# Explainable Lightweight Block Attention Module Framework for Network-Based IoT Attack Detection
## 3 Proposed Methodology
### Intrusion Detection Using DCBAM Architecture  
This section provides a comprehensive overview of the implementation process for an attack detection and classification system utilizing DenseNet201, a deep learning model with 201 layers. The framework leverages the unique characteristics of DenseNet201, which establishes direct connections between layers possessing the same feature map size. This design enables the reuse of extracted features across layers, resulting in a more precise and compact model. The DenseNet201 model is structured with four dense blocks interconnected by three transition layers responsible for downsampling. These blocks and layers are crucial for feature extraction. The final deep layers in DenseNet201 incorporate the information from all preceding layers, as denoted by Equation (4). This equation represents the composite function involving batch normalization, ReLu activation, and a 3 \(\times\) 3 convolution layer. Furthermore, specific convolution layers with varying filter sizes and kernel shapes are appended after the fourth dense block to capture more detailed information. The features extracted from previous aggregated layers are subsequently passed to the classification head of the model. The classification layer comprises two dense layers, a batch normalization layer, and a convolution layer, with a Softmax. These components play a vital role in the final classification of attacks based on the extracted features. In summary, the implementation of the attack detection and classification system utilizes DenseNet201 as the underlying model, incorporating direct connections, dense blocks, transition layers, and specific convolution layers. The system effectively captures and reuses features, leading to a more precise and compact model for accurate classification of attacks. \[X^{l}=H_{l}\Big{(}\Big{[}X^{0},X^{1},\ldots\ldots X^{l-1}\Big{]}\Big{)} \tag{5}\]  
To extract important features while removing redundant information, the attention mechanism is employed. The convolutional block attention module (CBAM) proposed by [PERSON] et al. [4] effectively extracts meaningful features in the channel and spatial dimensions, respectively, allowing for adaptive feature refinement. The module is shown in Figure 3. Using deep learning-based techniques, such as DenseNet, for cyberattack detection has become increasingly popular due to several advantages over other available techniques. Here are some reasons why DenseNet and similar deep learning approaches are favored [44; 45; 46; 47; 48; 49; 50; 51; 52]:  
* Feature learning: Deep learning models like DenseNet automatically learn relevant features from the data, making them highly effective at capturing intricate patterns in complex data like network traffic or system logs. This adaptability is crucial in detecting new and evolving cyberattacks. * End-to-end learning: Deep learning models are designed to learn from raw input data to make predictions directly. This end-to-end learning can help simplify the detection pipeline, reducing the need for manual feature engineering and potentially improving accuracy. * Complex relationships: Cyberattacks can exhibit intricate relationships across multiple dimensions of data. Traditional techniques may struggle to capture these relationships effectively, whereas deep learning models can handle complex, nonlinear interactions in the data. * Scalability: Deep learning models can handle large-scale datasets, making them suitable for real-time or near-real-time detection in high-speed network environments, which is essential for modern cybersecurity needs. * Adaptability: Deep learning models can adapt to new attack patterns with minimal human intervention. This adaptability is crucial as cyberattacks constantly evolve, making it challenging to maintain rule-based or signature-based detection systems. * Representation learning: Deep learning models can learn useful representations of the data, which can aid in identifying both known and novel attack types.