# Protocol-Specific and Sensor Network-Inherited Attack Detection in IoT Using Machine Learning
## 2 Related Work
### Machine Learning for Securing IoT--An Overview  
In this section, the use of ML approaches in IoT is explored with an emphasis on security. Different Learning Paradigms (LP) are identified that are exploited for designing and developing security solutions in IoT infrastructures by the research community. Supervised Learning (SL) approaches have been extensively used for the development of solutions to address the security issues in IoT-enabled systems. For example, Ref. [25] have proposed supervised classifiers for the detection of security attacks including DoS, DDoS, cross-site scripting (XSS), injection and scanning attacks, backdoor malware, and password cracking attacks in Vehicular Ad hoc Networks (VANETs). ToN-IoT dataset,which contains the aforementioned attacks, has been used to train eight SL models in two contexts: (1) binary classification, and (2) chi-square and synthetic minority oversampling technique-included classification. The models are then evaluated against performance evaluators such as accuracy, precision, recall, F1-score, and confusion matrix. XGBoost has performed well overall with the highest accuracy and confusion matrix parameters such as False Positive Rate (FPR), while in the second context, k-NN has performed well among other models. In [26], the authors have proposed a DL-based attack detection framework leveraging fog technology to train supervised DL models for attack detection in IoT networks. Six models are trained on five datasets and Long Short-Term Memory (LSTM) has outperformed other SL models. The architecture of the LSTM model is based on artificial recurrent neural networks, and they are well-suited for classification as well as prediction-related tasks. The authors of [27] have used the distributed LSTM as part of their proposal for energy efficient calculations in mobile edge computing systems. The authors of [28] have proposed a DL-based anomaly detection technique using binary and multiclass classification techniques in six datasets. They have trained convolutional neural networks (CNN) for classifying the normal and attack data as well as further classification of attacks using the transfer learning approach. The authors of [29] have proposed a novel feature selection approach to improve the accuracy of ML models for anomaly detection. Furthermore, four models are trained for attack detection in bot-related traffic. It is observed that the researchers have proposed IDSs, classification-based models, and improved feature selection methods for increasing the classification accuracy of the security models for IoT systems. Unsupervised Learning (UL) approaches have been used to develop models for anomaly detection, attack detection, node clustering, and pattern recognition. For example, the authors of [30] have proposed a DL-based unsupervised learning method to detect botnets in IoT. Balanced and unbalanced datasets are used to evaluate the model efficiency by detecting the threats. The false-positive rate has been used to evaluate the detection capability and performance of the model. The authors of [31] have employed unsupervised and supervised learning methods to detect intrusions in IoT using a multistage approach and employing a feed-forward neural network with a single hidden layer. SVM is used with a synthetic minority oversampling approach for clustering and data reduction. This approach has achieved good results in comparison with other classifiers used as benchmarks. The authors of [32] have incorporated unsupervised-learning-based dimensionality reduction using one-class SVM, autoencoder, and isolation forest-based techniques. In [33], the authors have used autoencoders as UL models for detecting network intrusions in IoT. In [34], the authors have proposed semi-supervised learning (SSL)-based IDS for handling intrusions in IoT networks. Deep learning is used to develop the system and train it on two datasets. The IDS is evaluated for seven security attacks namely: DDoS, bots, infiltration, PortScan, web attacks, and brute force attacks.