# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 5 Findings
### Machine Learning Techniques
These techniques reduce high-dimensional feature spaces into low-dimensional visualizations, allowing analysts to intuitively identify anomalies in data distributions. By combining clustering algorithms and dimensionality reduction techniques, researchers can explore new attack behaviors in unsupervised environments, contributing to enhanced IoT network security. The advantages of unsupervised learning lie in its independence from labeled data, making it highly effective in detecting unknown threats. However, the lack of labels often results in less interpretable outcomes, and model performance is highly sensitive to feature selection and parameter tuning. In practice, unsupervised techniques are often complemented with domain knowledge or additional supervised learning to improve detection accuracy [36]. Table 4 summarizes the performance metrics of notable unsupervised models. For instance, combinations like CNN + ScS, and DMLP + ScS reached 100% accuracy, precision, and recall in the referenced studies, although issues such as unclassified instances were noted. Reinforcement learning learns optimal strategies through interactions between an agent and its environment, showing potential applications in IoT honeypot systems. For instance, reinforcement learning algorithms can dynamically adjust honeypot configurations to achieve higher attack capture rates [64]. Compared to supervised and unsupervised learning, reinforcement learning emphasizes decision-making in dynamic environments, making it well-suited for addressing evolving attack patterns and attacker strategies. One application of reinforcement learning in IoT network security is dynamically configuring honeypot deployment locations to attract attacker behaviors. For example, using Q-learning algorithms, the system can iteratively adjust honeypot positions to maximize their effectiveness in trapping attackers. Another potential application involves utilizing reinforcement learning models to automatically adapt defense strategies, enabling honeypot systems to respond differently to various attackers [32]. Despite its potential, reinforcement learning faces several challenges in IoT honeypot applications. First, reinforcement learning models typically require large volumes of interaction data for training, which can be difficult to obtain in IoT environments. Second, reinforcement learning models are computationally intensive and require high-performance hardware. Due to these limitations, most reinforce \begin{table}
\begin{tabular}{c c c c c} \hline
**Learning Type** & **Accuracy** & **Precision** & **Recall** & **FPR** \\ \hline Supervised learning & 0.953 (Weka), 0.96 (R-Studio) [44] & 0.82 [37] & 0.82 [37] & 0.219 (Weka), 0.2667 (R-Studio) [44] \\ \hline Unsupervised learning & 100\% (CNN + ScS), 100\% micro and macro (CNN + ScS), (CNN + ScS), 100\% micro and macro (DMLP + ScS) [50] & 100\% micro and macro (DMLP + ScS) [50] & Not explicitly given; \\ Reinforcement learning &
\begin{tabular}{c} Highest average reward (A2C, PFO) [35] & - & - & -1 reward for incorrect response, used as \\ \end{tabular} \\ \hline \end{tabular}
\end{table} 
Table 4: Comparison table by metrics. ment learning research in IoT honeypots remains in theoretical validation stages [35]. As shown in Table 4, reinforcement learning models such as A2C and PPO have demonstrated the highest average reward in simulations, with reward-based proxies like a penalty for incorrect responses being used in place of standard false positive metrics. With advancements in computational technology, its application prospects merit further exploration. In summary, machine learning techniques offer diverse options for attack detection in IoT honeypots. Supervised learning is ideal for identifying known attack patterns, unsupervised learning excels at detecting unknown threats, and reinforcement learning provides innovative pathways for dynamically adjusting defense strategies.