# Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats
## 1 Introduction
The huge number of IoT devices distributed over a broad array of protocols, devices, technologies, and services challenges the administration of the emerging IoT environment. As a result of these Internet integration protocols, substantial cybersecurity dangers and vulnerabilities exist for exploiting information regarding citizens' everyday activities [11]. At least two major security issues confront each smart application. The first challenge is in recognizing zero-day attacks that start in a smart city's cloud data center via a range of protocols utilized by IoT devices, presuming that the massive attacks are hidden within IoT devices. The second difficulty is in identifying cyber-attacks intelligently (e.g., IoT malware attacks, etc.) [11] before IoT networks harm a smart city. Currently, most classic IDSs are still in use [12] because IoT network devices in smart cities have limited resources and capabilities, and are not suited for them [12]. However, updated hacker technology and sophisticated attack skills may create significant amounts of data with various features, including many samples, a variety of new attack kinds, and an unequal distribution of data. These issues are common in today's cyber environment, and they surely lower IDS performance [13]. ML can process multi-dimensional data and provide real-time predictions in dynamic contexts. Machine Learning developments have now broadened their application to include the creation of successful IDSs. Learning-based systems such as neural networks (NNs) have outperformed conventional approaches in various areas. Because of its learning and adaptable nature, ML-based IDSs can keep up with multiple threats. This article describes an approach for detecting general-purpose network incursions using an Extreme Learning Machine (ELM) network. The bulk of previously announced intrusion detection algorithms expose only one form of attack at a time, or can separate legitimate traffic from attacks. A five-level classification model based on ELM algorithms is used in the proposed system. R2L and DOS ARE IDENTIFIED FIRST because their assaults have incredible detection accuracy. Then, since their models have lesser accuracies, both Probe and U2R assaults are in the following tiers. The suggested model is tested on the NSL-KDD [14] and utilizes one classifier per layer, and it may outperform popular shallow ML-based IDSs. This article employs a multilayer technique based on ELM classification algorithms. The following are some of this paper's most significant contributions:  
* Developing a multi-level hybrid system capable of detecting intrusions based on six-flow characteristics that a standard Software-Defined Networking (SDN) controller can readily collect. * Grouping multi-level homogenous classifiers hierarchically based on Machine Learning. * Evaluating the suggested system's efficacy using standard datasets (NSL-KDD, KDD-CUP99) that contain a collection of special attacks not included in the training set. * Gains in accuracy are up to 95% compared to well-known state-of-the-art supervised Machine Learning methods employing similar datasets and flow-based features. The remainder of the paper is organized as follows: the second section presents recent related work. The third section provides background information on smart cities. Section 4 examines anomaly detection methods; Section 5 gives a potential solution for anomaly detection; Section 6 discusses experiments and findings, and Section 7 concludes with a discussion of future directions.