# An Intrusion Detection System Using BoT-IoT
## 3 Proposed Approach  
The system generally consists of three main components: sensors, a recorder, and an AI-based ID system. IoT networks are devices connected to exchange messages, and these messages are vulnerable to penetration in many forms and at many levels. We have a recorder to capture signals. Any captured signal will be sent to our AI-based system so that we decide whether it is an intrusion on the network by several steps in ML and training the classifiers to make an accurate decision about whether to send it to the IoT system. This is illustrated with our architecture for the system in Figure 2.  
The recorder is a critical component of the system as it captures all signals and all traffic on the network, including those that may be malicious or unauthorized. The recorder can store these data for later analysis, allowing the system to detect intrusions in real time or retrospectively. The AI-based ID system is the brain of the intrusion detection system, responsible for analyzing the data collected by the sensors and recorder to identify potential threats. The AI-based ID system uses various machine learning techniques such as deep learning, anomaly detection, and signature-based detection to identify patterns in the traffic and determine whether it takes the form of legitimate communication or an intrusion. \begin{table}
\begin{tabular}{c c c c c c} \hline
**Ref.** & **Approach** & **Algorithm** & **Dataset** & **Sample** & **Performance** \\ \hline
[8] & ML & KNN & The authors & 83 & KNN = 87\% \\  & ML & RF & collected this & Devices & RF = 97\% \\  & & DT & sample & & DT = 95\% \\ \hline
[9] & Deep learning & Neural Network & CISIDS & 225,742 & 99.03\% \\  & & LSTM & 2017 & instances & \\ \hline
[10] & ML & ANN & UNSW-15 & 175,341 & 84\% \\ \hline
[11] & ML & REP Tree & CICIDS 2017 and & 40,000 and & 96.6\% and 96.9\% \\  & & JRip Forest PA & BoT-IoT & 5,877,647 & 96.6\% and 96.9\% \\ \hline
[2] & ML & \begin{tabular}{c} NB \\ QDA \\ RF \\ ID3 \\ Adaboost \\ MLP \\ KNN \\ \end{tabular} & \
\begin{tabular}{c} NB = 79\% \\ QDA = 87\% \\ RF =97\% \\ ID3 \\ Adaboost \\ MLP \\ KNN \\ \end{tabular} &
\begin{tabular}{c} NB = 79\% \\ QDA = 87\% \\ RF =97\% \\ IdD = 97\% \\ Adaboost \\ MLP \\ KNN \\ \end{tabular} \\ \hline
[12] & \begin{tabular}{c} Machine/deep \\ learning \\ \end{tabular} & \
\begin{tabular}{c} CNN \\ RF \\ MLP \\ \end{tabular} & Bot-IoT & 3,264,128 &
\begin{tabular}{c} RF \& CNN = 90\% \\ RF \& MLP = 54\% \\ \end{tabular} \\ \hline
[13] & ML & \begin{tabular}{c} 3 Modules \\ PWM \\ PBM \\ GBM \\ SBM \\ \end{tabular} & \
\begin{tabular}{c} The authors \\ collected this \\ sample \\ \end{tabular} & 3973 &
\begin{tabular}{c} 78\% \\ 97\% \\ 99\% \\ for 3 layers \\ \end{tabular} \\ \hline
[15] & Deep learning & CNN & BoT-IoT datasets & 3,264,128 & 92.85\% \\ \hline
[17] & Machine learning &
\begin{tabular}{c} Random Forest and \\ XGBoost \\ \end{tabular} & BoT-IoT datasets & 3,264,128 & 99\%,99\% \\ \hline
[19] & Machine learning & Ensemble learning & BoT-IoT datasets & 3,264,128 & 97.37 \\ \hline
[20] & Deep learning & RNN & BoT-IoT dataset & 3,264,128 & 99 \\ \hline
[26] & Machine learning & KNN & BoT-IoT Dataset & 3,264,128 & 99.99 \\ \hline
[27] & Machine learning &
\begin{tabular}{c} Ensemble \\ Learning-based DNN \\ \end{tabular} & BoT-IoT Dataset & 3,264,128 & 98.99 \\ \hline
[30] & Machine learning &
\begin{tabular}{c} Gradient boosting (GB) \\ and decision tree \\ \end{tabular} & BoT-IoT Dataset & 3,264,128 & 99.9\% \\ \hline \end{tabular}
\end{table} 
Table 1: Analysis of Related Works. The system may use supervised learning algorithms, where it is trained using labeled data to identify different types of threats, or unsupervised learning algorithms, where it learns to identify anomalous behavior based on deviations from the network's expected behavior. The system uses classifiers to make decisions about the traffic on the network.