoencoders. Although the best all-in-one AE is a wider and deeper network than separate autoencoding, its training time and detection latency per record are acceptable. Our results show that it is possible to train a single model with normal traffic collected from different devices. While the findings of this paper should be contextualized with respect to the attacks and devices of N-BaIoT, we believe there is room to conceive more scalable and centralized intrusion detection solutions in the context of IoT, based on the notion of all-in-one models. An AE model trained _\"once and for all\"_ represents a lightweight and device-independent solution. This is a considerable advantage in terms of transferability and adaptability.