## 4 The Proposed MRMR-SATIDS System
### Applying SATIDS to an IoT system

Table 4: Performance comparison of DR % using ToN-IoT database. Figure 24: Alerts generated by CH nodes. The residual energy after 400 rounds is represented in Figure 26. The red points present the normal nodes while the green points present the attacker nodes. As noticed from the figure, after 400 rounds, only 30% of the normal nodes reach the threshold energy. Those nodes are the ones that were elected many times to be the CH. Only 8% of the attacked nodes reached the threshold since the BS did not select any of the attacked nodes as a CH after putting them in a blacklist. The proposed system was able to detect 24 out of 25 attacked nodes. ### Robustness and Generalization Test

In machine learning and deep learning, robustness and generalization are critical. To demonstrate the robustness and generalizability of the proposed method, its performance is evaluated on two different network intrusion detection datasets such as ToN-IoT and InSDN datasets for network attack detection and network attack classification. Figures 9-23 exhibit detailed performance results for network attack detection and classification. On both datasets, the proposed model detected the network attacks with 99% accuracy. As a result, the proposed model should be regarded as robust and generalizable. The proposed approach, however, may not be resilient or generalizable to an adversarial updated dataset or adversarial environment, therefore the case study is not shown in this paper. Figure 26: Nodes residual energy. Figure 25: Network lifetime. ## 6 Conclusions and Future Work

IoT is an extremely powerful platform for connecting objects to the Internet. However, IoT applications are susceptible to many security vulnerabilities that need to be mitigated. Users' safety and privacy concerns are on the rise due to IoT system's massive attack vector. Improved security measures can be achieved with the use of ML. It is a never-ending challenge to find the best ML-based IDS techniques. This research offers a two-level deep learning methodology called SATIDS based on the LSTM network to improve the performance of IDS systems. MRMR feature selection technique is utilized to minimize the huge number of features in the dataset. Using the MRMR technique improved the proposed IDS performance and its ability to detect various types of attacks. Two of the latest realistic IoT datasets, namely ToN-IoT and InSDN, are used to evaluate the efficiency of the proposed system. These datasets contain various types of attacks that could cause IoT failure. Using MRMR offers a much better overall system performance. Using 500 hidden and two LSTM layers achieves accuracy of 97.5%, precision of 98.4%, detection rate of 97.9%, and F1-score of 98.05% on ToN-IoT dataset, and precision of 99%, DR of 99.6%, and F1-score of 99.3% on the InSDN dataset. In every experiment across multiple network datasets, the suggested model outperformed the state-of-the-art approaches. The proposed MRMR-SATIDS system succeeded in detecting a wide range of attacks. This demonstrates the suggested model's strength and flexibility for use with other network traffic datasets. Finally, the trained algorithm is implemented in a power-saving IoT system that contains 250 mobile nodes to get close to the real network. This network used the EHRT routing protocol to save sensor energy and extend the network's lifetime. The following changes will be made in future work and are anticipated to increase the proposed system's decision accuracy:

* Analyze the performance of the proposed system against FGSM and JSMA attacks [29] to determine how robust the system is in an adversarial environment. We will continue to concentrate on the defense strategies that resist such attacks in the future. * Focus on developing methods for enhancing the SATIDS techniques to achieve better results for low-record attacks and detecting zero-day attacks on IoT systems. * Study the performance of the proposed SATIDS on a large, mobile, and heterogeneous real IoT network. Conceptualization, R.H. and S.A.E. ; methodology, S.A.E.