# Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats
## 5 Research Methodology  
### The Proposed System  
As shown in Figure 6, our proposed system is composed of three components. First is the traffic coming from smart city terminal nodes. The second is the anomaly classification system that takes traffic as the input from the first component. Using a proposed IDS approach, it evaluates traffic from smart devices and classifies it as being regular or anomalous. This multi-classification system can detect if the packet is normal or an attack, and the type of attack. The third is the cloud layer that takes the output from the second component. It communicates with cloud nodes via connecting to a set of fog nodes. If the IDS detects normal traffic, the traffic is allowed to communicate with the cloud system, otherwise, the traffic is prevented.  
**SALMA** is a five-tier classification model based on ELM algorithms presented to categorize anomalies. As shown in Figure 7, R2L and DOS assa  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Model** & **Advantages** & **Disadvantage** \\ \hline \multirow{3}{*}{**Ensemble approach**} & • Enhances precision and stability. & •Complexity of computation. \\  & •Reduced variance, contributing to the avoidance of & •Difficit to interpret if the model is large. \\  & overfitting problems. & •Requires fine-tuning of various parameters. \\ \hline \multirow{3}{*}{**NB Classifier**} & •It performs well with textual data. & •A fundamental assumption regarding the data \\  & •It is simple to build. & •Mbitribution’s shape. \\  & •It is quick when compared to other methods. & •Due to a lack of data, a frequentist must estimate a \\  & •SVM & •SVMs may be used to describe decision boundaries that are & •A vast number of dimensions contribute to the results’ lack \\  & •not linear. & •of transparency. \\  & •When linear separation is required, it performs comparably & •Selecting an effective kernel function is difficult (prone to \\  & to logistic regression. & overfitting/training difficulties). \\  & •SVM is resistant to overfitting concerns. &Memory complexity. \\ \hline \multirow{3}{*}{**DT**} & •Decision trees are a rapid approach for both learning & •Problems with diagonal decision boundaries. \\  & •They are well-suited for handling qualitative & •Easy to overfit. \\  & (categorical) data. & •Extremely sensitive to tiny data perturbations. \\  & •They work best with decision boundaries parallel to the & •Out-of-sample prediction issues. \\ \hline \multirow{3}{*}{**ANN**} & •Recognize complicated connections between dependent and & •Local minima. \\  & independent variables with ease. & •Overfitting. \\  & •Capable of dealing with noisy data. & •The processing of an ANN network is difficult to \\ \hline \multirow{3}{*}{**ELM**} & •Fewer optimization restrictions. & •Prodly conditioned hidden layer output matrices lead to \\  & •Increased efficiency. & low robustness. \\ \cline{1-1}  & •Simple implementation. & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of classification algorithms [50].  
Figure 6: The proposed system components.  
since their detection accuracy is the greatest. Then, both Probe and U2R attacks are in the next levels, as their models have lower accuracies. Each layer in our model has a single classifier. The training dataset is separated into two categories at each layer: one for each form of attack, and another for \"Other\" traffic, or an assault that the next layer must identify. Consequently, the model is trained on five datasets and it adopts a one-versus-all technique. We utilize the ELM technique in all layers, because of its resilience against noisy training data.