# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
## 3 Methodology
### Proposed Ensemble Machine Learning Approaches
The base classifiers were trained, tested, and evaluated using the following list of evaluation metrics: accuracy (Acc), probability of false alarm or false positive rate (P\({}_{\text{fa}}\)), probability of detection or true positive rate (P\({}_{\text{d}}\)), probability of misdetection or false negative rate (P\({}_{\text{md}}\)), and positive predictive value (PPV) in addition to processing time (PT), average prediction time per sample (TT), and model size (Mem) (Figure 3). Each evaluation metric was assigned a weight, called a score. These scores can be equal or varied according to each metric's importance in the evaluation and validation process. Higher-importance metrics are assigned higher scores. The algebraic sum of the scores was calculated for each base classifier, where that classifier achieves the best score for that metric. The best single classifier among the pool of base classifiers is the one that achieves the highest algebraic sum of scores and will be selected to detect any upcoming attacks. The concept of assigning a different score for each evaluation metric depends on the performance trade-off and baseline standardization. Several studies have considered different evaluation metrics for measuring the performance of the ML techniques used for assessing their proposed models' ability to detect cyber-attacks on WSNs; however, they did not emphasize any specific metric. We have considered the most common and widely used metrics, Acc, P\({}_{\text{d}}\), P\({}_{\text{fa}}\), P\({}_{\text{md}}\), and PPV, in addition to TT, PT, and Mem, which also matter in the context of WSNs for this reason. We considered base classifiers C = {C1, C2,..., Ci}, evaluation metrics M = {M1, M2,..., Mj}, and scores wj = {w1, w2,..., wj} for the WSS approach, where i is the index of the classifiers and j is the index of the evaluation metrics. We initially calculated the evaluation metrics for every base classifier Ci to have a matrix of M (i, j), then we determined the sum (w (i,j)) for every Ci with the best M (i, j). We supposed that the best value for every M (i, j) in terms of Acc, P\({}_{\text{d}}\), and PPV is the maximum, while in terms of P\({}_{\text{fa}}\), P\({}_{\text{md}}\), TT, PT, and Mem is the minimum. The model achieving the max (sum (w (i, j))) will be the one selected for the final detection of any upcoming traffic. The proposed WSS approach will then be implemented to distinguish the model with the greatest number of metrics that have the best values using Max (sum (w (i, j)). Our proposed approach does not need extensive processing or sophisticated hardware to be implemented compared to other approaches; therefore, we can assume it does not add any computational complexity to the selected base classifiers. This approach's effectiveness depends highly on the performance of the selected set of base classifiers, where the  
Figure 3: Workflow for the proposed approach, WSS. optimal model elected at the last stage will have the best scores in terms of the evaluation metrics used. We differentiated between high and low-importance metrics for the score value wj assigned to each of the evaluation metrics, Mj. We assumed that accuracy, probability of misdetection, processing time, and prediction time were high-importance metrics, while the probability of detection, probability of false alarm, and model size in memory were considered low-importance metrics. High-importance metrics were assigned higher score values compared to low-importance metrics; therefore, we used weights of \(\rm{w_{Acc}}=0.2\), \(\rm{w_{Pd}}=0.1\), \(\rm{w_{Pdn}}=0.1\), \(\rm{w_{Pmd}}=0.15\), \(\rm{w_{Processing\,T}}=0.2\), \(\rm{w_{Prediction\,T}}=0.15\), and \(\rm{w_{PPV}}=0.1\). Then, sum (\(\rm{w}\) (\(\rm{i},\rm{j}\))) is calculated for every model Mj, looking for Max (sum (\(\rm{w}\) (\(\rm{i},\rm{j}\))) to be the selected model with the best-weighted score summation and chosen as the promoted one to perform the detection of any incoming signal.