## 3 Methodology
### Detection Algorithm
CSA-ANN is significantly more resource-intensive than CSA-DT due to the inherent demands of ANNs, especially with large feature spaces and without heavy optimization. While CSA-DT showed slightly higher resource usage in the study,

Figure 10: Proposed model detection rate progress. the specific features and search space were unclear, suggesting the potential for resource intensiveness if not adequately controlled. Table 5 illustrates that the proposed model, leveraging CSA for efficient feature selection and a Decision Tree for rapid classification, demonstrates superior resource efficiency compared to the LOF, SVM, CSA-ANN, and CSA-DT models. As shown in the resource consumption analysis, our proposed model exhibits the lowest CPU usage, memory usage, and disk I/O, coupled with the fastest execution time, making it ideal for resource-constrained environments. This optimizes high detection performance with minimal overhead, underscoring its practical advantage for mitigating MitM attacks in DNS. In Figure 12, we have included the AUC-ROC score of 0.91, indicating that the proposed scheme, the CSA-optimized Decision Tree model, exhibits the ability to differentiate between the two classes, signifying a high actual positive rate with a low false positive rate. This good performance highlights that the model is very effective at correctly identifying instances of one class versus the other, translating to accurate anomaly detection with mini

Figure 11: Resources utilized. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **CPU Usage (\%)** & **Memory (MB)** & **Disk I/O (Bytes)** & **Execution Time (s)** \\ \hline LOF & 14.0 & 320 & 110,000 & 3.5 \\ \hline SVM & 17.5 & 480 & 190,000 & 4.6 \\ \hline Proposed Model & 12.5 & 290 & 100,000 & 3.0 \\ \hline CSA-ANN & 25 & 650 & 250,000 & 7.8 \\ \hline CSA-DT & 15.6 & 350 & 125,000 & 4.5 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance Resource Consumption. mal false alarms. The high AUC highlights the potential of our approach in distinguishing between normal and malicious DNS traffic, showcasing the benefits of addressing class imbalance and employing intelligent feature selection and/or hyperparameter tuning, as indicated in Figure 11.

## 7 Discussion

The lightweight CSA-optimized Decision Tree was evaluated in different datasets, which highlights the effectiveness of this hybrid approach for DNS MitM attack detection, especially in resource-constrained IoT environments. The CSA's efficient feature selection enables the Decision Tree to accurately classify network traffic with low computational overhead, outperforming traditional methods such as SVM, LOF, and the more resource-intensive CSA-ANN and CSA-DT methods, as using CSA is inherently resource-intensive. Studies that used CSA lack clarity on the number of batch sizes allowed for the CSA search space. This balance between high detection accuracy and low resource consumption highlights the potential of metaheuristic optimization in enhancing machine learning-based intrusion detection for complex network environments. These findings have significant implications for securing IoT and other resource-limited networks against sophisticated DNS-based attacks. Our lightweight and effective scheme provides a practical alternative to heavier, less adaptable methods. CSA's success in feature optimization presents a valuable strategy for handling high-dimensional network data, making it possible to develop more efficient and deployable security solutions. Table 6 presents a comprehensive overview of existing studies focusing on their contributions, approaches, and targeted attacks. While prior works like CSA-ANN and DT-CSA demonstrated notable advancements, they often experience challenges such as resource intensity and reduced efficacy in high-dimensional datasets. In comparison, our proposed lightweight model combines efficiency and precision to address DNS MitM attacks with minimal computational overhead.