# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices  
[PERSON]  
1 Computer Science Department, State University of Londrina (UEL), Londrina PR 86057-970, Brazil 1  
[PERSON]  
1 Computer Science Department, State University of Londrina (UEL), Londrina PR 86057-970, Brazil 1  
[PERSON]  
1 Computer Science Department, State University of Londrina (UEL), Londrina PR 86057-970, Brazil 1  
[PERSON]  
2 School of Computer Science, Federal University of Uberlandia (UFU), Uberlandia MG 38400-902, Brazil 2  
[PERSON]  
2 School of Computer Science, Federal University of Uberlandia (UFU), Uberlandia MG 38400-902, Brazil 222221  
Among several threats, botnets stand as one that can benefit the most from IoT security vulnerabilities. Botnets are networks made up of nodes that were infected by malware, which turned them into bots that can attack any target as a response to commands of a botmaster. Two main reasons make IoT an appropriate environment for botnets. First, the lack of security capabilities in IoT devices eases the installation and propagation of malware. Second, the huge number of IoT devices to be connected in next years provide the attackers with an unprecedented amount of vulnerable resources to support massive attacks. The denial of service attack performed by the Mirai botnet in 2016, which knocked down a major DNS provider in the United States, showed the destructive potential of this threat. In that occasion, the Mirai botnet generated peak traffic loads of 1.2 Tbps [8; 9; 10]. With those constant threats being developed and the lack of tools to increase the security of IoT devices, users can not rely only on updates for every security breach found. This scenario makes an intrusion detection system (IDS) fundamental for these devices [11]. Although the research community has proposed IDSs for IoT devices [12], they still present some open issues. The first issue is that several works such as [13; 14; 15; 16] are mostly focused on protecting wireless sensor networks based on the 6 LoWPAN protocol stack. These networks are an important part of the IoT universe, but many other kinds of IoT devices and networks also deserve attention, like the domestic devices. Relying on algorithms that require labelled data to be trained, as in [15; 17; 18], is another problem. Labelled samples of botnets attacks are difficult to obtain, and this data also usually becomes quickly outdated by new botnets and attacks. Lastly, various works, e.g., [19; 20], explore network data for detecting attacks. It may be an issue since most of the communications are protected by end-to-end encryption, making it more difficult to obtain useful information from traffic data. This work proposes the IoTDS (Internet of Things Detection System), an approach to detect botnets in IoT devices that aims to address the mentioned issues. The proposed approach makes use of one-class classifiers, which do not require labelled samples of malicious activities to train a model. One-class classifiers are a particular type of machine learning (ML) technique, which instead of classifying an instance in one of the multiple pre-defined patterns, they model a single pattern and use it to discern whether a new instance belongs to that pattern. IoT devices have specialised behaviour, performing simple tasks with a well-defined use of computational resources. We claim it is possible to model the device's host-based data, more specifically CPU utilisation and temperature, memory consumption, and the number of running tasks, with a one-class classifier to support the detection of a botnet infection as an anomaly in the device's behaviour. Therefore, the proposed solution is host-based and does not rely on network traffic data to detect the botnets. To avoid overloading its host, the approach is based on an agent-manager architecture that moves the effort of training a model from the host to a dedicated server.