# Network Attack Classification in IoT Using Support Vector Machines +
## 4 SVM Models Training and Evaluation  
There are two stages of SVM, the training stage and the evaluation stage. At the training stage, the SVM takes as input training data and creates a hyperplane. The classification hyperplane, the detection model, is evaluated using data that were not used at the training stage. The SVM model maps the data into the hyperplane and returns the classification result \(y\). The data used in both stages were retrieved from two set of scenarios and two different network topologies. Figure 1(a),b shows the two types of network topologies that have been used for the current work. Each figure shows the Sink node to be either in the middle of the network or on a corner of the network and the hop distance of each node to the Sink (shown in the node). Figure 1(a), places the Sink in the middle and is considered to be the best case scenario as four nodes are one hop away from the Sink and the maximum distance from the Sink is only four hops. The sensor activity used for training the SVM models were taken from experimental results from the Sink-in-the-Middle topology. SVM models were also created as a general approach to detect the presence of any attack within the network. The same general SVM model, trained for the Sink in the middle topology, was also evaluated against a new topology where the Sink is placed at the top left corner of the network (see Figure 1(b). The network topology in which the Sink is found on top of the network has only two nodes directly connected to the Sink, and the farthest node is eight hops away. To create the dataset for two class activities, the benign and the malicious, two types of experimental scenarios were used. The benign scenarios, in which all nodes within the network were executing the benign intended application, and the malicious scenarios, in which at least one node, except the Sink node, was malicious. From each node, a set of parameters was collected and used in the creation and evaluation of its IDS model (shown in Table 1). The parameters are taken from the routing layer, the layer the attacks exploit. Prior work has shown that when using parameters from the layer under attack, the IDS achieves better results compared to when using parameters from other layers [3; 10; 11; 12]. Figure 2: Network topology and placement of the Sink node. (**a**) Sink in the middle of the grid. (**b**) Sink on top left corner of the grid. Specifically, 80% randomly selected data values from both classes were used for the training stage and the other 20% were used to evaluate the detection models. For the current work, we used the attacks from the work of [1] and the RMT tool to collect the data [10]. There are three major routing layer category attacks, the Selective Forward (SF), Blackhole (BH), and Sinkhole. The SF attacks drop packets randomly either by using a predefined ratio (Forwarding Ratio (FR)) or by selectively choosing which neighbor's packets to drop (Block Node (BN)). For the current work, the ratio of the FR attack was set to 50%. Each packet received by the malicious node has a 50% probability to be forwarded or dropped. The probability ratio is determined by a random function. The BN version of the attack randomly chooses a neighbor to not forward its packets. The choice of the neighbor to block changes throughout the experiment. In our case, a new target node is selected every time the malicious node receives 10 packets from its current target. The Blackhole attack complements the SF attacks to create a greater effect. BH attack lures the traffic towards the malicious node, advertising that is one hop away from the Sink node and in turn the SF selectively chooses which packet to forward. The Sinkhole attack advertises that the malicious node is the Sink, aiming to gather the traffic and never allow them to reach their destination. The data was collected from each node at predefined time intervals called epochs and averaged per the distance of the sensor nodes from the Sink node [10].