# Detection and Prevention of DDoS Attacks on the IoT
## 4 Results and Discussion
In Figure 17e, it can be seen that when the MIX flood is encountered During the attack, the CPU's usage rate will suddenly rise and fluctuate violently, just like the previous attacks. As shown in Figure 17b-e, the usage rate of the memory remains roughly the same as normal. Therefore, we can find out its characteristics from the fluctuation of CPU usage. From the results in Table 4, it can be seen that various attacks will affect the network speed during transmission. In our experiment, the average network transmission speed will drop from an average of 14.2 Mbps to about 0.3 Mbps. Based on the above experimental results, we use a neural network for edge computing and model training. \begin{table}
\begin{tabular}{c c} \hline \hline
**Condition** & **Value** \\ \hline Normal Transmission & 14.2 Mbps \\ SYN Flood Attack & 0.30 Mbps \\ UDP Flood Attack & 0.30 Mbps \\ ICMP Flood Attack & 0.31 Mbps \\ MIX Flood Attack & 0.31 Mbps \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Average speed under the normal transmission, SYN flood attack, UDP flood attack, ICMP flood attack, and MIX flood attack. In this paper, the model of a NN, one-dimensional CNN, and two-dimensional CNN are respectively trained and evaluated. The best-performing model will be applied to the practical validation of the proposed system. Accuracy is used to evaluate the proportion of correct predictions of true and false under all conditions, which can be expressed as  
\[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text {FN}}\times 100\% \tag{1}\]  
where the four conditions, True Positive (TP), True Negative (TN), False Positive (FP), and False Negative (FN), are described in Table 5.  
Figure 17: CPU and memory usages (**a**) normal transmission; (**b**) SYN flood attack; (**c**) UDP flood attack; (**d**) ICMP flood attack; (**e**) MIX flood attack. In this paper, we use the packet traffic dataset to train the three models mentioned above. One data is used as the labeled input, and the training parameters are 10, 50, 100, 150, and 200 times respectively. The batch size of each training is 2500, and the learning rate is 0.00001. The model uses three hidden layers, 128, 64, and 32 neurons, respectively, with an excitation function of \"ReLU\" and the output layer using the \"softmax\" as an excitation function for classification. When using the packet feature dataset for training, four pieces of data are used as label input and trained 10, 20, 30, 40, and 50 times respectively. The batch size is 2500, and the learning rate is 0.00001. The model has three hidden layers of 128, 64, and 32 neurons, respectively, and the excitation function is \"ReLU.\" The excitation function \"softmax\" is used for classification in the output layer. For one-dimensional and two-dimensional CNN, a dropout layer is added after the first layer to prevent overfitting. The training accuracies of the two different pieces of training are shown in Tables 6 and 7, respectively. It can be seen from Tables 6 and 7 that with the increase in the number of training times and the ratio of input, the accuracy of training can reach more than 99% in the end. This shows that according to the characteristics of the environment, there must be more than a certain amount of data collected in  
their weights. Considering that the data of the packet traffic dataset may be affected by the increasing number of users in the IoT, and the features captured will not be able to identify because the data captured is too small, this paper gives the traffic model and feature model the weights of 70% and 30% respectively, as the basis for judging the identification results. Table 8 lists the identification results on the edge computer when measured under different conditions, in which Feature is the identification result of the feature model, Flow means the identification result of the traffic model, and Weighted is the identification result after individual weighting on the two models.