# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 1 Introduction  
The IoT refers to devices that are connected and communicate with one another, typically described as an IoT network. Whether they are used in your smart home, agriculture, or medical tools, IoT devices are important to the functioning of the digital world and are quite vulnerable from a cybersecurity perspective. One of the key properties of these devices is that they are resource-limited, meaning that they are an obvious target of different forms of cyberattacks, including DDoS. Given their wide adoption in daily life and industry, estimates vary regarding the actual number of IoTs devices in use, with some sources claiming that there were expected to be approximately 20 billion IoTs devices [1] by the end of 2024. However, Forbes claimed a figure over tenfold of that [2]. That being said, the need for a robust security solution for this popular technology is obvious. Intrusion detection system (IDS) based on ML appear to be a natural first choice to explore. ML's flexibility offers a number of benefits, including real-time detection of DDoS attacks through network analysis. Furthermore, the option of running ML algorithms on different systems can prove useful when memory and computational power are limited. Hence, we use this review as a foundational point to discuss the ML techniques that the current literature proposes. In order to draw more accurate conclusions from our research, we identify the datasets that the ML models are trained and tested on, as different datasets may vary in important properties, which may in turn impact the performance metrics of the proposed models. Finally, we also consider the deployment environments proposed by the reviewed papers. Given the constraints of IoT technology, the deployment options can have an impact on the construction of the ML models and vice versa. This paper presents a large-scale, in-depth analysis with a distinct focus on DDoS attacks, distinguishing it from more general or smaller-scale surveys, which are discussed in greater detail in Section 3. Additionally, our work provides a comprehensive, multi-dimensional examination of the field, covering deployment strategies, dataset usage, and a comparative evaluation of ML models, offering a level of detail and a combination of insights not found in previous reviews. This paper aims to follow the PRISMA structure in building up a literature review on ML-based IDSs for DDoS attacks in IoT networks. Our contributions to the topic include creating an updated survey on the deployment options, datasets, and ML techniques used in the academic literature published on the topic. We also compare our results in order to find consistent characteristics as well as gaps in current research and offer direction for future research. In particular, we aim to answer the following research questions:  
1. What are the deployment/platform solutions using machine learning proposed for mitigating DDoS attacks on IoT networks? 2. Which datasets are used to train and evaluate ML models for detecting DDoS attacks in IoT networks and how do they impact model performance? 3. How do different ML models compare based on performance metrics, and what factors contribute to achieving high accuracy rates? 4. What trends have emerged in the use of machine learning for DDoS detection in IoT networks? While other reviews on this topic have been published in the past 6 years, this paper stands out in that it includes significantly more reviewed literature than the comparable surveys. Moreover, this paper focuses on DDoS attacks and creates a broad survey of relevant surrounding elements, such as the datasets used, various performance metrics, and deployment contexts, which other papers may omit. Furthermore, with the PRISMA framework, this paper is replicable and follows a standardized research structure. To give an outline of this paper, Section 1 introduces this paper and motivation, while Section 2 denotes the methodology this paper is based on.