# Intelligent Detection of IoT Botnets Using Machine Learning and Deep Learning
## 2 Related Works
### IoT Security Threats
#### Attack Works  
By reviewing the various classifications used in each study in Section 2.1.1, we decided to use IoT layer classification to categorize the possible attacks on the IoT. Based on the aforementioned IoT layers, the most frequently mentioned attacks can be divided into nine types of attacks. We organize these nine types of attacks into the proposed taxonomy and see if they violate the three elements of information protection: confidentiality, integrity, and availability. We also look at studies related to each attack. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Classification** & **Reference** & **Classes** \\ \hline Based on the IoT layer & [6,7] & Perception layer, network layer, application layer \\ \hline Attacks & [8] & Physical attacks, reconnaissance attacks, DoS, access attacks, attacks on privacy, cyber-crimes, destructive attacks, supervisory control and data acquisition (SCADA) attacks \\  & [9,10] & Physical attacks, network attacks, software attacks, encryption attacks \\ \hline Vulnerabilities & [11] & Layers, security impact, attacks, countermeasures, sac ignoring functionality, reducing functionality, misusing functionality, extending functionality \\  & [13] & application, architecture, communication, data \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of classification works. * Perception: The Perception class includes attacks that usually deplete the resource of the devices. Jamming: A jamming attack is an attack that interferes with the radio frequency of the sensor node. Integrity is violated here because the device's frequency is changed. When someone cannot obtain service due to a jamming attack, availability is also violated. [PERSON] et al. [24] presented a mechanism that can solve a Jamming probe in an IoT system. [PERSON] et al. [25] proposed an ACA model that provides adequate resources for anti-jamming on the IoT. Through simulation, they showed that the model is suitable for low-power, band-limited IoT networks. DoS: A DoS attack is an attack that consumes all available resources and causes the IoT system to function abnormally. Here, availability is violated. DDoS is an attack in which many attackers from many points attack one target using a very large network. When carrying out a DDoS attack, the malicious code that allows an attacker to carry out an attack is called a bot. A botnet that carries out a DDoS attack consists of these bots. [PERSON] et al. [26] referred the structures of IoT botnets and introduced DDoS events using IoT botnets. The authors also presented improved measurements that can alleviate the risks related to the IoT. [PERSON] et al. [27] described botnets that can trigger DDoS attacks. They focused on the Mirai botnet and also mentioned other botnets, such as Hajime and BrickerBot. * Network: The Network class mainly categorizes attacks that send or receive incorrect information or deplete network resources so that the user cannot obtain normal service. Man in the middle attack (MitM): A MitM attack is made by a malicious device inserted by an attacker between two normal devices that are communicating in an IoT network environment. Data can be stolen or stored on the malicious device. Integrity is violated in this case because the data can be changed. Because the unauthorized person is in the middle, it can also be said that confidence is violated. [PERSON] et al. [28] demonstrated the weakness of the OpenFlow control channel by conducting an experiment based on an MitM attack. The authors also suggested a countermeasure called Bloom filters and indicated the efficiency of the Bloom filter monitoring system. [PERSON] et al. [29] showed a variety of attacks using MitM, including MIT-Cloud (MITC), MIT-Browser (MITB), and MIT-mobile (MITMO). They showed that MitM is not uncommon and can damage the IoT, even though it is an old attack. Routing attack: A routing attack is an attack based on the routing protocol of the IoT system. It causes a delay in the IoT network by creating a routing loop that manipulates routing.