## 3 Materials and Methods
### Performance Evaluation  
The proposed CNN-based model is designed for practical deployment in IoT/IIoT environments, operating on edge devices (e.g., Raspberry Pi, NVIDIA Jetson) or central gateways that aggregate sensor traffic. This architecture enables real-time processing, with an inference time of approximately 9 milliseconds per sample, allowing attack detection in dynamic environments with moderate traffic volumes (100-1000 flows per second).  
The hardware requirements include ARM-based processors (e.g., Cortex-A72) or lightweight GPUs (e.g., Jetson Nano) with a minimum of 2 GB RAM and 500 MB storage (for model weights and temporary data). To optimize resource usage, techniques such as model pruning (reducing parameters by 30-40% without accuracy loss) and quantization are applied, enabling deployment on resource-constrained devices. Practical tests on Raspberry Pi 4 have demonstrated processing of 85 flows per second with 98.7% accuracy, validating the method's efficacy in real-world settings. For large-scale networks (e.g., smart factories), distributed frameworks (e.g., AWS Greengrass) can distribute computational load across edge and fog nodes. This approach balances accuracy, speed, and resource efficiency, offering a practical pathway for deploying intrusion detection systems in IoT/IIoT environments.  
To evaluate the proposed method, several criteria are considered, including accuracy, precision, and recall (also known as sensitivity). Each of these criteria is defined as follows:  
**Accuracy**: It measures the model's ability to correctly predict the output. It offers a general assessment of the model's performance and its capacity to make accurate predictions across all classes. The calculation of accuracy is shown in Equation (4).  
\[Accuracy=\frac{TP_{Attack}+TN_{Normal}}{TP_{Attack}+TN_{Normal}+FP_{Normal}+ FN_{Attack}} \tag{4}\]  
**Recall** or **Sensitivity**: It measures the model's ability to correctly identify positive instances among all actual positive instances in the dataset. Recall is affected by the number of false negatives, where the model fails to predict positive instances. The calculation of recall is shown in Equation (5).  
\[Recall=\frac{TP_{Attack}}{TP_{Attack}+FN_{Attack}} \tag{5}\]  
**Precision**: It represents the ratio of true positives to all examples classified as positive, also known as the positive predictive value. It quantifies the proportion of actual attacks among all flows classified as attacks. When the detector makes more false positive predictions than correct (true positive) predictions, the precision value decreases. Precision is calculated using Equation (6).  
\[Precision=\frac{TP_{Attack}}{TP_{Attack}+FP_{Normal}} \tag{6}\]  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Parameters** & **Value** \\ \hline Activation & ReLU in all layers, softmax in the last layer \\ \hline Loss & Sparse\_categorical\_crossentropy \\ \hline Optimizer & Adam \\ \hline Metrics & Accuracy \\ \hline Epochs & 10 \\ \hline Batch\_Size & 32 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Key parameter values for the proposed CNN model.  
**F1 Score**: It serves as a suitable criterion for assessing detector performance, as it integrates both precision and recall. Equation (7) outlines the expression for F1 score calculation.  
\[F1\ Score=2*\frac{Precision*Recall}{Precision+Recall} \tag{7}\]