Jie Han
email: jiehan@xjtu.edu.cn

EDITORIAL

Who is running faster, the virus or the vaccine?

Han Dai 1 • Jie Han 1 • Eric Lichtfouse 2,3 Vaccinating the world population against the COVID-19 faces both classical challenges such as vaccine transport and new challenges such as public trust. Here, we detail issues and potential solutions that will require a world collaboration of public authorities, industries and scientists from both physical and social sciences.

Lab-to-jab

As the global coronavirus pandemic progresses into the tenth month, vaccination, one of the most important public health interventions invented by Dr. Edward Jenner (1749-1823) and pioneered by Professor Louis Pasteur (1822-1895), is once again coming under the spotlight [START_REF] Fujiwara | COVID 19 vaccination lessons from Japanese anti-HPV vaccination lobby[END_REF][START_REF] Hanson | Is freezing in the vaccine cold chain an ongoing issue? A literature review[END_REF][START_REF] Hasselgren | The smallpox epidemics in America in the 1700 s and the role of the surgeons: lessons to be learned during the global outbreak of COVID-19[END_REF] https ://en.wikip edia.org/wiki/Louis _Paste ur). While progress on vaccine development has been achieved at an unprecedented speed, safety, efficacy, production capacity and universal accessibility of vaccines are major challenges in the forthcoming labto-jab process [START_REF] Callaway | Outrage over russia's fast-track coronavirus vaccine[END_REF]Wang et al. 2020a) (Fig. 1). In particular, transport and storage of vaccines present a significant obstacle, especially in developing countries and remote areas [START_REF] Kartoglu | Logistical challenges for potential SARS-CoV-2 vaccine and a call to research institutions, developers and manufacturers[END_REF]. Who is running fasterthe virus or the vaccine-will not only depend on when the vaccines become available but where and how we vaccinate a global population in a safe and most efficient manner. Even when the vaccine becomes available, the average public acceptance to take the COVID vaccine still amounts to only 67% in the USA [START_REF] Malik | Determinants of COVID-19 vaccine acceptance in the US[END_REF]. Therefore, scientists and public health authorities ought to pursue innovative and pragmatic solutions in the early planning stage to prepare for the upcoming actions.

Fair priority

Countries all around the world have started clinical trials for COVID-19 vaccines (Mahase 2020). To date, there have been more than 200 candidates registered with the World Health Organization (WHO), including nine currently in Phase 3 clinical trials (WHO 2020a). Communities with inadequate healthcare, vulnerable population groups, and areas with community spread of COVID-19 are in most need of vaccines [START_REF] Singh | The case for why africa should host COVID-19 candidate vaccine trials[END_REF]. While researchers are racing against time, it is of paramount importance to ensure the safety of the vaccines that are about to be used by a significant portion of the global population [START_REF] Makoni | COVID-19 vaccine trials in Africa[END_REF]. The WHO reiterated that after passing all safety tests, vaccines would be distributed to both high-income and lowincome countries through the COVAX project, the global vaccine alliance that aims to deliver about two billion doses of COVID-19 vaccines to 156 countries by the end of 2021 (WHO 2020b). To ensure fair distribution and prevent hoarding of COVID-19 vaccines, some researchers proposed a Fair Priority Model [START_REF] Emanuel | An ethical framework for global vaccine allocation[END_REF][START_REF] Liu | Multivalue ethical framework for fair global allocation of a COVID-19 vaccine[END_REF]. Based on an ethical framework, the model aims to achieve the most effective allocation of vaccines by transcending economic, political and ethnic barriers.

