## 3 Methodology  
Our proposed solution is based on the use of a CSA for feature selection and a Decision Tree for classification to detect and mitigate MitM attacks in the DNS. The study selected the CSA and Decision Tree due to their advantages in efficiency, simplicity, robustness, and interpretability. CSA is highly efficient and accurate in feature selection, effectively exploring the search space to find optimal solutions, which are crucial for handling high-dimensional data. Its simple structure with minimal parameters makes it easy to implement and tune. Decision Trees, on the other hand, are robust classifiers capable of handling both numerical and categorical data without assuming any specific distribution. They provide clear and interpretable models essential for understanding the decision-making process. Recent studies have demonstrated that CSA-optimized models, when combined with Decision Trees, outperform traditional machine learning models in terms of classification accuracy and computational efficiency, making this combination an ideal choice for detecting and mitigating Man-in-the-Middle attacks in the Domain Name System. We compared our proposed work with existing methods by [15], a study that proposes a novel method for anomaly detection using artificial neural networks (ANNs) optimized with CSA. The study enhances the accuracy and efficiency of IDS by leveraging the fast convergence rate and Levy flight mechanism of CSA. The proposed model uses the NSL-KDD dataset for training and testing, achieving good performance such as mean absolute error, mean square error, root-mean-square error, and accuracy compared to standard methods such as fuzzy clustering, ANN, and artificial bee colony. However, the model's reliance on ANNs may lead to higher computational complexity and resource consumption, which may not be suitable for real-time applications. The model may not adapt to rapidly changing attack patterns and new emerging intrusions without frequent retraining. Meanwhile, our study employs a lightweight approach using CSA and Decision Tree, which provides faster processing and lower resource requirements, making it more suitable for real-time DNS traffic analysis and mitigation of MitM attacks. Another existing method by [23] proposed a hybrid model combining the CSA with a Decision Tree for intrusion detection in network security. The study used the NSL-KDD dataset for training and testing to improve the classification accuracy and minimize false positives. The CSA was used to optimize the Decision Tree by selecting the best features and tuning the tree's parameters. This hybrid approach leverages the global search capability of CSA and its interpretability of DT to enhance detection accuracy. Despite its advantages, the model may encounter challenges in real-time applications due to the computational overhead of optimizing the Decision Tree with CSA, compared to our proposed study, which provides a more streamlined approach with lower computational complexity. By focusing on DNS traffic and using a lightweight model, our system is better suited for real-time analysis and mitigation of MitM attacks, providing faster processing and adaptability to dynamic network conditions. Our proposed scheme integrates the CSA with a Decision Tree to optimize the detection capability of the anomaly detection scheme. This integration aims to improve detection accuracy and minimize false positive rates, thereby securing the DNS server [24]. The proposed anomaly-based detection scheme, utilizing the CSA and Decision Tree, is integrated into the DNS server to enhance security against MitM attacks. By placing the scheme on the DNS server, it can monitor and analyze DNS traffic in real time, detecting anomalies that indicate potential MitM attacks as indicated in Figure 1. The CSA optimizes feature selection, ensuring that the most relevant data are used for detection, while the Decision Tree classifier accurately distinguishes between legitimate and malicious activities.