# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion
### Artificial Neural Network (ANN)  
A form of machine learning technique called artificial neural networks (ANN) is based on the structure and operation of the human brain. A number of tasks, including classification, regression, and prediction, are carried out using ANNs. An ANN is made up of layers of interconnected processing nodes called neurons at the highest level. The output layer generates the final prediction or output after receiving input data from the input layer. There may be one or more hidden layers that carry out intermediary computations between the input and output layers.  
Each neuron in an ANN receives input values, processes them, and generates an output. A neuron computes by adding a bias term, multiplying the input values by weights, and then passing the output through an activation function. The parameters' weights and biases are acquired by training, and the activation function chooses the neuron's output depending on the weighted sum of its inputs.  
In order to reduce the error between the projected output and the actual output, the ANN modifies the weights and biases during training. The confusion matrix is given below for TON-IOT and BOT-IOT, representing binary and multiple-class classification for each (Case 1 to Case 4) for 15 features (Table 7). It is observed that in Case 1 and Case 3, the FP value is zero and the FN value is one, so this makes the model less robust for multiple-class classification compared to Case 2 and Case 4, with FP and FN values as zero. Therefore, it obtains the maximum accuracy.  
The subsequent ROC curves are given for BOT-IOT and TON-IOT with 15 features for multiple-class and binary classifications. When the steepness of the ROC curve reaches the top left corner then it is considered an excellent model, hence, in this case Figure 8b,d touch the top left corner. However, Figure 8a,c are almost touching the top left, making them a little less effective as models but still optimal. The AUC scores provide a summary measure of the model's discriminatory power; a higher AUC indicates a more effective DDoS attack detection model. Hence, Figure 8a,c give 0.99, but Figure 8b,d give 1.00 as the AUC score.  
ANN is significant for detecting DDoS attacks in IoT devices due to its ability to analyze complex patterns and handle high-dimensional, heterogeneous data. It learns and adapts to evolving attack patterns, ensuring accurate detection of emerging DDoS  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Case 1 (All Attacks)** & \multicolumn{4}{c}{**Case 2 (DDoS Attacks)**} \\ \hline True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ \hline Class 0 (Normal) & 60,119 & 0 & Class 0 (Normal) & 59,988 & 0 \\ Class 1 (Attack) & 1 & 59,880 & Class 1 (Attack) & 0 & 4012 \\  & **Case 3 (All Attacks)** & \multicolumn{4}{c}{**Case 4 (DDoS Attacks)**} \\ True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ Class 0 (Normal) & 292,999 & 0 & Class 0 (Normal) & 142,529 & 11,245 \\ Class 1 (Attack) & 1 & 293,888 & Class 1 (Attack) & 4804 & 149,682 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Confusion matrix for TON-IOT (Case 1 and Case 2), BOTIOT (Case 3 and Case 4), and ANN (15 features).  
techniques in IoT environments. ANN's parallel processing enables real-time detection, mitigating potential damages and maintaining IoT service availability.  
Combining ANN with other techniques improves detection accuracy and reduces false positives. By reducing reliance on signature-based approaches, ANN enables the detection of zero-day attacks and novel vectors. It can be implemented on IoT devices or in the cloud, facilitating distributed detection and response mechanisms. Overall, ANN provides a robust and adaptable approach, enhancing the resilience and security of IoT networks against DDoS attacks.  
\[Y=w_{1}X_{l}+w_{2}X_{2}+b \tag{3}\]