## 3 Discussion and Classification of IoT Attacks and Countermeasures
### Defenses and Countermeasures
[10], some of the ML/DL-based methods most commonly used in the research literature can be classified as supervised, unsupervised, semi-supervised, and reinforcement learning methods (RL) [10]. These can be summarized as follows:  
* _Supervised learning algorithms_ are trained on data samples which are labeled and provide mapping between inputs and outputs. The most widely used supervised learning methods for IoT security include decision trees, support vector machines, Naive Bayes, K-nearest neighbors, random forest, deep neural networks (DNN), convolutional neural networks (CNN), recurrent neural networks (RNN), etc. [10];
* _Unsupervised learning_ approaches try to identify patterns (typically by clustering) within an unlabeled data set. Common unsupervised learning methods used for improving the security in IoT networks include K-means clustering, principal component analysis, deep autoencoders (AEs), restricted Boltzmann machines (RBM), and deep belief networks (DBN) [10];
* _Semi-supervised learning methods_ utilize a data set which typically contains a low volume of labeled and a large volume of unlabeled data points. Semi-supervised algorithms use both portions of the data for training, which places them in-between supervised and unsupervised learning [18]. The main advantage of these methods is that they can have improved accuracy due to the usage of a small number of labeled samples, while simultaneously being trained on a large volume of cheap, unlabeled data. Some of the semi-supervised methods used for IoT security include generative adversarial networks (GANs) and an ensemble of DNNs [10];
* _Reinforcement learning methods_ train an agent which is supposed to make decisions based on the conditions present in a given environment. The agent is trained by interacting with the environment and receiving rewards proportional to the \"accuracy\" of its decision. Based on examples from research literature provided by [PERSON] et al. [10], in the context of IoT security RL methods (e.g., Q-learning [1; 10]), they are used primarily for preventing signal jamming attacks. The methods described above can be utilized to prevent a wide spectrum of attacks performed at each layer of the IoT network. For instance, at the physical layer, user authentication strategies can be implemented with the help of DNN-based approaches that recognize users based on their daily habits [10; 22]. As illustrated by the approaches summarized by [PERSON] et al. [10], attacks on the network layer can also be detected with the help of ML/DL methods, e.g., malware and network anomaly detection can be performed with the help of autoencoders [23], whereas DoS and DDoS attacks can be detected with the help of deep neural networks [24]. Finally, at the application layer, various attacks (e.g., malware attacks [25], application layer DDoS attacks [26]) can be also successfully detected with the help of ML/DL approaches such as CNNs [25] and AEs [26]. **Blockchain:** The blockchain [27] is a decentralized ledger that stores data entries in a tamper-proof manner. It consists of blocks that are uniquely identified by so-called \"hashes\" and linked with each other with hash pointers. Therefore, modifying information inside the block (e.g., a transaction) changes its hash identifier, which invalidates all blocks in the chain that come after. In traditional blockchain implementation, new blocks are added to the chain by solving a resource-intensive cryptographic challenge called \"proof-of-work\". Since solving the challenge is computationally expensive and the blocks are secured with cryptographic hash functions, it is very unlikely that an adversary will be able to tamper with data stored in the blockchain. Additionally, each block stored in the chain is verified by all participants in the network and there is no central authority that can single-handedlyalter the transaction history or prevent transactions from executing.