# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices
## 5 Results and Discussion
### System Impact on Its Host  
After evaluating the predictive performance of our approach, we also need to assess its impact when running in an IoT device. Since we built a host-based approach, and IoT devices have limited resources, it is essential that the resource consumption of IoTDS does not harm the performance of the device. To address this, we computed the device's CPU and memory utilisation, energy consumption, and CPU temperature with and without the IoTDS running. Each monitored parameter has, respectively, the following minimum and maximum values: 0% to 100%, 0 GB to 1 GB, 1 VA to 10 VA and 0 \({}^{\circ}\)C to 100 \({}^{\circ}\)C. In Figures 7-9, these values, for each IoT device profile, are presented. The blue line represents values computed when the IoTDS was not running, whereas orange lines comprehend to values collected with the IoTDS running. All the tests were performed with LOF using its optimised hyperparameters, as in Table 6.  
In Figure 7, the MC profile is considered. The IoTDS seems not to have affected the device since the behaviours in the two scenarios are very similar. In this sense, the IoTDS did not compromise the device performance. The CPU and memory utilisation, as well as the CPU temperature, behave similarly. The energy consumption in the scenario was slightly higher on average.  
Figure 8 presents the results regarding the SC profile. Among the three profiles, this one has the lowest level of resource use under normal conditions, so the impact of the IoTDS is more evident here. The CPU utilisation increased by two percentage points, followed by the CPU temperature that was around 5 \({}^{\circ}\)C higher. The memory utilisation increased by 40 MB but remained constant throughout time. This profile presented the same increase in energy consumption, as seen in the MC profile. Despite these increases, resources were far from being exhausted, showing that the IoTDS did not compromise the device operation.  
Lastly, Figure 9 shows the results for the ST profile. Its behaviour was similar to the SC profile. When this profile was running the IoTDS, the CPU utilisation had a peak of 30%, quickly decreasing later and then, stabilising around 20%. The initialisation of the IoTDS may have caused this peak. The energy consumption also increased, having similar results as the MC and SC profiles. In the same manner, as in other profiles, the increase in resource consumption caused by the IoTDS did not seem to impair the device.  
Figure 8: Behaviour of the SC profile regarding host’s resource usage with and without the IoTDS.  
Figure 7: Behaviour of the MC profile regarding host’s resource usage with and without the IoTDS.  
For comparison purposes, we also analysed the impact of the IoTDS in a device infected by botnets. Figures 10-12 present the CPU and memory utilisation, the energy consumption and the CPU temperature for all the profiles infected by the infection type 3. As shown in the figures, the behaviour was very similar in the cases with and without the IoTDS, as the botnets forced a high consumption of resources on the device. The MC profile showed the highest CPU and memory utilisation, compared to the SC and ST profiles. All resources presented intense use, regardless of the device was running the IoTDS.  
In the SC profile, the memory and CPU utilisation were less intense, representing half of the memory and CPU used by the MC profile. The ST profile shows the same memory utilisation as the SC profile, but a higher CPU utilisation in some moments. In all tests, it is possible to see that the IoTDS impact in the device was almost the same in the infected and non-infected scenarios. This results showed that IoTDS can still be functional even with the device's resources being heavily used by the botnets.  
Figure 11: Behaviour of the SC profile infected with botnets regarding resource usage with and without the IoTDS.  
Figure 10: Behaviour of the MC profile infected with botnets regarding resource usage with and without the IoTDS.