# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices
## 4 IoTDS: A Host-Based Botnet Detection System for IoT
### IoTDS Overview  
Since IoT devices are very specialised, running simple, repetitive, and well-defined tasks, these devices behaviour are supposed to present a precise level of regularity as long as they are not compromised. Likewise, malicious software that compromises an IoT device should alter its behaviour. Therefore, it is possible to take advantage of a one-class classifier to model the device's behaviour and detect anomalous events, avoiding the effort demanded by collecting and labelling malicious data to train the behaviour model. The IoTDS is a host-based system. Running the system in an IoT device, instead of at some point of the network, allows the collection of data about the device's resource consumption, which can be more sensitive to the presence of bot malware. Also, by relying only on resource consumption data, the IoTDS ability to detect malicious activity is not hindered by the encryption of malicious traffic. Lastly, IoTDS can be pre-installed in IoT devices, offering protection to these devices out of the box. The IoTDS works creating models of the legitimate behaviour of the IoT devices and detecting any anomalies using host-based data. If the behaviour of the device presents an anomaly, the device sends an alert to a central server. After a given number of consecutive alerts, the system tries to stop the unusual behaviour executing a reboot of the IoT device's system automatically. The IoTDS is divided into two phases, Model Induction, and Continuous Analysis. These two phases are executed for each IoT device. Also, the system architecture is divided into two elements: Agent, installed in the IoT device and responsible for analysing the device's data, and Management Console, installed in a separated computer server, where the alerts are stored, and an overview of the situation of the device is provided to the network administrator. Two main challenges coming from our design choices were addressed in this work. Being a host-based solution, the system can not consume a large amount of the device's resources, since that would be harmful to its other functionalities. Bearing this in mind, we move the heaviness of inducing a model to a centralised server with more computational power, which hosts the IoTDS Management Console. Hence, the IoT device runs an already trained behaviour model, which can be done at a minimum cost of computational power. Besides, the chosen features can be easily extracted, which avoids an overhead related to this task. Processing data in a separated computer brings challenges regarding channel security to the proposed system. Since the IoTDS Agent captures host-data about the device, it is necessary to build a secure communication between the Agents and the Management Console. In the proposed approach, the HTTPS protocol is used to protect the information travelling between the Agents and the Management Console. HTTPS provides privacy and integrity, as well as allows the authentication of the end points [32]. The IoTDS is designed to offer the following advantages:  
1. _Distributed architecture_: although a main server is responsible for inducing the behaviour model, the continuous classification of new observations is performed by distributed agents deployed in the hosts. Therefore, the server does not have to analyse data coming constantly from a large number of IoT devices. This saves network resources and improves system scalability;
2. _No need for Internet connection_: the system does not need any Internet connection or use third-party online software to detect IoT botnets, such as whitelists and other software to verify valid IP addresses/ports;
3. _No use of malicious data during the training step_: the system does not need the collection or use of malicious data to induce the classification model during the training step. It only has to capture legitimate data on the IoT device's behaviour to do it;
4. _No use of traffic analysis_: the system does not analyse traffic data.