# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 4 Proposed Hybrid Deep Learning-Based IDS (DL-IDS)
### Hybridization of DAE and DANN Models (DAE-DANN)  
This section describes the IDS training and classification phase using the DAE-DANN approach. Algorithm 4 shows the main steps of the approach. Let us first define some terms: let \(\mathbb{R}\) be a set of real numbers and \(\mathbf{X}\ \in\ \mathbb{R}^{N\times d}\) be a matrix of \(N\) training samples (network traffics) of \(d\) features each; therefore, \(\mathbf{x}_{i}=(x_{i1},\ x_{i2},\ \dots,\ x_{id})\) stands for the \(i\)th training traffic samples, and \(\mathbf{y}\ \in\left\{y_{0},\ y_{1},\ \dots,\ y_{i}\right\}^{N\times 1}\) is a vector of \(N\) multi-labels of the training samples. \(\mathbf{Z}\ \in\ \mathbb{R}^{M\times d}\): a matrix of \(M\) testing samples (network traffics) of \(d\) features each; therefore, \(\mathbf{z}_{i}=(z_{i1},\ z_{i2},\ \dots,\ z_{id})\) stands for the \(i\)th traffic test samples. \(\mathbf{I}\ \in\left\{l_{0},\ l_{1},\ \dots,l_{i}\right\}^{M\times 1}\) is a vector of \(M\) multi-labels of the testing samples. In the first phase, the DAE model is trained using normal traffic samples. During the training process, the model will reconstruct the initial input by minimizing the mean squared error between the input and output. The average loss value (reconstructed mean square error) result of the training process will be stored as a threshold named \(normalLoss_{threshold}\). During the test phase, the model calculates the average reconstruction error for a given test sample \(z_{i}\) using the function shown in Equation (4). This function computes the difference between the average sum of the original input features (\(\mathbf{z}_{i_{test}}\)) of a given sample \(z_{i}\) and the reconstructed inputs (\(\mathbf{z}_{i_{predict}}\)) when applying the DAE to the same sample \(z_{i}\) and using the tuned training parameters' weight and the bias that was used with the normal training samples \(\mathbf{X}\). The resulting reconstruction loss value (\(z_{i}loss_{diff}\)) will then be compared with the stored normal samples' loss threshold (\(normalloss_{threshold}\)) boundary and attack (\(attack_{t}thresholds\)) boundaries. The (\(normalloss_{threshold}\)) boundary is defined between 0 and \(normalloss_{threshold}\times 2\). The attack\(attack_{l}\)_thresholds_ boundary is defined between \(\frac{attack_{l}threshold}{2}\) and \(attack_{l}\)_thresholds_\(\times\) 2. If \(z_{i}loss_{diff}\) is out of these boundaries, then this traffic is considered a new attack label. \[z_{i}loss_{diff}=\frac{\left\|\sum_{j=1}^{d}\left(z_{i_{predict_{j}}}-z_{i_{ test_{j}}}\right)\right\|^{2}}{d}, \tag{4}\]  
where \(d\) is the number of features. To simplify, let us consider the following example: Suppose that we are starting with training set \(\mathbf{X}\) containing normal traffic samples and one known attack labeled (\(y_{0}\), \(y_{1}\)), where \(y_{0}\) is the normal traffic label and \(y_{1}\) is the attack traffic label number 1. Therefore the \(normal_{threshold}\) and \(attack_{l}\)_threshold_ are known. Let us assume that we have another unknown attack added to the test sample \(\mathbf{Z}\) in the range of \(z_{1}\). \(z_{m}\) that occurs at a specific time sequence. These test samples are passed to the DAE, compute the \(z_{i}loss_{diff}\) of each sample \(i\), and are compared to the exciting \(normal_{threshold}\) and \(attack_{l}\)_threshold_. If the \(z_{i}loss_{diff}\) value is within the \(normal_{threshold}\) boundary or range, then this sample can be considered as normal traffic, whereas if \(z_{i}loss_{diff}\) is within the \(attack_{l}\)_threshold_, then this traffic can be considered as \(attack_{1}\). Therefore, these samples will be passed to the supervised DANN model. However, since this is a new attack type, the \(z_{i}loss_{diff}\) of attack samples should be different and out of the range of the \(normal_{threshold}\) and \(attack_{l}\)_threshold_ boundaries.