# MITIBOT: An Intelligent Mitigation Technique for IoT Botnets
## 3 Proposed Intelligent Mitigation Technique
### Stacking Ensemble Classifier Module  
Although, classifiers can be applied as individuals for the evaluation of the performance of the model, stacking generalization and ensemble learning classifiers are used to combine multiple machine learning classifier models based on similar features and validate more skillful results. These can be applied in two distinct levels. Level 0 is the base model that fits the training data and compiles the predictions. Meanwhile, level 1 is a meta model  
Figure 2: Experimental testbed setup for IoT botnets. applied to learn how to combine the prediction of the base model. The meta-model is not trained with the base model; instead, it is used to predict the best outcomes and provide input-output pairs for best-fit models. In the proposed module, the stacking of Adaboost, Random-forest, and XGBoost is applied at the base level for training purposes, while the random cluster classifier is applied at the meta-model. The AdaBoost technique is used to improve the performance of call trees in binary classification problems. It is utilized for classification rather than regression and works best with slow learners. It has been acknowledged that the accompanying algorithmic software XGBoost is the industry leader in producing structured or tabular data using applied machine learning. A similar version of gradient-boosted call trees called XGBoost was developed to raise speed and efficiency simultaneously. The testing of the model is evaluated by using hierarchical clustering algorithms. To create additional correctness and consistent prediction, random forest constructs distinct decision trees and integrate the results. Due to its effectiveness and accuracy, random forest is used as a base classifier and as a meta-classifier. Clustering samples are adapted in a meta-classifier for the prediction of unknown samples using Equation (3):  
\[s^{\prime}=\frac{1}{T}{\sum_{1}^{T}}s_{t}*P(s) \tag{3}\]  
where \(s^{\prime}\) refers to the predictions for unknown samples, \(T\) indicates the time taken during the training of the random samples, \(s_{t}\) refers to the observation's time span, and \(P(s)\) indicates the Poisson distribution, which is a discrete probability distribution and is defined as in Equation (4). \[P(s=x)=\frac{e^{-x}*x^{s}}{s!} \tag{4}\]  
where \(P\) (\(s=x\)) indicates the probability for the observation of \(x\) events, \(s\) is the Poisson random variable, \(x\) indicates the average rate, and \(e\) is the logarithmic base. The clusters can be built for a similar IoT botnet that has repetitive structures with the help of a distinct classifier. The cluster is built with different observations, \(O_{1}\), \(O_{2}\),...., \(O_{n}\), and m distinct terms are used for the \(n\) indexed features \(t_{1}\), \(t_{2}\),...., \(t_{m}\). Therefore, the similarity index among the two observations of the cluster is defined by Equation (5). \[sim_{index}\big{(}s_{i},\,s_{j}\big{)}=\frac{\sum_{p=1}^{p=m}\big{(}O_{ip},\,O _{jp}\big{)}}{\sqrt{\sum_{p=1}^{p=m}\big{(}O_{i_{p}}\big{)}^{2}}\sqrt{\sum_{ p=1}^{p=m}\big{(}O_{j_{p}}\big{)}^{2}}} \tag{5}\]  
where observations can be represented in terms of the vector (\(O_{ip}\), \(O_{jp}\)). Finally, we applied the stacking of the classifiers by combining the distinct classifiers \(C_{1}\), \(C_{2}\),...., \(C_{n}\) and applying them on a single dataset. Base-level classifiers are integrated with the meta-level classifiers, as one of the critical factors providing this technique's advantage. The major aim of the proposed approach is to enhance the learning process [25]. It will improve by learning from the errors and alternate classifiers, while the next step is to use meta-classifiers to obtain better performance and apply the approach for testing purposes. The stacking of classifiers can be obtained using the proposed algorithm. Algorithm 1 shows the algorithmic steps for stacking the classifier. The above algorithm takes into account three factors, namely the dataset (D), ensemble classifier (E), and time taken by the model for training (T).