## 3 Methodology
### Detection Algorithm
The CS component generates an initial population of nests (potential solutions) and iteratively improves them using Levy flights. New solutions replace worse ones, and the best solutions are continuously updated. This process repeats until the maximum number of iterations is reached, ensuring that the algorithm converges to an optimal solution. ## 4 Proposed Model

The study designed an anomaly-based detection scheme to mitigate the effects of MitM attacks and protect users and DNSs. An IoT dataset that contains malicious and regular traffic was used. The dataset was preprocessed to ensure it did not contain missing values, NAN values, and class imbalance, which can impact the scheme's performance. The dataset was split into 70% training and 30% testing. The hyperparameters were optimized to build the proposed model. The Decision Tree classifier was used to detect the anomalies within the dataset. Since anomaly-based detection models suffer from high false positives, cuckoo search optimization improves exploration efficiency (allowing a global search in the parameter space) and exploitation (finding the best solution). The balance improves the algorithm's efficiency in searching for the optimal threshold to minimize false positives without over-fitting the model. Our study advances existing anomaly detection schemes through several key innovations tailored for resource-constrained environments. Prior work, such as CSA-optimized Artificial Neural Networks [25], has demonstrated its effectiveness. Our integration of CSA with Decision Tree classifiers provides a lightweight that is accurate. This is achieved by leveraging the CSA not just for general optimization but specifically for feature selection to identify a minimal subset of highly informative features crucial for detecting MitM attacks in DNS traffic. The focus on feature reduction translates to a less complex and faster Decision Tree model, which is a critical advantage in resource-limited IoT or edge deployments where computational efficiency is paramount. Furthermore, our approach integrates a novel application of Statistical Process Control (SPC) with the Expected Weighted Moving Average (EWMA) as the CSA's objective function [26]. Unlike conventional objective functions that primarily focus on maximizing classification accuracy, our SPC-EWMA method improves the feature selection process by prioritizing feature subsets that yield high detection rates, demonstrate stability, and minimize false positives. The emphasis on statistical control enhances the robustness and reliability of the detection mechanism, providing a more practical solution for real-world deployment, where consistent performance and low false alarm rates are essential. In contrast to existing methods that face challenges related to scalability and adaptability in response to the dynamic nature of network threats [27], the inherent efficiency of the Decision Tree, coupled with the CSA's ability to adapt its feature selection based on the specific characteristics of the DNS traffic and evolving MitM attack patterns, ensures a more responsive and scalable solution. The detailed performance metrics, particularly the demonstrated improvements in detection accuracy and the reduction in false positive rates, further underscore the compelling advancement of the lightweight CSA-Decision Tree approach over prior work, providing a more practical and efficient strategy for securing DNS against MitM attacks in resource-sensitive environments. Figure 2 illustrates the proposed model's process. The algorithm starts with a root node that represents the entire dataset, preprocesses the data, and splits the dataset into subsets based on the attribute values test. This process is repeated recursively for each derived subset; thus, there are decision nodes where the data are split. The CSA is then used to build and train the model, utilizing a Decision Tree that incorporates a progress bar that dynamically indicates the classification process, distinguishing between normal and anomalous activities.