# A Novel Intrusion Detection Approach Using Machine Learning Ensemble for IoT Environments
## 2 Literature Review
### Classification Algorithm
#### 2.2.3 Random Forest  
The random forest (RF) model uses the property of the decision tree-based model to build and aggregate a set of learning trees. It selects variables that are capable of being put into each model for random selection [27] for examples of predictors \(\{t(x_{in},\theta_{n}),n=1,\cdots\}\) that have individual predictive outputs at a given input \(x_{in}\). This predictive model relies only on a set of variables, \(\theta_{n}\), that admits to random selection, freely sampled with similar  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Author** & **Attacks Coverage** & **Dataset** & **Methodology** & **Performance Metric** \\ \hline [PERSON] et al. [11] & \begin{tabular}{c} Man-in-middle, replay, \\ DoS, security-against- \\ any-learner, tracking, \\ scalability \\ \end{tabular} & - & \begin{tabular}{c} Physically unclonable \\ function (PUF), \\ registration, and \\ authentication \\ \end{tabular} & - \\ \hline [PERSON] et al. [22] & \begin{tabular}{c} DDoS, bot, \\ attacker-centric \\ mitigation \\ \end{tabular} & UNSW NB15 dataset & FLEAM architecture & \begin{tabular}{c} Mitigation response \\ time; \\ detection accuracy \\ \end{tabular} \\ \hline [PERSON] and [PERSON] [15] & \begin{tabular}{c} DoS, DDoS, volumetric \\ flooding attack \\ \end{tabular} & - & \
\begin{tabular}{c} Attack recover \\ algorithm along with \\ traditional Grey List \\ and Black List \\ \end{tabular} & Packet delivery ratio \\ \hline [PERSON] et al. [14] &
\begin{tabular}{c} DoS, wormhole, \\ selective forwarding \\ \end{tabular} & - & 6 LoWPAN Jammer & Energy consumption \\ \hline \hline \end{tabular}
\end{table}
Table 2: Summary of some important previously proposed schemes.  
prevalence values. The core concept behind building a random forest model is that it accepts the simultaneous number of indicators that helps to achieve better accuracy while keeping away the issues of over-fitting values. Every indicator in a random forest develops to the largest size without sorting. When innumerable trees are created, they predict the information by deciding in favor of the most mainstream class on the input \(x_{in}\). For the performance evaluation, the quality of estimators (trees) was set to 500 and the maximum depth for tree growth was 26 as suggested by [PERSON] [26; 28] and [PERSON] [17]. Various parameters were obtained by using random search operations.  
The novelty of the proposed model is the bagging technique, which uses the random forest to train different sets of models in a sequential manner. This bagging technique is ensembled with a gradient boosting machine. This ensemble technique learns from the model's citations of its previous residual errors and misclassifications to produce a strong learning model, whereas the previously introduced models try to enrich the model by updating the weights of the data points, which affects the performance of the model. Additionally, the performance of the proposed ensemble technique was estimated to be 2.9% more than that of the earlier models [18]. The proposed model was implemented with polynomial and standard scalar feature selection, rather than a grid search-based process, which enhanced the overall performance of the model by extracting the most relevant features from the input malicious attack data values.