## 3 Proposed Methodology  
The main objective in this paper is to enhance the detection of anomalies in DoS with the lowest possible power consumption. First, we improve network performance through the use of the cluster protocol. Next, we combine lightweight feature selection with machine learning technologies to minimize DoS detection power cost and raise detection accuracy. Therefore, the proposal environment consists of three processes. The first is to aggregate WSN nodes into multiple clusters, each cluster having a CH in the WSN nodes environment. The LEACH standard protocol is updated with additional parameters to improve its performance, and the protocol generated from the modifications denoted CH_Rotations. In the following process, feature selection and machine learning testing approaches are used to analyze traffic in each CH node to distinguish between normal and abnormal incoming packets. The feature selection technique is used to detect the most important data features and also to reduce mathematical operations during each packet inspection at each WSN CH node. In the last process, CH makes a decision based on the results of the second process. The structure of the general proposal model is illustrated in Figure 2, and each of the processes will be discussed in the following subsections.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline
**Category** & **Reference** & **Technique** & **Dataset** & **Accuracy** & **Goals** & **Limitation** \\ \hline \multirow{3}{*}{Statistical-based} & \multirow{3}{*}{[15]} & Game theory and an autoregressive model & Live format simulator (Matlab) & \multirow{3}{*}{81\%} & Reduce detection power consumption in the intrusion detection process & \multirow{3}{*}{Accuracy is low detection process} \\  & & & & & & \\ \hline \multirow{3}{*}{MLP} & \multirow{3}{*}{[23]} & Sequential feature selection with MLP algorithm & \multirow{3}{*}{NSL-KDD} & \multirow{3}{*}{99.7\%} & Reduce DDoS attacks & The proposal is not considered a WSN restriction \\ \hline \multirow{3}{*}{Statistical-based} & \multirow{3}{*}{[20]} & K-medoid clustering technique & Live format simulator (NS-2) & \multirow{3}{*}{-} & Attacks detection & Accuracy unknown \\ \hline \multirow{3}{*}{Deep Learning} & \multirow{3}{*}{[58]} & Deep Neural Network & \multirow{3}{*}{WSN-DS} & \multirow{3}{*}{99\%} & Improve intrusion detection in IoT networks & The proposal’s \\  & & & & & IoT networks & it unsuitable for WSNs \\ \hline \multirow{3}{*}{Deep Learning} & \multirow{3}{*}{[13]} & Deep Neural & Live format & \multirow{3}{*}{90\%} & Improve DDoS detection in WSNs & No energy consumption tested on WSNs \\  & & Learning-based Defense Mechanism & \multirow{3}{*}{[59]} & Live format simulator & \multirow{3}{*}{96–100\%} & Improve DoS detection in WSNs & Data features are few and do not cover the majority of common attacks \\ \cline{1-1} \cline{4-4} \multirow{3}{*}{[58]} & \multirow{3}{*}{[58]} & Binary Logistic Regression (BLR) & \multirow{3}{*}{WSN-DS} & \multirow{3}{*}{99\%} & Improve intrusion detection in WSNs & The proposal’s \\  & & & & & & \\ \cline{1-1} \cline{4-4} \multirow{3}{*}{Deep Learning} & \multirow{3}{*}{[58]} & Deep Neural Network & \multirow{3}{*}{WSN-DS} & \multirow{3}{*}{99\%} & Improve detection in IoT networks & The proposal’s \\  & & & & & IoT networks & it unsuitable for WSNs \\ \hline \end{tabular}
\end{table}
Table 2: Taxonomy of different machine learning algorithms in detection attacks.