# IoTDS: A One-Class Classification Approach to Detect Botnets in Internet of Things Devices
## 5 Results and Discussion
### Experimental Environment  
To test the proposed approach, we used the experimental environment built by [21], which is illustrated in Figure 4. The network components consist of a switch with Ethernet and Wi-Fi interfaces, and four computers (Machine 1, Machine 2, Machine 3, and Gateway) connected to the switch through Ethernet. There is also a Raspberry Pi model 3B connected to the switch through the Wi-Fi interface. The Machine 2 provided two virtual machines, with the first one hosting a Web Server and the second being a client, referred to as Device Admin. The Raspberry Pi emulates three different behaviour profiles: two focused on security cameras and one focus on a multimedia device. * Multimedia Centre (MC): found in today's living rooms, a multimedia centre is a device that consumes streams of video such as movies or TV shows, to transform regular TVs in smart TVs. In addition to the use of video content, it also accesses an application store for updates and installation of other programs. The task of rendering video combined with the heavy traffic generated by video streams make this device to use a significant portion of its resources during its operation;
* Surveillance Camera with Additional Traffic (ST): used both on the inside and outside parts of houses and companies, the operation of surveillance cameras is mostly characterised by the transmission of a video stream to a computer or station. However, this kind of device can also present traffic from other protocols. Telnet or SSH connections can be established to check if the device is working, its temperature, and the running processes, for example. These cameras may also include configuration web pages, which users access from their browsers to set up the parameters of cameras operation. As the device do not have to render video before transmitting, it consumes fewer resources than the multimedia centre;
* Surveillance Camera (SC): this profile is similar to the ST profile, but it does not include interactions with users through Telnet, SSH, and configuration web pages. Having the video transmission as their single task, devices of this profile consume fewer resources than those of the ST profile. The Gateway machine was used to provide Internet access and DHCP functionality to the network. The Machine 1 hosted a DNS server that was used by the Mirai botnet. The same machine also hosted a VLC client that consumed the video stream generated by SC/ST profiles and a VLC server that  
Figure 4: Network topology of the experimental environment. generated a video stream for the MC profile. The Machine 2 hosted the Web Server and the Device Admin. The Web Server was responsible for providing a static Web page, which was accessed by the Raspberry Pi in all the profiles to emulate the consumption of web services. The Device Admin emulated the transactions of an administration software used to control and set up the emulated camera in the ST profile. To do so, it interacted with the Raspberry Pi through Telnet, SSH, and the Web configuration page. Lastly, the Machine 3 was responsible for emulating an attacker in the network, infecting IoT devices with botnet samples. Particularly for Mirai, this machine also hosted a C&C server, which could be used to make the Raspberry Pi launch DoS attacks against selected targets. We executed the following botnets in our experimental network: Mirai and Bashlite, the most famous IoT botnets that uses Telnet [10]; Hajime, a botnet of unknown purpose that patches vulnerabilities in IoT devices [34]; Aidra, Tsunami and Dofloo, very famous botnets that moved from personal computers domain to IoT devices using ARM processors [35]. With those botnets, we have three types of infection, as presented in Table 1. Legitimate data was captured following the description of each behaviour. The MC profile received video streams from YouTube, Twitch and HD video, while the SC device streamed video to another computer. The ST device streamed video, was accessed via SSH and Telnet and performed updates in programs.