## 2 Background Literature Review
### Data-Related Capabilities of the IoT Ecosystem Components  
The key to the successful identification of attacks on the IoT ecosystem is the availability of the necessary data and corresponding Indicators of Compromise. Taking into consideration a generic structure of the IoT ecosystem mentioned earlier, we focus only on _IoT nodes_ and _IoT gateways_, which are more susceptible and vulnerable to cyberattacks. Those devices often have multiple communication capabilities and are located at the forefront of the anticipated attacks. On the one side, the _Data Lakes_ have enough computational capacities to withstand large-scale Distributed Denial-of-Service (DDoS) attacks using enterprise solutions. On the other side, _sensors/actuators_ have no functionality that can be affected-their ways to check the readings to prevent erroneous actions. Therefore, those can be only sabotaged physically, however, cannot be performed unnoticed due to multiple security measures [21].  
To ensure reproducibility of the study, the range of devices that we consider are well-maintained in the community, open projects available for a wide range of customers to build end-point solutions. The main research question is to understand the capabilities of those devices related to data processing and the anticipated introduction of data analytics. The amount of data that can be generated in the IoT ecosystem has already become susceptible to the challenges affiliated with the Big Data paradigm: Velocity, Variety, Veracity, and Variability [3]. It means that one will need to develop novel cybersecurity defense mechanisms in IoT focusing on the most important traces of traffic attributed to attacks.  
As mentioned before, we are looking into the capabilities of single-board MCU and single-board microcomputers or System on a Chip (SoC) from the perspective of data analytics to combat cyberattacks. Both are portable and can be easily placed on-site as well as out in a remote location with limited availability of power supply either through batteries or solar panels. Considering the popularity aspects and community-based maintenance of the projects, AVR-based Arduino can be treated as the most popular single-board micro-controller (_IoT node_) with ARM-based Raspberry Pi/Orange Pi representing single-board micro-computer (_IoT gateway_) [22]. From the cybersecurity perspective, data can be protected on the Linux-based IoT gateway using tools available for Unix such as Clam AV for malicious software detection, encryption available for Linux [23] and RPiDS [24] for IDS.  
However, the application of such measures on _IoT end-nodes_ is extremely limited. There is no OS, yet rather firmware that defines strict routine of initialization function setup() and iterative function loop() [25]. The only cybersecurity solution that is available and being tested for AVR is Arduino Crypto library [26]. Therefore, it is necessary to establish an understanding of what kind of data analytics for security can be run on IoT nodes and what should be moved to IoT gateway for the sake of ensuring primary services availability and data protection. Therefore, it is imperative to see the differences in the computational and data processing capabilities of both IoT nodes and IoT gateways. The comparison of the two most common, widely used, and cheap devices are given in Table 1.  
From the comparison of both devices, it is clear that IoT gateway devices can participate in full-scale data processing and analytics. However, IoT node with limited computational capabilities shortens the range of additional functionality that can be implemented in addition to primary functionality.