# Intrusion Detection and Prevention in CoAP Wireless Sensor Networks Using Anomaly Detection
## 3 Anomaly-Based Intrusion Detection in Internet-Integrated CoAP WSN
### Learning Methodology  
Supervised Learning is a family of Machine Learning (ML) techniques that searches for the design of computational models capable of learning patterns from annotated data, in order to automatically classify new sets of unseen data. The performance of these techniques highly depend on the quality of the data and the parameters used in the configuration of the model, such as the kernel function and learning rates. These parameters must be selected carefully, in order to build models that can deliver good quality results.  
Concerning the data used, it is preprocessed using Standardization, i.e., all of the features have a gaussian distribution of mean 0 and and standard deviation 1. This ensures that the features have the same underlying distribution, thus avoiding any misbehaviour from the ML algorithms. To extract features from the original data we employed the Principal Component Analysis (PCA) and Linear Discriminant Analysis (LDA).  
The algorithm used to perform the detection of intrusions is the Support Vector Machines (SVM). SVMs are powerfull classification methods that perform well using reasonable amounts of computational resources. This is an important requirement to take into account on these systems, which makes the use of Neural Networks infeasible due to their excessive computational requirements and time-consuming learning process. Besides, SVMs have a faster classification procedure, which facilitates a real time implementation, and they have the advantage of being non-linear classifiers, based on the kernel function that is used.  
The intrusion detection mechanism was implemented using two different approaches: multi-class and binary-class. In the multi-class case we are interested in knowing which intrusion the system has detected. On the other hand, in the binary-class case we are simply detecting if there was an intrusion or not. To transform the multi-class problem into a binary-class one, we reduce the number of labels to two, where misbehavior labels were converted to a single label. For example, the multi-class array of labels [0; 1; 2; 1; 0; 3; 4; 2; 1] is converted into [0; 1; 1; 1; 0; 1; 1; 1; 1], where 0 means no intrusion and 1 means intrusion. The calculation of the features and the learning methodology considered are depicted in Figure 2. In this figure, the steps marked as \"2\" take place simultaneously, meaning that when the calculation of the features is completed the new data will be available for classification. Simultaneously, the network traffic starts to be obtained (using a network sniffer) again by the device supporting the IDS (the 6 LBR in our implementation, as previously discussed in the context of Figure 1).  
Referring again to Figure 2, in step \"3\" a set of labels is returned, and such labels are computed by applying the learned model to the test data. The process involves the splitting of packets and the calculation of features, and its aggregation is analyzed in greater detail in the context of the experimental evaluation, which we discuss next.