# DeepDCA: Novel Network-Based Detection of IoT Attacks Using Artificial Immune System
## 6 DeepDCA: Deep Learning Dendritic Cell Algorithm
### Anomaly Metrics: \(Mcav\) and \(K_{\alpha}\)
Therefore, the hidden layer neurons should decide for a sign and threshold for each feature. Then, we used \(selu\) activation functions for the hidden layer and an \(alpha-dropout\) layer between the hidden layer and the output neurons. The output neurons can choose a sign and weight per input signal, and would again yield signals within the interval [0, 1]. Figure 6 represents the accuracy and loss of SNN model. #### 7.5.3 Dendritic Cell Algorithm Module

Once the data pre-processing phase is performed, the model moves to the next stages -as described in Section 3, which are the Signal Processing, the Context Assessment, and the Classification Procedure. ### Evaluation Criteria

The confusion matrix is usually used to evaluate the performance of the classification model. The confusion matrix relies on the four terms of True Positive (TP), True Negative (TN), False Negative (FN) and False Positive (FP) [81] as shown in Table 6.

* **TP:** is the number of actual malicious records classified as attacks. * **FP:** is the number of actual legitimate records classified as attacks. * **TN:** is the number of actual legitimate records identified as normal,
* **FN:** is the actual anomalous records categorized as normal

Also, we evaluate the performance of DeepDCA model in terms of Accuracy, Precision, Recall, F-measure, and False alarm rate:

\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{12}\]

\[Precision=\frac{TP}{TP+FP} \tag{13}\]

\[Recall=\frac{TP}{TP+FN} \tag{14}\]

Figure 6: SNN Model Accuracy and Loss. ## 8 Result and Analysis

This section presents the results obtained when applying the DeepDCA model for intrusion detection. Several hyper-parameters are examined such as the selected features and the attack types. ### Impact of Features

Table 7 illustrate the influence of the features employed in the learning process. The first three records in the table represent the result of the imbalanced data. We examined all features of the BoT-IoT then the best 10 features, and finally, the selected features using information gain (see Section 7.4). As the accuracy is misleading metrics when dealing with imbalanced classes problem, Recall, Precision F-measure are telling a more truthful story. Precision is a measure of (exactness), recall for (completeness) of a model and the F-measure is a harmonic mean of the two. As shown in Table 7, even though the accuracy for all features of the imbalanced classes gets a better result, the rest of the metrics are not in line with it. The IG-selected features have the best indication of detection performance for imbalanced classes. On the other hand with balanced data, as expected fewer features render better results in general. The results produce slightly worse when added to the full features set. Consequently, DeepDCA yields a better result when dealing with balanced classes and features that have a higher importance in the detection process. For make it easier to compare the result, Figure 7 shows the same results in a different format. \begin{table}
\begin{tabular}{|c|c|c|c|} \hline \multirow{2}{*}{**Actual**} & \multicolumn{2}{c|}{**Predicted**} \\ \cline{3-4}  & & **Positive** & **Negative** \\ \hline \multirow{2}{*}{**Actual**} & **Positive** & True Positive & False Negative \\ \cline{2-4}  & **Negative** & False Positive & True Negative \\ \hline \end{tabular}
\end{table} 
Table 6: Confusion Matrix. \begin{table}
\begin{tabular}{l l l l l l} \hline \hline \multirow{2}{*}{**Features**} & \multicolumn{1}{c}{**Accuracy**} & **Precision** & **Recall** & **F-Measure** \\ \hline \multirow{4}{*}{**Im-Data**} & **All** & 0.7613 & 0.5091 & 0.7368 & 0.6022 \\ \cline{2-6}  & **Best 10** & 0.5800 & 0.3200 & 0.6667 & 0.4324 \\ \cline{2-6}  & **IG** & 0.6550 & 0.7000 & 0.6422 & 0.6699 \\ \hline \multirow{4}{*}{**Ba-Data**} & **All** & 0.8950 & 0.7900 & 0.9836 & 0.8827 \\ \cline{2-6}  & **Best 10** & 0.9500 & 0.9000 & 1.0000 & 0.9474 \\ \cline{1-1} \cline{2-6}  & **IG** & 0.9873 & 0.9917 & 0.9836 & 0.9877 \\ \hline \hline \end{tabular}
\end{table}