Bumpy road

Maintaining the potency of vaccines during their transport and storage is a prerequisite. Most human vaccines require low-temperature storage, where a specific range of temperatures must be kept to avoid any impairment on vaccine potency [START_REF] Hanson | Is freezing in the vaccine cold chain an ongoing issue? A literature review[END_REF][START_REF] Matthias | Freezing temperatures in the vaccine cold chain: a systematic literature review[END_REF]. Deviations from the required storage conditions may render vaccines unusable, potentially putting users at greater risks of contracting illnesses [START_REF] Kartoglu | Tools and approaches to ensure quality of vaccines throughout the cold chain[END_REF]. Important lessons come from the mass vaccination of polio [START_REF] Billah | Cold-chain adaptability during introduction of inactivated polio vaccine in Bangladesh, 2015[END_REF], Ebola [START_REF] Chisholm | Thermostable Ebola virus vaccine formulations lyophilized in the presence of aluminum hydroxide[END_REF][START_REF] Davis | Examination of the effect of agitation on the potency of the Ebola Zaire vaccine rVS-VDeltaG-ZEBOV-GP[END_REF] and influenza [START_REF] Dubrovina | Composition of the stabilizer and conditions of lyophilization for preserving infectious activity of influenza virus[END_REF]. For instance, manufacturers firstly need to test the effectiveness of vaccines in the widest possible temperature ranges [START_REF] Zipursky | Assessing the potency of oral polio vaccine kept outside of the cold chain during a national immunization campaign in Chad[END_REF], and make their data accessible to allow enough time of preparation for the upcoming logistics. Thermostable vaccines, albeit difficult to develop, is one way to circumvent these issues [START_REF] Kartoglu | Logistical challenges for potential SARS-CoV-2 vaccine and a call to research institutions, developers and manufacturers[END_REF].

Heat-sensitive labels

Adjustments need to be made throughout the existing cold chain to accommodate the needs for distributing COVID-19 vaccines. Facilities along the cold chain should be coordinated, regardless of political boundaries, based on the storage requirements, quantities, and destinations of delivery, following the priority settings for vaccine allocation. Meanwhile, the WHO and local public health authorities should be authorized to inspect the facilities throughout the cold chain prior to and during vaccine deployment. The storage conditions of vaccines should be kept as consistent as possible throughout the transport to avoid weak or broken links along the steps before vaccines reach the end users. Heatsensitive thermochromic labels affixed on vaccine vials, also known as Vaccine Vial Monitors, can help reduce the likelihood of using vaccines that have been exposed to excessive heat (WHO 2011). By providing visual indication on the preservation of potency, these can be particularly useful for delivering vaccines to remote areas or places without intact cold chains.

Vaccination in parking lots and shopping malls

Since there is no experience to follow on vaccinating a global population in the midst of an ongoing pandemic, plenty of planning work will be needed with innovative approaches to avoid chaos or mis-management. Appropriate sites must be first selected for community-wide vaccination. The designated sites need to accommodate a large number of visitors, while preventing virus spread from crowd gathering [START_REF] He | Electrostatic fine particles emitted from laser printers as potential vectors for airborne transmission of COVID-19[END_REF] and reducing the pressure on transportation to control the cost of vaccination (Wang et al. 2020a). Medical institutions such as hospitals, clinics and pharmacies are often considered first choices, given that medical professionals and cold-storage facilities are available on-site. However, healthcare facilities are already under tremendous pressure for diagnosing and treating COVID-19 patients. Alternatively, large grocery shops, community survival centers, shopping malls and airports may be used as alternative sites owing to their high foot traffic and large open spaces, e.g., parking lots. Using these sites can also reduce the need of commuting for people to receive vaccination, that is no need to make separate trips. All these facilities require mobilized medical staff and storage facilities, with the exception of grocery shops which often have ample cold-storage facilities on-site that may be adapted for the temporary storage of COVID-19 vaccines.

Where possible, centralized vaccination can achieve highly efficient vaccination within a short timeframe. Kindergarten, schools and colleges, including their students and employees, should be vaccinated in this manner given their regular and large number of daily attendees. When not in use, these facilities can also be used for community vaccination given the large open grounds often available at these facilities, e.g., sports fields and parking lots, and given their convenience of access for people living in the community. Other institutions may also receive centralized vaccination from mobile medical teams, such as nursing homes, retirement villages, prisons and correctional facilities. People who are at elevated risks or more vulnerable to COVID-19 infections, including healthcare workers, medical first responders, the elderly, pregnant women, children (Wang et al. 2020b), and those with chronic respiratory diseases or having frequent contact with people, could be given priority for receiving COVID-19 vaccinations. It is also important to include people living in remote locations, the elderly living alone, and those who are physically challenged or have limited mobility in future vaccination programs for COVID-19. Authorities may need to formulate intervention measures for these groups to ensure their vaccinations [START_REF] Williams | Towards intervention development to increase the uptake of COVID-19 vaccination among those at high risk: outlining evidence-based and theoretically informed future intervention content[END_REF].

