## 3 Materials and Methods
### Convolutional Neural Network (CNN)-Based Methodology for Intrusion Detection
_Evaluation_: Finally, the proposed model is evaluated with the test set to measure its effectiveness in detecting and classifying attacks within IoT and IIoT networks. Preprocessing includes removing malformed or inconsistent entries (1.2% of the data), label encoding categorical attributes, and normalizing numerical values to the [0, 1] range using min-max scaling. After this, the training set is used for model learning, while the testing set remains unseen during training for unbiased performance assessment. Real-time feature extraction is achieved using optimized TensorFlow Lite libraries, enabling efficient execution on edge devices (e.g., Raspberry Pi). The CNN model is trained with the Adam optimizer (learning rate = 0.001), using sparse categorical cross-entropy loss over 10 epochs with a batch size of 32. An early stopping mechanism monitors validation loss to avoid overfitting. Dropout layers after pooling and dense stages further support generalization. The model architecture, shown in Figure 4, is designed to classify 15 attack types using 63 normalized features from the DNN-EdgeIIoT dataset [7]. The architecture starts with two Conv1D layers (32 and 64 filters, kernel size 3), followed by max pooling (pool size 2), a fully connected layer (128 neurons, ReLU), and a softmax output layer for multiclass classification. The design balances accuracy and computational efficiency, consistent with prior CNN-based intrusion detection frameworks [11; 18]. Figure 3: Convolutional neural network architecture [19]. The proposed CNN-based intrusion detection system was evaluated using the DNN-Edgelliot dataset [7], a benchmark specifically designed for IoT/IIoT security research. This dataset was generated using a heterogeneous testbed comprising 42 IoT/IIoT devices (e.g., sensors, actuators, edge nodes) and 14 attack scenarios emulating real-world threats (e.g., DDoS, SQL injection, ransomware). Each sample represents a bidirectional traffic flow between devices and edge/cloud nodes, captured over 30 days of continuous operation. * _Unique Attributes of DNN-Edgello_T:
* _Protocol Diversity:_ Includes lightweight protocols (MQTT, CoAP) and industrial standards (Modbus, OPC UA). * _Feature Granularity:_ A total of 63 features per flow, spanning network-layer metrics (e.g., packet inter-arrival times), protocol-specific attributes (e.g., MQTT topic flags), and system-level telemetry (CPU/memory usage). * _Temporal Context_: Flows are timestamped to enable time series analysis, though our CNN model processes samples independently to prioritize real-time detection. * Preprocessing Specific to This Work:
* _Outlier Removal:_ Flows with malformed headers or implausible feature values (e.g., negative packet counts) were excluded (1.2% of raw data). * _Normalization:_ Min-max scaling was applied to mitigate bias from features with large dynamic ranges (e.g., byte counts vs. protocol flags). This dataset's realism and granularity enable robust evaluation of spatial attack patterns, a key focus of our CNN architecture. The proposed convolutional neural network (CNN) architecture is designed for multi-class intrusion detection in IoT/IIoT networks, leveraging spatial feature extraction and hierarchical learning to classify 15 attack types. The model is trained and evaluated on the DNN-Edgelliot dataset, comprising 2,219,201 traffic flows, each represented by 63 normalized features scaled to [0, 1] using min-max normalization to ensure balanced contributions during training. The dataset is partitioned into 80% training (1,775,361 samples) and 20% testing (443,840 samples) via stratified sampling to preserve class distribution. The architecture begins with a one-dimensional sequential input layer of shape (63 \(\times\) 1), representing the features of each network traffic flow.