# Detecting IoT Attacks Using an Ensemble Machine Learning Model
## 3 Proposed Approach
The new result (r) and execution time (time) is then compared to the previous best result (Result) and time (ExecutionTime). If this is the best result so far, the corresponding combination and ensemble method is stored in the output (OUTPUT); see line 14. Further, the result is stored in line 15. In the end, the best output is returned at line 21. 3. **Running the best model on the fog layer** This step involves executing the model selected in the previous step over the fog layer with the real-time data collected from the thing layer. The model consists of a combination of base classifiers and an ensemble method. Figure 3: Selection of an ensemble method. Figure 2: Proposed approach. ```
procedureFindABestModel(\(B,E,D\)) //\(B\gets B_{1},B_{2},B_{3},\ \ldots\ B_{n}\). Here, \(B_{1},B_{2},B_{3},\ \ldots\ B_{n}\) are Base Classifiers. //\(E\gets E_{1},E_{2},E_{3},\ \ldots\ E_{m}\). Here, \(E_{1},E_{2},E_{3},\ \ldots\ E_{m}\) are Ensemble methods. //D is the training dataset. 1\(OUTPUT\gets NULL\);
2\(Result\gets NULL\);
3\(ExecutionTime\gets MAX\);
4\(C\gets findAllCombinations(B)\); //Find all the combinations of the Base Classifiers (B). 5 foreach\(c\in C\)do //Iterate each combination. 6\(o=0\);//Initialize an outcome. 7 foreach\(B_{a}\in c\)do //Iterate each Base Classifier in c.
8\(o\gets o,ApplyBaseClassifier(B_{a},D)\); //Apply\(B_{a}\) over dataset D and store the outcome of each \(B_{a}\) in the form of the ROC curve or any performance measure in o. 9
10 foreach\(E_{a}\in E\)do //Iterate each Ensemble method. 11\(e\gets applyEnsembleMethod(E_{a},o)\); //Apply\(Ensemble\) Method \(E_{a}\) on \(o\). 12\(r\gets findResult(e)\); //Find the result in form of ROC or any other Performance measures
13\(time\gets findExecutionTime(c,E_{a})\); //The execution time of the combination of base classifiers (c) and an ensemble method (\(E_{a}\))is calculated
14 ifisResultBetter(r, time, Result, ExecutionTime)then //Ifr and time is better than Result and ExecutionTime. 15\(OUTPUT\gets c,E_{a}\); //Store the base classifiers and Ensemble method over OUTPUT. 16\(Result\gets r\);
17\(ExecutionTime\leftarrow time\);
18
19 end if
20
21 end
22 Return:\(OUTPUT\); //Return the best model with base classifiers and an ensemble method
```  
**Algorithm 1**Find a best model  
The proposed approach to include cloud-fog/edge architecture is derived from the analysis of an NGIAtlantic EU project [48], in which cross-Atlantic experimental validation is proposed for intelligent SDN-controlled IoT networks. In this project, IoT devices transmit data to an IoT application in the cloud over the Internet via a gateway (located at edge/fog devices) whose security and latency are enhanced by running secure network functions. Our approach is a practical solution in real-time for such a scenario since, in production IoT networks, fog/edge nodes do not have a lot of resources to run heavy weight algorithms that require a lot of resources. Therefore, if only the trained model is run in the fog layer (step 3, above), the fog node's resource requirements will be lowered, which is practical. Furthermore, since the cloud layer has plenty of resources, it makes sense to train the data there, as described in steps 1 and 2.