# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices
## 2 Related Work  
Most of the works on intrusion detection for IoT are based on simulated networks using the protocol 6 LoWPAN [12]. The two most common operating systems deployed at these 6 LoWPAN-based devices are Contiki and TinyOS. Although these works have promising results, exploring host-based, network-based and hybrid IDS, their focus on 6 LoWPAN networks may prevent their application in networks based on other IoT protocols, such as Bluetooth Low Energy, and the conventional TCP/IP stack. One of the most mature IDS for 6 LoWPAN networks was dubbed SVELTE [13]. It is composed of several modules to protect devices from different attacks. The first module of the system uses the routing protocol RPL (Routing Protocol for Low power and Lossy Networks) to map the network topology and discover the nodes within the reach of IDS agents that are distributed over the network. Then, the distributed IDS agents check the packets of their neighbours. This process aims to protect the devices from insider attacks. Another module is a distributed firewall deployed on the devices, which protects them from an outsider attack, closing ports, and blocking addresses. SVELTE was tested in a network of Contiki-based devices. In [14], an IDS is developed for TinyOS. The proposed IDS has some watchdog devices to analyse the packets being sent by their neighbours. This allows the system to detect traffic-based attacks and abnormal behaviour on the network. The IDS also enables the creation of rules and countermeasures that must be executed by the devices upon the detection of an intrusion. A limitation of their approach is that the rules may not have the needed complexity for responding accurately to a network attack, and the communication between the devices and the management module is insecure. [PERSON] et al. [15] also proposed an IDS for 6 LoWPAN networks, but the proposed system has a particular focus on the Constrained Application Protocol (CoAP), an application layer protocol for 6 LoWPAN-based constrained devices. The proposed system is deployed in a centralised node in the network, which acts as a network sniffer to capture the packets within its network domain. To analyse the captured packets, the system first extracts different features from IEEE 802.15.4, 6 LoWPAN, IPv6 and CoAP protocol headers. These features are selected using two methods, Principal Component Analysis (PCA) and Linear Discriminant Analysis (LDA). Then, Support Vector Machine (SVM), a supervised classification algorithm, is applied to classify the extracted data. To test the approach, the authors built an experimental setup on IoT-Lab ([[https://www.iot-lab.info/](https://www.iot-lab.info/)]([https://www.iot-lab.info/](https://www.iot-lab.info/))). As the authors employed SVM, they need samples from the different classes they modelled to induce their classifier, which can be an issue. Besides, the system relies only on network-based data, but they did not discuss how it would deal with encrypted traffic. Other works on intrusion detection for IoT focus on conventional TCP/IP stack and IoT domestic devices. Most of these works are IDSs intended to be a module in a router or gateway, using whitelists, machine learning methods, or pre-defined rules. In [19], it is proposed an IDS named Heimdall. This IDS uses a whitelist to prevent IoT devices from connecting to malicious addresses, avoiding communications with botnets C&C (Command and Control) or private data leaks. Heimdall is intended to be a module in the local router, acting as a gateway for IoT devices, using third-party analysis of malicious addresses from organizations such as VirusTotal, Metadefender, and VirScan, combined with an auditor and DNS validation. They tested this approach on real domestic IoT devices, and the method is effective against the attacks developed by the researchers, as well as has minimal overhead. However, tests with real botnet attacks were not carried out, and the IDS depends on the maintenance of the third-party systems.