Mail-in vaccines

The immense scale of the COVID-19 vaccination program also calls for innovations on the administration route of the vaccines. Most human vaccines, including vaccines currently in the developmental stage for COVID-19, are administered subcutaneously. Such practices require the presence of trained medical staff to safely conduct the procedures for each person to be vaccinated. Under this scenario, the availability of trained staff on-site and the time required for completing the procedures for each person become the limiting factors when vaccinating a large group of people.

Alternatively, given that most COVID-19 vaccines currently in clinical trials require two separate doses [START_REF] Weintraub | Pfizer reports 'potential' of COVID-19 candidate vaccine after expanding trial to 44,000 people[END_REF], self-administered vaccines would be highly desirable to reduce a lot of the need for medical staff and vaccination sites. For instance, intranasal administration has long been exploited for delivering drugs to the human respiratory tract, for both therapeutic and recreational purposes [START_REF] Parhi | Drug delivery applications of chitin and chitosan: a review[END_REF]. Intranasal administration can provide both systemic and localized treatment for respiratory diseases, which can be easily administered by the users themselves [START_REF] Mato | Nasal route for vaccine and drug delivery: features and current opportunities[END_REF]. Recent studies show potent immune response throughout the body with particularly high immunity in the nose and respiratory tract against SARS-CoV-2 via intranasal administration of spike proteins carried by harmless adenovirus [START_REF] Feng | An adenovirus-vectored COVID-19 vaccine confers protection from SARS-COV-2 challenge in rhesus macaques[END_REF][START_REF] Hassan | A SARS-CoV-2 infection model in mice demonstrates protection by neutralizing antibodies[END_REF]). On September 9, 2020, China approved the first Phase I human testing for a nasal spray vaccine, which became the first COVID-19 trial vaccine that does not require a needle injection [START_REF] Deese | China starts testing nasal spray coronavirus vaccine[END_REF]. Should thermostable COVID-19 vaccines also become a reality, it may even be possible to have "mail-in vaccines" designed for users' self-administration, which can circumvent the logistic challenges as well as site constraints and on-site staffing for vaccinating the global population.

Public trust

Vaccinating a large and culturally diverse global population means that challenges are not only technical but arise also from the attitude of vaccine users. Researchers have indeed warned that vaccine hesitancy and crowd boycott could be the ultimate challenge in the fight against COVID-19 (Peretti-Watel et al. 2020). Moreover, a global survey on COVID-19 vaccine acceptance showed that in many countries, including those with very active COVID-19 infections, a significant portion of the population refused to vaccinate for COVID-19, including Russia (47%), Poland (45%), Hungary (44%), France (41%), and the USA (33%) (Ipsos 2020). Such a resistance appears to be due to skepticism on science and a lack of public trust in government authorities [START_REF] Dror | Vaccine hesitancy: the next challenge in the fight against COVID-19[END_REF][START_REF] Peretti-Watel | A future vaccination campaign against COVID-19 at risk of vaccine hesitancy and politicisation[END_REF]. Other resistance factors include conspiracy theories, misinformation and the long-disproven link on vaccine and autism, which are still widely circulating in communities [START_REF] Stefanelli | Contrasting the anti-vaccine prejudice: a public health perspective[END_REF][START_REF] Zuk | The anti-vaccine movement in Poland: the socio-cultural conditions of the opposition to vaccination and threats to public health[END_REF]. In Europe, the anti-vaccine movement has a long history tracking back to the eighteenth's century, which now owes much to the social-culture and political context. The current pandemic may have exacerbated this feeling due to the emotional distress and impaired access to normal healthcare [START_REF] Dror | Vaccine hesitancy: the next challenge in the fight against COVID-19[END_REF]. It is thus essential to promote the transparency of vaccine research and data in the course of development of and to maintain good communication with the public to avoid fear and mistrust.

