# Optimizing Internet of Things Honeypots with Machine Learning: A Review
## 5 Findings
### Machine Learning Classifiers  
The classifier for different machine learning techniques can be divided into different domains, including specific classifier algorithms and different types of classifiers. In addition, the areas of IoT traffic and malware detection can be covered with machine learning. Finally, a smart honeypot framework \"S-Pot\" from [PERSON] et al. [34] will be introduced. First, it is important to understand why machine learning with its classifier is important for security analysis. One problem is that the botnet structure contains very large and diverse data structures, which is why a synchronous view of attack activities is important. For this purpose, features such as duration or frequency can be indexed. Machine learning offers a perfect solution to this problem, as it uses feature-based classification and clustering. In addition, no unnecessary features need to be installed and no static assumptions about botnet profiles need to be made [59]. The process is the following, with machine learning (Figure 3): After the network packet is captured, the packets can be split into time bins. Then stateless and stateful feature vectors are generated, which can now be used for classification using machine learning [65]. This process shows the perfect applicability of machine learning. Overall, it can be said that with its classification, machine learning offers a very good opportunity for security. There are two different types of classifiers. One is the ensemble voting classifier [53]. This combines different models to increase the prediction accuracy. For this purpose, different models are trained on different data aspects in order to strengthen the models for different possibilities and data sets. The predication process is then practiced with individual models. Finally, all predictions are merged to obtain a final classification. For merging, majority voting according to the most frequent prediction or weighted voting according to performance can be used. Ensemble voting offers the possibility to be used in different scenarios [53]. Another classifier type is the weighted voting classifier [53]. This is used when the performance of the prediction can be different in order to achieve an even weighting. The strategy here is that weights are assigned according to model performance. The process therefore looks like this: First, the weights are assigned individually to their respective model. Then, all model predictions are combined with an average weight into a final prediction. The weights can be assigned manually or automatically to their respective models and are based on training data [53]. In summary, it can be said that the classifier type should be selected according to the desired objective. If the focus is on prediction accuracy, the ensemble voting classifier is a good choice. If the performance of the different models is different, weighted voting classifiers should be preferred. Classification and attack detection in the area of IoT uses various classifier techniques. The special thing about IoT here is the short-range communication and distinct network flow characteristics. Attack detection with machine learning involves two different analyses. One is power side-channel and the other is behavioral [65]. The power side-channel analysis uses power consumption data and extracts the features with deep learning. In the behavioral analysis, the device behavior is displayed as graphs. The application used here is Graph Convolutional Networks (GCNs). For both analyses, the machine learning process in the IoT area includes data collection, feature extraction based on packet length, inter-packet intervals, and protocol and binary classification. The feature selection is based on limited endpoint and regular packet intervals [65]. The most effective algorithms used are random forest, K-nearest neighbors, and neural networks. These are ensemble voting classifiers [65]. The random forest classifier [33] is used for power-side channel analysis.