## 3 Materials and Methods
### Convolutional Neural Network (CNN)-Based Methodology for Intrusion Detection  
In this section, we introduce the proposed method for designing an intrusion detection system tailored for IoT and IIoT networks. While numerous approaches exist for implementing intrusion detection in these environments, traditional machine learning algorithms often face limitations in scalability and accuracy when applied to large-scale, high-dimensional IoT traffic. Consequently, deep learning techniques--particularly convolutional neural networks (CNNs)--offer a more effective solution for attack detection. CNNs are well-suited for this task due to their ability to identify spatial correlations among adjacent features within network traffic data, such as packet rates, connection durations, and protocol flags. These convolutional filters excel at capturing local patterns, which are often overlooked by classical models. In addition, CNNs handle high-dimensional input effectively through max pooling layers that reduce feature dimensions while preserving salient information, thus improving generalization and reducing the risk of overfitting. Their hierarchical structure enables robust multiclass classification, making CNNs capable of distinguishing between normal traffic and various types of attacks. Prior works, including those by [PERSON] et al. (2018) and [PERSON] et al. (2011), support the superiority of CNNs in the IoT intrusion detection domain. Although hybrid models like CNN + LSTM can enhance performance, we selected a pure CNN to minimize computational overhead, making the system more suitable for deployment in resource-constrained IoT/IIoT settings. The proposed detection method includes four key stages: (1) preprocessing, (2) data splitting, (3) feature extraction and classification via CNN, and (4) model evaluation. As illustrated in Figure 3, the CNN consists of convolutional, pooling, and fully connected layers. The convolutional layer serves as the core, identifying relevant local features. The pooling layer reduces data dimensionality, and the fully connected layer acts as the final classifier ([PERSON] et al., 2014). \begin{table}
\begin{tabular}{c c} \hline
**Classes** & **Samples** \\ \hline Normal & 1,615,643 \\ \hline Backdoor-based attack & 24,862 \\ \hline DDoS\_HTTP-based attack & 49,911 \\ \hline DDoS\_ICMP-based attack & 116,436 \\ \hline DDoS\_TCP-based attack & 50,062 \\ \hline DDoS\_UDP-based attack & 121,568 \\ \hline Fingerprinting-based attack & 1001 \\ \hline MITM-based attack & 1214 \\ \hline Password-based attack & 50,153 \\ \hline Port\_Scanning-based attack & 22,564 \\ \hline Ransomware-based attack & 10,925 \\ \hline SQL\_injection-based attack & 51,203 \\ \hline Uploading-based attack & 37,634 \\ \hline Vulnerability\_scanner-based attack & 50,110 \\ \hline XSS-based attack & 15,915 \\ \hline \end{tabular}
\end{table} 
Table 3: Distribution of 15-class samples. While CNNs are commonly associated with image processing, they are also effective for non-visual data, such as communication traffic. Their structure enables the learning of temporal-spatial dependencies within sequences of traffic features. Pooling operations further reduce noise and redundancy, focusing the model's attention on key traffic characteristics. This ability to generalize is essential for handling previously unseen attacks. Furthermore, CNNs' inherent support for multiclass classification makes them valuable for identifying various attack types or anomalies in traffic patterns. The overall architecture of the proposed method is shown in Figure 4. The operation of the proposed method is organized as follows:  
1. _Preprocessing_: Data are initially preprocessed to improve their quality and prepare them for analysis. 2. _Data splitting_: The preprocessed data are divided into two subsets: a training set for model training and a testing set for performance evaluation. 3. _Feature extraction_: The training data are input into the CNN to extract key features from the dataset. 4.