## 3 Methodology
### Detection Algorithm
Although it achieves comparative accuracy, its overall performance is limited by the inherent limitations of ANN, its black-box nature, and reliance on extensive training data and hyperparameter tuning. The CSA-DT performs better than both SVM and LOF, likely due to its structural resemblance to the proposed model and its use of Decision Trees. However, without further optimization, such as through CSA in the classification phase, its performance is less consistent, likely due to data complexity and distribution sensitivity, leading to overfitting or underfitting. The SVM performs better on the IoTID20 dataset than the IDD but is outperformed by the top-performing models. While SVM maintains reasonable precision and accuracy, its recall drops significantly, especially on the IDD, indicating difficulty in detecting all relevant anomalies. While the LOF consistently yields the lowest results in both datasets, its poor scalability in dynamic environments where data distributions evolve limits its effectiveness. The drastic drop in recall and F1-score, particularly in Dataset 2, highlights its inability to adapt to new or emerging anomaly patterns, making it less suitable for real-time intrusion detection applications. Thus, this clearly shows that the proposed scheme is most effective and reliable across datasets, keeping a good balance between accuracy and robustness, which is essential for practical deployment in dynamic cybersecurity environments. Figure 10 shows the control chart of our proposed model. Due to a lack of access to the actual DNS for live evaluation of our model, the study used the PUF dataset, a labeled flow-based DNS dataset, specifically designed for anomaly detection. The data were

Figure 9: Comparison across IoTID20 and IDDs. captured from the computer center of Panjab University, encompassing real network traffic, which is approximately 298,463 instances, with 260,343 labeled as benign and 38,120 as malicious. The features include statistically derived and entropy-based features, facilitating the detection of compromised hosts and anomalous sub-networks. By choosing the 20% control range, we ensure that our model's performance is monitored effectively, with a clear threshold for identifying significant deviations. This helps maintain the reliability and accuracy of the model while quickly addressing any potential issues. The intervals help detect subtle changes, monitor consistency, identify trends, and pinpoint outliers. This approach ensures we can make informed decisions to improve our model's accuracy and reliability. The CSA and Decision Trees provide a good combination for lightweight anomaly detection, achieving high accuracy with minimal computational overhead and resource consumption. The CSA's efficient search mechanism narrows the search space, while Decision Trees are simple and fast, requiring less memory and processing power than complex models such as deep learning. This synergy provides a unique balance, making it an ideal choice for real-time applications where low latency and efficient resource utilization are critical, outperforming other lightweight methods such as LOF and Isolation Forest in memory usage and CPU-intensive techniques such as Autoencoders and CNNs [25]. Acknowledgments: Python's limitations for precise, real-time system-level monitoring, this study validates the lightweight nature of the proposed scheme by monitoring resource consumption during training and evaluation, with comparative results for CPU usage, memory usage, disk I/O, and execution time presented in Figure 11. Due to resource constraints during training, a lightweight detection scheme was proposed. The results show that the SVM, LOF, CSA-ANN, and CSA-DT models consume more resources than the proposed model. Specifically, SVMs' computational cost and training time increase with high-dimensional data, and while LOF avoids kernel functions, it remains computationally expensive in such scenarios.