# XGB-RF: A Hybrid Machine Learning Approach for IoT Intrusion Detection
## 2 Materials and Methods
### Data Acquisition  
The research has considered the N-BaIoT dataset [28] to detect IoT botnet attacks, one of the most recent datasets published in 2020 and publicly available ([[https://www.kaggle.com/mkashifn/nbaiot-dataset](https://www.kaggle.com/mkashifn/nbaiot-dataset)]([https://www.kaggle.com/mkashifn/nbaiot-dataset](https://www.kaggle.com/mkashifn/nbaiot-dataset)) (accessed 5 June 2021)). The dataset is comprised of nine IoT sensor traffic captured in a local network using Wireshark in the central switch. It has 115 statistically designed attributes derived from the pcap files. Over five separate time windows, seven statistical measures (mean, variance, count, magnitude, radius, covariance, and correlation coefficient) were computed. Since it includes a time window, this dataset is suited for a stateful Intrusion Detection System (IDS). It is a predetermined timeframe during which data are extracted from traffic within the same period. However, three or more statistical measures were computed for each of these four features, yielding a total of twenty-three features. A total of 229,829 samples were used; among them, benign and malicious attack samples are 13,113 and 216,716, respectively. The malicious attack consists of 27,188, 9502, 23,361, 15,148, 26,210, 21,205, 24,250, 21,995, 23,755, 24,102 samples of Mirai.ack, Mirai.scan, Mirai.syn, Mirai.udp, Mirai.udpplain, Gafgyt.combo, Gafgyt.junk, Gafgyt.scan, Gafgyt.tcp, Gafgyt.tudp, respectively. In this study, a multi-class (i.e., 11 classes) dataset was used. A description of these classes is provided as below:  
Figure 1: Workflow diagram of the proposed system. * **Benign (Class_1)**: The benign class is defined as the traffic which does not carry any attack or malicious activities. * **Mirai ACK & Mirai SYN (Class_2 & Class_4)**: In order to prevent legitimate clients from connecting to a server, Mirai uses SYN flooding. As soon as the two parties complete the three-way handshake: the client sends SYN, receives SYN, the server sends ACK+1, the client sends ACK+1 (which the server receives and processes), and the information exchange may begin. Mirai (the threat actor) uses an illegal IP address to send SYN queries to all open ports. The server will respond with an SYN-ACK in response. Because of this, the attacker will not return the ACK intended. It is an interactive Mexican standoff in the digital world at its core. Until the server receives a response, it will wait. The attacker will transmit another SYN before the connection expires, and the process begins again. The attack's goal is to completely fill the connection table so that a genuine user cannot access it. When Mirai attacks its target, it uses a variety of methods. Mirai ACK is similar in fashion to Mirai SYM, which uses ACK Flooding. * **Mirai Scan (Class_3)**: The virus and the command and control center (CnC) are the two major parts of Mirai. In addition to the malware's 10 attack vectors, Mirai also includes a scanner that actively scans out more computers to infect. Later on, the CnC plays the main initiator and can activate the single or multiple attack vectors onto the compromised devices (BOT). When the scanner is running, it randomly attempts to connect to IP addresses using the telnet protocol (on TCP port 23 or 2223). After a successful login attempt, the CnC receives the identification of the new BOT and its credentials from the CnC's database. Attackers can use the CnC's command-line interface to choose a target IP address and length of the attack. New device addresses and credentials discovered by the CnC are also used to copy over the infection code and establish further BOTs. * **Mirai UDP (Class_5)**: The Mirai UDP attack is unique among other UDP Floods. While still a UDP Flood, the default behavior of Mirai is to randomize the source port and the destination ports.