# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices
## 6 Conclusions  
This work proposes an approach named IoTDS to detect botnets in IoT devices. The IoTDS is a host-based solution, which analyses the host's CPU and memory utilization, CPU temperature, and number of running tasks to classify its behaviour as malicious or legitimate. A one-class classifier performs the classification. The IoTDS architecture is organized into two elements: the IoTDS Agent, installed in the IoT device, and the IoTDS Management Console, installed in a separated server. In this proposed architecture, the effort of inducing new behaviour models is transferred to the Management Console, leaving the IoT devices free from running this costly task. In addition to data collection, the only responsibility of IoTDS Agents is to analyse new data using the behaviour model induced by the Management Console.  
To evaluate the proposed approach, we used an experimental setup built in previous work. This setup includes a Raspberry Pi, which emulated three different IoT device profiles and was infected by seven different botnets. We organised the tests to evaluate the system's predictive performance and its impact on the host. Four different one-class classifiers were used in our tests: EE, IF, LOF, and OSVM. Our tests showed that a sample size of 1,080 data instances for training and a 1-s time-window would be able to produce results as good as those obtained with larger training samples and time windows. After selecting the time window and the training sample size, we optimised the hyperparameters of all tested algorithms. The best algorithms were OSVM and LOF, with the LOF algorithm having a slight advantage with a mean F1-score of 94%. We also evaluated the impact of running the IoTDS in the three different IoT device's profiles. These tests showed that the approach increases the CPU, memory, and energy utilisation of the device, but we did not detect any problems for the device's operation.  
As future work, we intend to evaluate the proposed approach in different devices and IoT botnets, including other host-based features (e.g., syscalls) and testing other ways of mitigating botnets, such as blocking IP addresses and changing IPs using software-defined networking routers in conjunction with the IoTDS. Also, we plan to make the system able to handle concept drifts and defend the machine learning algorithms from attacks against their detection capacity. Finally, employing federated machine learning techniques can be a promising alternative to make the system more resilient.  
Conceptualization, all the authors; methodology, all the authors; software, V.H.B. and V.G.T.d.C.; investigation, V.H.B.; data curation, V.H.B.; writing--original draft preparation, V.H.B, V.G.T.d.C. and B.B.Z.; writing--review and editing, all the authors; visualization, V.H.B.; supervision, S.B.J., R.S.M. and B.B.Z.; project administration, B.B.Z.  
This study was financed in part by the Coordenacao de Aperfeicoamento de Pessoal de Nivel Superior--Brazil (CAPES)-- Finance Code 001.  
The authors declare no conflict of interest.  
The following abbreviations are used in this manuscript:  
C&C Command and Control  
CoAP Constrained Application Protocol  
CPU Central Processing Unit  
DDoS Distributed Denial of Service  
DHCP Dynamic Host Configuration Protocol  
DNS Domain Name System  
EE  
Eliptic Envelope