# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
## 4 Simulation Results  
The parameters _Acc_, \(P_{d}\), \(P_{fa}\), \(P_{md}\), and PPV, then TT, PT, and Mem, were used to evaluate and compare WSS performance to the three classical ensemble approaches. Equations (1)-(5) formulae were used to calculate the first five metrics:  
\[P_{d}=\frac{\rm{T_{P}}}{\rm{T_{P}+F_{N}}}\times 100 \tag{1}\]  
\[P_{fa}=\frac{\rm{F_{P}}}{\rm{T_{N}+F_{P}}}\times 100 \tag{2}\]  
\[P_{md}=\frac{\rm{F_{N}}}{\rm{T_{P}+F_{N}}}\times 100 \tag{3}\]  
\[\rm{PPV}=\frac{\rm{T_{P}}}{\rm{T_{P}+F_{P}}}\times 100 \tag{4}\]  
\[Acc=\frac{\rm{T_{P}+T_{N}}}{\rm{T_{P}+T_{N}+F_{P}+F_{N}}}\times 100 \tag{5}\]  
where the true positive, true negative, false positive, and false negative values, respectively, are denoted by TP, TN, FP, and FN. These attributes were derived from the training and testing datasets and computed from the confusion matrix. Mem was considered by assessing each model's size as an entity that must be kept in memory until it is time to run. PT is largely influenced by the size of the training dataset and the ML technique; it can be defined as the amount of time needed to train and test each model. TT estimates the time required to determine if the present sample is normal or an attack. A 3-Fold cross-validation technique was applied, which uses every sample to create training and testing subsets from the corresponding dataset. We deleted two unnecessary features from the dataset, the Time and ID columns, before applying two independent feature selection methods to find the correlated and low-importance features. Figure 4 depicts the results of applying [PERSON]'s correlation and MI to the extracted balanced dataset. Table 4 lists the features removed from the extracted balanced dataset in addition to the four single-class datasets after applying the two feature selection techniques. MI represents the dependencies of the features whose values range from 0 to 1. High MI values represent important features, while low MI values are features with lower importance. The characteristics we eliminated from the dataset are the features with MI values less than 0.1. Two features from the balanced all_attacks dataset needed to be removed: Data_Sent_To_BS and dist_CH_To_BS since they had MI values less than 0.1. We also had to remove SCH_S, JOIN_R, and DATA_R from the balanced dataset retrieved for Grayhole,and the Data_Sent_To_BS, dist_CH_To_BS, SCH_S, DATA_R, and JOIN_R features needed to be removed from the Blackhole dataset. The JOIN_R, SCH_S, and DATA_R features were removed from the Flooding dataset, and Data_Sent_To_BS, dist_CH_To_BS, ADV_R, and DATA_R features were removed from the TDMA dataset during the feature selection phase before the learning process was started. We investigated the results of each of the evaluation metrics individually before starting our discussion on the simulation results for the WSS model vs. the Boosting, Bagging, and Stacking models. One of our observations was related to the model size for each considered approach. The model size is represented by how many bytes the classifier reserves in memory after the learning process is finished and once it is ready to be deployed on the sensor nodes. We noticed that the model sizes for all base classifiers in the WSS were 23, 25, 23, 22, 32, and 28 Bytes for SVC, NB, KNN, DT, RF, and LightGBM, respectively while the other three ensemble model sizes were 27, 28, and 28 Bytes for Bagging, Stacking, and Boosting, respectively. The model sizes were very similar; therefore, we did not need to include the model size with the evaluation metrics in the WSS implementation. We also excluded model size from the comparison between the proposed approach and the three ensemble techniques. Figure 5 illustrates the simulation results for the proposed approach, WSS, as well as the Boosting, Bagging, and Stacking techniques. In terms of accuracy, WSS achieved the best results considering the All_attacks, Grayhole, and Flooding datasets with accuracies of 99.3%, 98.95%, and 100%, respectively (Figure 5A).