# Intrusion Detection and Prevention in CoAP Wireless Sensor Networks Using Anomaly Detection
## 5 Conclusions and Future Work  
In this article we have proposed an IDS framework for the detection and prevention of attacks in Internet-integrated CoAP networks, and in the context of this framework we have evaluated the effectiveness of employing anomaly-based intrusion detection in preventing DoS attacks against such communication environments. From a practical perspective of implementing an IDS system in Internet-integrated CoAP sensing applications, it is crucial to prevent the most intrusions as possible, while at the same time assuring a low rate of false negatives, even if at a cost of increasing false positives. This must be taken into account when searching for the maximum accuracy, and from our results we may also consider that, in the case that the security manager is interested and able to identify particular attacks, the multi-class problem approach is appropriate, since results show that a linear Kernel or a polynomial Kernel have the best results regarding accuracy. On the other hand, the binary class approach is a good fit to capture the largest possible amount of anomalous (ERRONEOUS) behaviors. In general, we consider that the results obtained from our experimental evaluation show that anomaly-based intrusion detection is viable to protect 6 LoWPAN and CoAP communication environments from internal and Internet-originated attacks against the security and stability of the devices.  
Although only SVM was used as a classier algorithm, the proposed system can be extended to include additional algorithms, such as K-NN, Neural Networks or Random Forests. Thus, the implementation and evaluation of such alternative algorithms in the context of the proposed framework is part of our plans to conduct further research work in this area. The inclusion of other algorithms will also provide an opportunity to evaluate the scalability of the proposed system using machine learning models that more demanding in terms of computational resources such as delay, storage and computational effort. In addition, and from a more practical implementation standpoint, another aspect that we plan to target is related to how the features are currently calculated. The computational efficiency in this step can certainly be improved by developing an application for calculating features directly from the captured data. Additional intrusions will also be considered in future developments, particularly regarding attacks focused on subverting the usage rules and the semantics of the CoAP protocol, either by internal or external attackers.  
[PERSON], [PERSON] and [PERSON] conceived and designed the experiments, analyzed the data and have written the article. The experiments have been performed by [PERSON].  
**Conflicts of Interest:** The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Scoring Metric: Accuracy** & & & & & & & \\ \hline C & **Kernel** & **Iterations** &
\begin{tabular}{c} **Degree (Valid on** \\ **Polynomial Only**) \\ \end{tabular} & **Gamma** & **Coef** & **Decision Function Shape** & **Accuracy** \\ \hline
0.20000 & \({}^{\prime}\)linear\({}^{\prime}\) & 30 & 1 & 0.100000 & 0.000000 & \({}^{\prime}\)ov\({}^{\prime}\) & 0.858325 \\
0.20000 & \({}^{\prime}\)rib\({}^{\prime}\) & 30 & 1 & 0.100000 & 0.000000 & \({}^{\prime}\)ov\({}^{\prime}\) & 0.830403 \\
0.915790 & \({}^{\prime}\)poly\({}^{\prime}\) & 30 & 3 & 0.621053 & 0.000000 & \({}^{\prime}\)ov\({}^{\prime}\) & 0.810238 \\
0.20000 & \({}^{\prime}\)sigmoid\({}^{\prime}\) & 30 & 1 & 0.9052632 & 0.315710 & \({}^{\prime}\)ov\({}^{\prime}\) & 0.927094 \\ \hline \hline \end{tabular}
\end{table}
Table 3: SVM Parameters obtained using accuracy as the scoring metric (previously processed with dual-class LDA).