Vaccine hesitancy may also derive from the public perception that there is a low risk following COVID-19 infection, particularly in countries with advanced universal healthcare. This trend is in agreement with the fact that countries with limited healthcare generally show high acceptance for the vaccine (Ipsos 2020), such as China (97%), Brazil (88%), and India (88%) where preventive treatment plays a pivotal role in their healthcare systems [START_REF] Makoni | COVID-19 vaccine trials in Africa[END_REF][START_REF] Singh | The case for why africa should host COVID-19 candidate vaccine trials[END_REF]). To encourage acceptance, public health authorities and members of the scientific community need to actively engage in communications with the public to ensure recognition of the risks associated with COVID-19 infections and the benefits of protection provided by the vaccine [START_REF] Stefanelli | Contrasting the anti-vaccine prejudice: a public health perspective[END_REF]Wang et al. 2020c). For lowincome groups, the cost of COVID-19 vaccination may be borne or subsidized to encourage acceptance.

Overall, the very act of vaccination does not bring an end to our fight against COVID-19, as several foreseeable challenges may persist in the post-vaccination era. For instance, given that most vaccines currently in development require two separate doses at least 3-4 weeks apart, there is still a risk of transmission during the interim period. Even after receiving the second dose, it may still take few days to few weeks for immunity to fully build up. Just-vaccinated and partially vaccinated individuals must therefore continue to follow the protocols on preventing the spread of COVID-19, including maintaining social distancing, wearing face coverings, minimizing exposure to enclosed public spaces or frequently touched surfaces in community environments. In addition, receiving one dose of the vaccine may give some individuals the perception of instant immunity against COVID-19 infection: these individuals may thus subsequently engage in high-transmission risk activities. Therefore, public health authorities and medical professionals should give clear instructions to raise awareness of such risks of non immunization immediately after receiving the vaccination or during the interim period of a multi-dose vaccination.

Mutations

We should also bear in mind that the novel coronavirus is an evolving organism with ongoing mutations (CDC 2020; [START_REF] Korber | Spike mutation pipeline reveals the emergence of a more transmissible form of SARS-CoV-2[END_REF]). Since August 24, 2020, there has been at least four confirmed cases of COVID-19 reinfections by different, possibly mutated SARS-CoV-2 strains in Hong Kong, the Netherlands, Belgium, and most recently, in the USA [START_REF] Bowen | Nevada State Public Health Lab-led team studying COVID-19 reinfection. Nevada Today[END_REF]To et al. 2020;[START_REF] Deutsch | Coronavirus re-infections raise concerns about immunity[END_REF]. In the most recent case, the reinfection was confirmed only 48 days after the initial infection, and the patient showed more severe symptoms after being infected with a different SARS-CoV-2 strain (Mole 2020). These newly emerged cases not only raised questions on the earlier hypothesis of acquired immunity to COVID-19, named "herd immunity", but signals the need of possible re-design and continual development of COVID-19 vaccines as the pandemic continues in our communities.

Before scientists find a perfect cure for treating infections by the novel coronavirus, vaccinating the global population will be the keystone in the current battle against COVID-19 (Stern 2020;[START_REF] Williams | Towards intervention development to increase the uptake of COVID-19 vaccination among those at high risk: outlining evidence-based and theoretically informed future intervention content[END_REF]. The numerous challenges in the lab-to-jab process not only present a daunting task, but also provide an unprecedented opportunity to collaborating and finding innovative solutions, on a global scale and across different disciplines to increase the preparedness of our communities for future pandemics [START_REF] Paital | Air pollution by NO 2 and PM 2.5 explains COVID-19 infection severity by overexpression of angiotensin-converting enzyme 2 in respiratory cells: a review[END_REF][START_REF] Roviello | Lower COVID-19 mortality in Italian forested areas suggests immunoprotection by Mediterranean plants[END_REF][START_REF] Sharma | Environmental chemistry is most relevant to study coronavirus pandemics[END_REF]Wang et al. 2020d). Since epidemics and pandemics may emerge in a not too distant future, these experiences will become an important part of the legacy of the COVID-19 era.

