## 3 Methodology
### Detection Algorithm
Its innovative feature optimization technique through CSA ensures robust anomaly detection, even in resource-constrained IoT environments. Furthermore, leveraging a streamlined hybrid approach, our model outperforms traditional

Figure 12: ROC curve of CSA Decision Tree. methods in detecting accuracy and adaptability, addressing a research gap in the field. These improvements demonstrate the potential of our model as a reliable and scalable solution for enhancing cybersecurity in complex networks. ## 8 Conclusions

Domain Name Servers are crucial systems that must be protected against MitM attacks, such as eavesdropping and interception, which can lead to severe consequences if not addressed. The study developed a lightweight anomaly-based model to counter these attacks on secure DNSs. Two datasets were used to evaluate the proposed model. The results show that it outperformed the traditional SVM, LOF, CSA-ANN, and CSA-DT models, achieving an accuracy of 99.6%. These findings indicate that the model can potentially improve cybersecurity measures and harden DNS. Its adaptability proposes that it could be extended to other domains where MitM attacks are a challenge. The CSA-DT model, while innovative and leveraging CSA techniques, also performed well but was less effective compared to the proposed model. It shows good precision and recall, but its effectiveness is slightly lower due to challenges in handling dynamic and high-dimensional data. Future research could involve a broader comparison with contemporary machine learning and optimization techniques. Methods such as deep learning algorithms, ensemble learning approaches, and advanced evolutionary algorithms could be considered to validate and benchmark the performance of



## References

* _[PERSON] et al. (2022)_ [PERSON]; [PERSON] Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography. _EAI Endorsed Trans. Pervasive Health Technol._**2022**, \(8\), e3. [CrossRef]
* _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON]; [PERSON] APT Attack Detection Scheme Based on CK Sketch and DNS Traffic. _Sensors_**2023**, _23_, 2217. [CrossRef] [PubMedMed]
* _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] A Review on the Security of IoT Networks: From Network Layer's Perspective. _IEEE Access_**2023**, _11_, 71073-71087. [CrossRef]
* _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] Real-time bot infection detection system using DNS fingerprinting and machine-learning. _Comput. Netw._**2023**, _228_, 109725. [CrossRef]
* _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] A novel bi-anomaly-based intrusion detection system approach for industry 4.0. _Future Gener. Comput. Syst._**2023**, _145_, 267-283. [CrossRef]
* _[PERSON] et al. (2024)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Unveiling Vulnerabilities of Web Attacks Considering Man in the Middle Attack and Session Hijacking. _IEEE Access_**2024**, _12_, 6365-6375. [CrossRef]
* _[PERSON] et al. (2022)_ [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Intrusion detection in networks using cuckoo search optimization. _Soft Comput._**2022**, _26_, 10651-10663. [CrossRef]
* _[PERSON] et al. (2020)_ [PERSON]; [PERSON]; [PERSON]; [PERSON] A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics. _IEEE Commun. Surv. Tutov._**2020**, _22_, 1942-1976. [CrossRef]
* _[PERSON] et al. (2024)_ [PERSON]; [PERSON]; [PERSON] Anomaly Detection in Cybersecurity with Graph-Based Approaches. _Int. J. Sci. Res. Eng. Manag._**2024**, \(8\), 1-5. [CrossRef]
* _[PERSON] et al. (2023)_ [PERSON]; [PERSON]; [PERSON]; [PERSON] Detecting and classifying man-in-the-middle attacks in the private area network of smart grids. _Sustain. Energy Grids Netw._**2023**, _36_, 101167. [CrossRef]
* _[PERSON] et al. (2019)_ [PERSON]; [PERSON]; [PERSON] Intrusion Detection Systems: A Cross-Domain Overview. _IEEE Commun. Surv. Tutov._**2019**, _21_, 3639-3681.