## 6 Countermeasures in EC-IoT
### AI Methods
#### 6.2.1 Machine Learning  
ML methods are essential in enhancing the security of EC-IoT systems by providing robust mechanisms for detecting and mitigating various attacks. For network-level attacks, support vector machines (SVMs) are used for binary classification of normal versus attack traffic, while random forests analyze various features of network traffic to classify and detect anomalies [42; 115]. In application-level attacks, decision trees apply rule-based detection by identifying decision rules from training data, and naive Bayes classifiers use probabilistic classification to detect anomalies [42; 115].  
For data-level attacks, K-nearest neighbors (KNN) detect data points that deviate significantly from the norm, and principal component analysis (PCA) is employed for dimensionality reduction and anomaly detection [42; 115]. Logistic regression is applied for binary classification of access attempts in access control attacks, while random forests analyze features of access attempts to detect anomalies [42; 115].  
In protocol-based attacks, SVMs classify normal and anomalous protocol usage patterns, and decision trees create rule-based models to detect deviations in protocol usage [42; 115]. For side-channel attacks, PCA is used for dimensionality reduction and anomaly detection, while KNN identifies anomalous side-channel signals that deviate from normal patterns [42; 115].  
Supply chain attacks are countered by random forests, which classify and detect anomalies in supply chain processes, and logistic regression, which models and detects deviations in supply chain activities [42; 115]. Social engineering attacks are addressed using naive Bayes classifiers for probabilistic classification of communication content to  
\begin{table}
\begin{tabular}{p{71.1 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Attack Type** & **AI Application** & **Advantages** & **Disadvantages** \\ \hline Network-level & CNNs, RNNs (LSTMs) & High accuracy in detecting anomalies, real-time analysis & Significant computational resources required, complex model training \\ \hline Application-level & Autoencoders, GANs & Effective anomaly detection, can simulate attack scenarios & Significant training time, needs large labeled datasets \\ \hline Data-level & RNNs, VAEs & Good at detecting temporal anomalies, handles high-dimensional data & Potential for high false positive rates, requires continuous training \\ \hline Access control & LSTMs, DBNs & Detects complex user behavior patterns, adaptive authentication & High computational cost, complex implementation \\ \hline Protocol-based attacks & Autoencoders, GANs & Detects protocol-specific anomalies, improves IDS robustness & Requires extensive training data, computationally intensive \\ \hline Side channel & CNNs, RNNs & Effective analysis of side channel signals, real-time detection & Significant computational power needed, difficult to implement \\ \hline Supply chain & Autoencoders, GANs & Detects anomalies in supply chain data, simulates attack scenarios & High resource requirements, requires continuous updates \\ \hline Social engineering & RNNs, DNNs & Analyzes communication patterns, detects phishing attempts & High false positive rate, requires large amounts of training data \\ \hline \hline \end{tabular}
\end{table}
Table 2: ML and DL-based countermeasures for different attack types in EC-IoT.  
detect phishing attempts, and SVMs analyze the features of communications to classify and detect social engineering attacks [42; 115].