# Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks
## 5 Experiment Setup and Evaluation
### Evaluation Results  
#### 5.3.1 Semi-Supervised Classification Results  
In this evaluation experiment, the model was first evaluated in predicting a single unlabeled attack at a time when the model did not see attack behaviors during the training phase. Then, the model was evaluated in predicting two attacks that were not seen by the model during the training phase using a mixture of testing traffic of DIS and rank attacks, besides the normal traffic. The model was trained using the normal traffic samples only where the loss threshold was stored and used to detect the abnormal behaviors.  
Figure 5 shows the loss values relevant to the number of epochs over the normal training dataset. The loss value reaches its lower value near 300 epochs, which means that the epochs are sufficient for the model. The average reconstruction error (loss) recorded by the model during the training phase is 0.085, which is stored as a threshold value. As mentioned earlier, when predicting new traffic, the model will reconstruct the error using trained normal samples parameters (weight and bias). If the given traffic is not within the normal traffic range, the reconstruction error should be relatively higher than the threshold. Figures 6  
Table 7 presents the performance metrics of the binary classification using DIS testing instances. It shows that the overall DIS attack detection accuracy is 99%, with a precision, recall, and f1-score of 99%, 98%, and 98%, respectively, using the DIS dataset. With the rank attack classification, the accuracy is 96%, and the precision, recall, and f1-score are 85%, 98%, and 91%, respectively, as shown in Table 8. For the wormhole DAE classification, the overall accuracy detection rate is 92%, with a precision, recall, and f1-score of 70%, 93%, and 80%, respectively, as shown in Table 9. These values are much lower than those of the other two attack cases because the reconstruction error value for the wormhole attack traffic is lower than the other attack errors. In other words, the difference in the feature values changes between the wormhole attack, and there is less normal traffic compared with those change values in other attacks. Finally, by predicting a combination of two untrained attacks (DIS, rank), the overall accuracy of classifying the traffic is 95%. The precision, recall, and f1-score reported in DIS are 99%, 95%, and 97%, respectively, which are much higher than those in the rank attack, which are 93%, 53%, and 68%, respectively, as listed in Table 10. Again, this is due to the reconstruction error value for the rank attack traffic being much lower than that of the DIS attacks, making it more challenging to detect.  
\begin{table}
\begin{tabular}{l l l l l} \hline \hline  & **Precision** & **Recall** & **F1-Score** & **Accuracy** \\ \hline Normal & 0.99 & 0.98 & 0.98 & 0.99 \\ Attack & 0.99 & 0.98 & 0.98 & 0.99 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Performance Metrics in DAE DIS Attack Classification.  
Figure 8: Average Predicted Wormhole Attack Loss Compared to the Normal Loss Threshold.  
Figure 7: Average Predicted Rank Attack Loss Compared to the Normal Loss Threshold.