Fig. 1

 1 Fig.1Major challenges for vaccinating a global population for COVID-19, e.g., cold-chain logistics, vaccination sites, on-site staffing of medical staff and public acceptance after the successful development and production of safe and effective vaccines in sufficient quantities. Facing an ongoing pandemic, these challenges call for


François Bercher
email: jf.bercher@esiee.fr

Nawel Zangar
email: nawel.zangar@esiee.fr

Vassia Bonandrini
email: vassia.bonandrini@edu.esiee.fr

Jean-François Bercher

Machine learning methods for anomaly detection in IoT networks, with illustrations

Keywords: Internet of Things, IoT, IDS, NIDS, Intrusion Detection System, rules, CIDDS-001 1

Machine learning methods for anomaly detection in IoT networks, with illustrations

Vassia Bonandrini, Jean-

Introduction

The problem of securing electronic devices is as old as computers exist, but with time computers have gained more and more resources, so IDS in these devices became more efficient. Now, a lot of different small devices without the power of modern computers are connected to a network and are the target of many attacks. Moreover, every IoT system is different and has specific worries depending on the type of the attack (DDoS, Blackhole, Sybil Attack…) they want to be protected from. Wireless Sensor Networks (WSN) for instance has unique characteristics such as limited power supply, low transmission bandwidth, small memory size, and data storage [START_REF] Butun | A Survey of Intrusion Detection Systems in Wireless Sensor Networks[END_REF]. It is thus crucial to develop and deploy new IDS.

Section 2 presents a brief review of the literature and Section 3 presents the problem of selecting or simulating a dataset to test IDS. Section 4 presents the implementation, tests, and results of several machine learning algorithms for outlier detection for CIDDS-001 dataset. Section 5 presents some simple decision rules that can be introduced in an IoT network to work like an IDS. Section 6 presents a summary of the conclusions and future work.

2

Related work

Doshi et al. [START_REF] Doshi | Machine Learning DDoS Detection for Consumer Internet of Things Devices[END_REF] simulate IoT networks with raspberry Pi and virtual machines. They collect network data from their system and test this data with 5 algorithms: Knearest neighbors, Support Vector Machine (SVM) with linear kernel, decision tree, random forest, and neural network. The specificity of their work is to use stateful features and they get up to 30% better performance compared to without these features. Hussain et al. [START_REF] Hussain | Machine Learning in IoT Security: Current Solutions and Future Challenges[END_REF] list for each problem many surveys that use machine learning techniques (table IV on the document). For anomaly and intrusion detection:

-K-means clustering and Decision Tree [6] -Artificial Neural Network ANN [7] -Novelty and Outlier Detection [START_REF] Nesa | Non-parametric sequence-based learning approach for outlier detection in IoT[END_REF] -Decision Tree [START_REF] Viegas | A reliable and energy-efficient classifier combination scheme for intrusion detection in embedded systems[END_REF] -Naive Bayes [START_REF] Viegas | A reliable and energy-efficient classifier combination scheme for intrusion detection in embedded systems[END_REF], [START_REF] Pajouh | A two-layer dimension reduction and two-tier classification model for anomaly-based intrusion detection in IoT backbone networks[END_REF] Butun et al. [START_REF] Butun | A Survey of Intrusion Detection Systems in Wireless Sensor Networks[END_REF] classify the IDS methodology of IDS in 3 categories: 1 -Anomaly Based detection: We create an activity profile for each member of the network and a certain amount of deviation is reported as an anomaly. This method is adequate to detect never known attacks but we need to update the profiles periodically because the network behavior can change rapidly.

-Misuse based detection

A signature (profile) of the previously known attack is used and is used as a reference to flag the next attacks. The disadvantage of this method is that it cannot detect new type of attacks, but the false positive rate is very low. 3 -Specification based detection That's a mix of the previous ones, "a set of specifications and constraints that describe the correct operation of a program or protocol is defined." [START_REF] Butun | A Survey of Intrusion Detection Systems in Wireless Sensor Networks[END_REF] But it takes a lot of time to develop special rules to get a low false-positive rate. Some surveys have unclear results, sometimes there is no result. There are also very few simulations and implementations in real systems.

3

Dataset

Selecting a dataset to design and evaluate NIDS ML-based algorithms is not immediate and may be a full part challenge.

