# Network Attack Classification in IoT Using Support Vector Machines +
## 4 SVM Models Training and Evaluation
### Training of the SVM Models  
In our case, we have two classes, the benign and the viral class, denoted \(-1\) and \(1\), respectively.  
To construct the training model, we use the following steps [13]:  
1. Label data into either benign and malicious class in the form of vectors \((x_{i},y_{i})\).
2. Apply scaling to the training set.
3. Apply RBF kernel to the training set.
4. Apply cross validation.
5. Conduct a grid search to the training set to retrieve the best values of \((C,\gamma)\).
6. Input the training set and \((C,\gamma)\) values, when training for C-SVM, to create the SVM model.  
Steps 1 to 3 were applied for both SVM models. Steps 4 and 5 were only used to retrieve values \(C\) and \(\gamma\) of the C-SVM detection model. The last step was to use as input the training data to the SVM training and get the SVM model. For the OC-SVM, the training was conducted only on the benign data and as a result only one detection model was created and evaluated against the routing attacks. On the contrary, for the C-SVM method, one detection model was created for each routing attack.  
For the C-SVM method, the significant parameters for each detection model varied based on the attack. For Selective Forward attacks, the scaling step returns data for the parameters _data packets received (\(P_{RC}\)), packets forwarded (\(P_{FR}\)), number of packets dropped (\(P_{DR}\))_ and the _number of announcements received (\(P_{An}\))_. For the Sinkhole attack, the scaling step returns the training set for all five parameters shown in Table 4. The results of the free parameters \((C,\gamma)\) are shown in the column titled Significant Parameters in Table 5. For the OC-SVM, only three parameters were found to be significant, the \(P_{RC}\), \(P_{FR}\), and \(P_{DR}\).  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & & \multicolumn{5}{c}{**C-SVM**} \\ \cline{2-9}
**Monitored Routing Layer Parameters** & \multicolumn{2}{c}{**SF**} & \multicolumn{2}{c}{**SF \& **\& BH**} & \multirow{2}{*}{**Sinkhole**} & \multirow{2}{*}{**OC-SVM**} \\ \cline{2-2} \cline{5-8}  & **FR** & & & & & & \\ \hline Data Packets Received (\(P_{RC}\)) & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline Data Packets Sent (\(P_{St}\)) & & & & & & ✓ & \\ \hline Packets Forwarded (\(P_{FR}\)) & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline Packets Dropped (\(P_{DR}\)) & ✓ & ✓ & ✓ & ✓ & ✓ & ✓ \\ \hline Announcements Received (\(P_{An}\)) & ✓ & ✓ & ✓ & ✓ & ✓ & \\ \hline \hline \end{tabular}
\end{table}
Table 4: SVM evaluation data set when Sink is in the middle.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & \multirow{2}{*}{**Attack**} & \multicolumn{5}{c}{**C-SVM**} & \multicolumn{5}{c}{**OC-SVM**} \\ \cline{3-8}  & & **Benign** & **Viral** & **Total** & **Benign** & **Viral** & **Total** \\ \hline \multirow{2}{*}{SF} & BN & 20 & 20 & 40 & 20 & 100 & 120 \\ \cline{2-8}  & FR & 20 & 20 & 40 & 20 & 100 & 120 \\ \hline \multirow{2}{*}{SF \& BH} & BN & 20 & 20 & 40 & 20 & 100 & 120 \\ \cline{2-8}  & FR & 20 & 20 & 40 & 20 & 100 & 120 \\ \hline \multirow{2}{*}{Sinkhole} & 20 & 20 & 40 & 20 & 100 & 120 \\ \hline Sink in the middle (All attacks) & 20 & 100 & 120 & 20 & 500 & 520 \\ \hline Sink on Top (All attacks) & 200 & 800 & 1000 & 200 & 800 & 1000 \\ \hline \hline \end{tabular}
\end{table}
Table 3: SVM evaluation data set when Sink is in the middle.