## 3 Methodology
### Detection Algorithm
Each instance is characterized by 83 features, including network flow features such as source and destination IPs, ports, protocols, packet sizes, duration, and statistical features derived from the flow. The dataset exhibits an imbalanced class distribution, as depicted in Figure 4. This comprehensive dataset captures different attacks on IoT devices. Generating a new dataset from scratch is time-consuming and resource-intensive, involving data collection, labeling, and preprocessing. Utilizing the existing dataset allows for a focus on developing and refining the proposed detection scheme. Handling imbalanced data is crucial for building an effective model. We applied several preprocessing steps to address the class imbalance in the IoTID20 dataset to ensure the model could learn from the data effectively. We cleaned the data to remove duplicates or irrelevant instances, ensuring the dataset's quality. Feature selection was conducted to reduce dimensionality and enhance accuracy by retaining the most relevant features and ensuring that all features contributed equally to the learning process. To tackle the class imbalance, we employed the Synthetic Minority Over-Sampling Technique (SMOTE), \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameters** & **Values** \\ \hline Platform & Kaggle \\ \hline Programming language & Python 3.10 \\ \hline Algorithms & Decision Tree, CSA, SVM, LOF, CSA-ANN, CSA-DT \\ \hline Datasets & IoTID20, Intrusion Detection Dataset (IDD) \\ \hline Metrics & Precision, Recall, F1-score, Accuracy \\ \hline Objective function & Statistical Process Control \\ \hline Population size & 10–20 (nests) \\ \hline Number of iterations & 20–50 \\ \hline Discovery rate & 0.2–0.4 \\ \hline Max\_depth & 10–20 \\ \hline Min\_samples\_split & 5–10 \\ \hline Min\_samples\_leaf & 3–5 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Simulation Parameters. which generates synthetic samples for the minority class, thereby balancing the dataset. This combination of preprocessing steps, data cleaning, normalization, feature selection, and oversampling using SMOTE ensured that our model could learn effectively from the imbalanced data and make accurate predictions. To solve the overfitting of the model, our study uses CS to select the most relevant features from the preprocessed data, minimize dimensionality, and focus on the most relevant information. Furthermore, the CS optimizes the hyperparameters of the Decision Tree classifier, tuning its complexity to avoid memorizing noise in the training data. The trained model was evaluated using cross-validation on a separate dataset to ensure its generalization capability and confirm that the selected features and optimized hyperparameters lead to effective anomaly detection without overfitting the specific characteristics of the training set. Our evaluation benchmarks the proposed lightweight anomaly detection framework against contemporary state-of-the-art methods, encompassing ensemble techniques like Random Forests and deep learning architectures such as Convolutional Neural Networks (CNNs). The comparative analysis reveals that while our approach prioritizes computational efficiency and maintains a lean profile suitable for real-world deployment, it achieves comparative performance in detecting MitM attacks in DNS. By directly contrasting our method with these established approaches, we provide a clear and compelling context for its effectiveness, underscoring its advantages in balancing detection accuracy with the need for resource-conscious operation in practical security implementations. Since the CSA optimizes feature selection, the main ten features are shown in Table 2, and their importance is extracted by the CSA. Figure 5 shows the confusion matrix of the proposed scheme, indicating that the positives and negatives were identified, which suggests good performance. It also shows that false positives and negatives are minimized. The proposed scheme was implemented on the Kaggle platform using Python.