One of the most used datasets is the KDD cup99 set, but it still presents defaults, as emphasized by Tavallaee et al. [START_REF] Tavallaee | A detailed analysis of the KDD CUP 99 data set[END_REF]:

-a lot of redundant measures -some parts of the train set were used as test sets in some studies -set is too long forcing to take only part of the set. Ring et al. [START_REF] Ring | A survey of networkbased intrusion detection data sets[END_REF] did an exhaustive list of network-based detection data set and compared them. One of the recent and not too heavy dataset is the CIDDS-001 (Coburg Intrusion Detection Data Set) [START_REF] Ring | Technical Report CIDDS-001 data set[END_REF] which was described as follows:

"The CIDDS-001 data set was captured within an emulated small business environment in 2017, contains four weeks of unidirectional flow-based network traffic, and comes along with a detailed technical report with additional information. As special feature, the data set encompasses an external server which was attacked in the internet. In contrast to honeypots, this server was also regularly used by the clients from the emulated environment. The CIDDS-001 data set is publicly available and contains SSH brute force, DoS and port scan attacks as well as several attacks captured from the wild." [START_REF] Ring | A survey of networkbased intrusion detection data sets[END_REF] The dataset contains 14 features as follow.

Table 1. Features within the CIDDS-001 data set, from [START_REF] Ring | Technical Report CIDDS-001 data set[END_REF] In our experiment, we used the "Class" attribute as the target for classification, removed the AttackType, AttackID and AttackDescription features which are obviously correlated with the "attacker" class. Furthermore, since IPs were anonymized, they do not convey information so we also removed them. We also use "Date first seen" as the x-axis. Finally, we transformed Flags, Class and Proto, which are categorical features, into "dummy variables" by one-hot encoding.

In the CIDDS-01 dataset, we used the internal-week1 subset of observations, as it contains 42 of the 92 attacks on the entire dataset.

Anomalies are labeled as victim or attacker. However, this file has more than 8 million rows and less than 20% are anomalies. Hence we face a case of imbalanced classes. In such a case, the more represented class can have a "masking effect" on the others; this has been studied in [START_REF] Abdulhammed | Deep and Machine Learning Approaches for Anomaly-Based Intrusion Detection of Imbalanced Network Traffic[END_REF] for this dataset. Given the high number of instances available, rebalancing the classes can be simply done by subsampling the majority class (otherwise, one can also oversample the minority classes by creating new, synthetic, instances). In our case, we decided to (a) shuffle the data, (b) keep half of the data for a final evaluation (c) subsample the other half to keep about 180000 instances per class.

4

Experiments and results

The experiments were carried out using Google Colaboratory with 32GB of ram and the Tensor Processing Unit acceleration material.

The metrics that were used to evaluate the performance of the algorithm include the classification accuracy, precision, recall and F1-score. These metrics are expressed by the equations below,

Precision . Recall Precision+ Recall

where, TP, TN, FP and FN stand for true positives, true negatives, false positives and false negatives, respectively.

We shuffle the set and we take 33% of the set as the test set and 66% as the train set. Then, we classify the traffic with 4 algorithms: K-Nearest Neighbors (KNN), Decision Tree (DT), Random Forest (RF) and Neural Network (NN). We used the python sklearn package to do our test.

For the KNN, we use only 1 neighbour with a uniform weight function. We get a global accuracy of 99.27%; other metrics are reported Table 2. For the Decision Tree, we used the default parameters, which is the Gini criterion for measuring the quality of a split and maximum expansion of nodes. We already obtained a global accuracy of 99.89%; other performance metrics are given Table 3. For instance, we get something as shown in Fig. 1 for the beginning of the tree:

Fig. 1. First nodes of the decision tree

The decision tree has a depth of 31, a total of 563 nodes and 282 leaves, thus 281 tests. From this tree, it is possible to deduce, and even generate automatically, a classification script (see the source code [START_REF] Bonandrini | [END_REF] for an example). Running this code on an instance will predict the classification with 99.88% accuracy.

For the RF, we selected the best parameters using a grid search strategy, which consists of computing the performance, by cross validation, on a grid of possible parameters values, and then selecting the best estimator. We used global accuracy as the performance metric. In particular, we used 800 trees with a max depth of 20. We get a global accuracy of 99.95%, with the performances reported in Table 4. For the Neural Network, we used the multi-layer perceptron classifier. This model optimizes the log-loss function using LBFGS or stochastic gradient descent. We used 100 neurons in the hidden layer with the rectified linear unit function for the hidden layer activation function. The maximum iteration was set to 200. We finally obtained a global accuracy of 99.25% ; performances metrics for the different classes are shown Table 5. For the CIDDS-01 dataset and the ML-based algorithms, we obtained very high accuracies. As mentioned in [START_REF] Ring | A survey of networkbased intrusion detection data sets[END_REF], for this particular dataset, balancing the classes or not has a very tight influence on the accuracy, which is already so high. Anyway, by a careful selection of the hyperparameters we recover results similar to the best RF-WHICD in [START_REF] Abdulhammed | Deep and Machine Learning Approaches for Anomaly-Based Intrusion Detection of Imbalanced Network Traffic[END_REF] (where only two classes normal/attacker were considered).

