## 3 Materials and Methods
### Convolutional Neural Network (CNN)-Based Methodology for Intrusion Detection
To balance the extraction of both low-level and high-level features while considering the computational constraints typical of IoT and IIoT environments, two Conv1D layers are employed as the core of  
Figure 4: General architecture of the proposed CNN-based intrusion detection method. the network. The first convolutional layer, consisting of 32 filters with a kernel size of 3 and a stride of 1, applies ReLU activation and focuses on identifying short-range spatial patterns, such as correlations between packet rate and connection duration. This kernel size was specifically chosen to capture local dependencies while maintaining computational efficiency. The second convolutional layer uses 64 filters with the same kernel size (3) to detect more complex and abstract features, such as DDoS attack signatures. This two-layer design is inspired by previous studies on network traffic processing, which have shown that two convolutional layers are sufficient for effectively learning spatio-temporal patterns in one-dimensional data. Initial experimentation with larger kernels (e.g., size 5) did not yield meaningful improvements in detection accuracy but introduced unnecessary computational overhead, reinforcing the choice of a compact and efficient architecture. The output of the \(l\)-th convolutional layer for the \(j\)-th feature map is computed by Equation (1):  
\[y_{j}^{l}=\sigma(\sum_{i=1}^{N_{l-1}}conv1D(W_{i,j}^{l},X_{i}^{l-1})+b_{j}^{l} \tag{1}\]  
In Equation (1), \(X_{i}^{l-1}\) denotes the \(i\)-th feature in layer \(l-1\), while \(y_{j}^{l}\) denotes the \(j\)-th feature vector in layer l. The term \(W_{i,j}^{l}\) refers to the convolution kernel. \(N_{l-1}\) indicates the number of feature vectors in layer \(l-1\). The symbol \(b\) refers to the bias, while \(\sigma\) denotes the ReLU activation function, which helps to prevent overfitting. Its mathematical formulation is outlined in Equation (2), where x represents the neuron's input. \[\sigma(x)= \begin{cases}0,x\leq 0\\ x,x>0\end{cases}  \tag{2}\]  
Following each convolution, max pooling layers with a pool size and stride of 2 are applied to reduce the spatial dimensions by half. This downsampling process preserves the most critical features while significantly decreasing the number of parameters and computational load. By striking a balance between information retention and model efficiency, these max pooling layers help the network to maintain its ability to detect essential patterns in the data while remaining suitable for resource-constrained environments such as IoT and IIoT systems. The pooling operation is defined by Equation (3):  
\[p_{i}^{a}=max(p_{i}^{a^{\prime}}:a\leq a^{\prime}<a+s) \tag{3}\]  
In Equation (3), \(a^{\prime}\) and \(p_{i}^{a^{\prime}}\) represent the neurons in the \(i\)-th feature vector prior to the max pooling operation, while \(a\) and \(p_{i}^{a}\) represent the neurons in the \(i\)-th feature map following the max pooling operation. The extracted features are then mapped to class probabilities through a fully connected layer (128 neurons, ReLU activation), culminating in a softmax output layer that generates a probability distribution across 15 attack classes. Trained using the Adam optimizer (\(\alpha\) = 0.001, \(\beta_{1}\) = 0.9, \(\beta_{2}\) = 0.999) with sparse categorical cross-entropy loss, the model processes data in batches of 32 over 10 epochs, with early stopping to prevent overfitting. Key advantages include dimensionality reduction (75% fewer parameters via pooling), generalization (ReLU and pooling mitigate overfitting), and efficiency (lightweight design compatible with edge devices). This architecture balances spatial feature extraction, computational efficiency, and multiclass accuracy, addressing the unique security challenges of IoT/IIoT networks. The parameter values set in the model are presented in Table 4.