# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
## 3 Methodology
### Feature Selection  
Nineteen features comprised the associated dataset, including class type (Table 3). Any detection model's effectiveness depends on the choice of pertinent features in addition to the selected learning algorithm [19]. Appropriate feature selection criteria are necessary to extract an optimal subset of features, decreasing the dataset's dimensionality and increasing learning process speed [29].  
We applied two independent feature selection techniques: [PERSON]'s correlation coefficient and Mutual Information (MI). The authors of [30] investigated the [PERSON]'s correlation coefficient and MI approaches, establishing that these two approaches together can determine the optimal feature subset and reduce dataset dimensionality. [PERSON]'s correlation coefficient and MI techniques measure the correlation between attributes to generate optimal feature subsets. [PERSON]'s correlation is one of the most commonly used measures with ordinal or interval data; however, it works best with data that has at least one ordinal variable.  
_MI_ is a statistical independence measure that estimates the dependence among attributes. This measure has two essential characteristics: it measures any kind of relationship, or dependencies, between random variables, and it is invariant under invertible and differentiable feature space transformations, such as translations and rotations, as well as any transformation that preserves the initial order of the feature vector's component elements [31]. _MI_ can be calculated according to the following equation [30] to determine the amount of reduced uncertainty in one attribute \(X\) if the other attribute \(B\) is given.  
\begin{table}
\begin{tabular}{l l} \hline \hline \multicolumn{1}{c}{**Feature**} & \multicolumn{1}{c}{**Description**} \\ \hline Time & Simulation time at the moment for the sensor node \\ \hline ID & Unique number to identify the node during the simulation period \\ \hline Is\_CH & Flag bit to determine whether the node is CH or normal \\ \hline Who CH & Unique number to identify the CH of the current round \\ \hline Dist\_To\_CH & The current round’s distance between the node and its CH \\ \hline ADV\_S & Number of advertised broadcast messages sent to the nodes by the CH \\ \hline ADV\_R & Number of advertised broadcast messages received from the CHs by nodes \\ \hline JOIN\_S & Number of join request messages sent by the nodes to the CH \\ \hline JOIN\_R & Number of join request messages sent from the nodes by the CH \\ \hline DATA\_S & Number of data packets sent to the CH from the node \\ \hline DATA\_R & Number of data packets received from the CH from the node \\ \hline Data\_Sent\_To\_BS & Number of data packets sent toward the BS \\ \hline dist\_CH\_To\_BS & Distance between the CH and the BS \\ \hline SCH\_S & Number of advertised TDMA schedule broadcast messages sent to the nodes \\ \hline SCH\_R & Number of advertised TDMA scheduled messages received from the CHs \\ \hline Rank & Order of the node in the TDMA schedule \\ \hline send\_code & A special code for data exchange \\ \hline Consumed Energy & During the previous round, the estimated energy used \\ \hline Attack type & Grayhole, Blackhole, Flooding, Scheduling \\ \hline \hline \end{tabular}
\end{table}
Table 3: Key Features of Dataset [13].  
\[MI(X,Y)=\sum_{i=1}^{r}\sum_{j=1}^{t}P(Xi,Yi)*\log\left(\frac{P(Xi,Yi)}{P(Xi)*P(Yj)}\right)\]  
_MI_, one of the filter techniques, is computationally less expensive when compared to wrapper and embedded techniques, making it more appropriate in the context of WSNs. _MI_ evaluates the relevance between each feature and class label; therefore, the feature with a high _MI_ value means that this feature has high predictive power.