Rules

The most accurate algorithm is the RF with 99.95% accuracy. However, it may be difficult to embed on an IoT and it lacks interpretability. The problem of extracting simple rules from a forest of decision trees has been considered in the machine learning community. The goal was to find a trade-off between the modelization power of random forests and some simple rules interpretable as in a (small) decision tree. The Skope rules Python library [19] enables us to extract such rules from a random forest. In our experiments, we took all the instances to train the model and extract the rules. For the victim class, the skope rules are:

-Bytes > 100 -Duration <= 0.03749999962747097 -Flags == ASF And for the attacker class, the identified rules are:

-Dst Pt <= 261 -Duration <= 0.032500000670552254 -Flags == APSF With these very simple rules, we already get a global accuracy of 86.88%. Furthermore, by a simple inspection of data, we discovered that adding the instances flagged with AR (class victim) or S (class attacker) TCP flags enables us to improve the accuracy to 98.45%, with only 0.35% are miss classifications.

6

Conclusion

We have considered the problem of detecting anomalies or intrusions in IoT networks. We have first presented the context and reviewed approaches in the literature. We have focused on machine learning-based methods that can learn directly from data and find what are the important features, without resorting to specialized models of the network or specialized signatures. We have then selected a dataset of network activity with several attacks, which is regularly used to develop NIDS and as a benchmark of proposals. Using standard open-source libraries, we have implemented and evaluated several ML-based algorithms, with performances that are at the state-of-the-art. The sources are available and results easily reproducible [START_REF] Bonandrini | [END_REF].

Using and implementing such solutions in an IoT network requires to consider the possible computational overhead. For a router or network supervisor, we need a network traffic module to capture the incoming network, and the classifiers, once trained by a decision tree or a random forest, can probably be implemented. For the IoT devices themselves, where consumption and computational costs can be more severely constrained, it is possible to use a decision tree classifier (at most 20 comparison tests and a 840 lines program in Python) or even to use the very simple rules (3 tests) derived from a random forest, with a 98.5% accuracy and a low falsepositive rate. Testing these ideas on real devices and real data is the objective of future efforts.

Fig. 2 .

 2 Fig. 2. Relative importance of features in the CIDDS-01 dataset.

Table 2 .

 2 Results with the K Nearest Neighbour algorithm

	KNN	precision recall	f1-score
	attacker 0.9633	0.9972 0.9799
	normal	0.9996	0.9916 0.9956
	victim	0.9573	0.9988 0.9976

Table 3 .

 3 results with the Decision Tree algorithm

	DT	precision recall	f1-score
	attacker 0.9956	0.9982	0.9969
	normal	0.9998	0.9990	0.9994
	victim	0.9946	0.9996	0.9970

Table 4 .

 4 results with the Random Forest algorithm

	RF	precision recall	f1-score
	attacker 0.9982	0.9981	0.9982
	normal	0.9997	0.9996	0.9997
	victim	0.9981	0.9993	0.9997
	An interesting outcome of the random forest is that we can extract which are the
	most important features in computing the classification. The features are shown by
	importance on Fig. 2.

Table 5 .

 5 Results with the Neural Network algorithm

	NN	precision recall	f1-score
	attacker 0.9929	0.9938	0.9933
	normal	0.9906	0.9962	0.9934
	victim	0.9914	0.9883	0.9899

Table 6 .

 6 Comparison with related work

	Survey	Approach	Accuracy (%)
	Verma and Ranga [15]	2NN	99.60
	Verma and Ranga [16]	DT	99.90
	Tama and Rhee [17]	DNN-10-FCV	99.90
	Idhammad et al. [18]	Entropy+RF	99.54
	Abdulhammed et al. [14]	RF-WHICD	99.99
	Proposed KNN	KNN-1	99.27
	Proposed DT	DT	99.89
	Proposed RF	RF	99.95
	Proposed NN	NN	99.25
	5