# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion
### K Nearest Neighbor  
The supervised machine learning method k nearest neighbor (KNN) is used for classification and regression tasks. Since it is non-parametric, it does not assume anything about the distribution of the data at its core. In its most basic form, KNN predicts the class  
Figure 8: (**a**) ROC curve for TON-IOT all attacks (15 features), ANN; (**b**) ROC curve for TON-IOT DDoS attacks (15 features), ANN; (**c**) ROC curve for BOT-IOT all attacks (15 features), ANN; (**d**) ROC curve for BOT-IOT DDoS attacks (15 features), ANN.  
or value of a test point by locating the k nearest neighbors to it in the training data and using their characteristics to determine that test point's characteristics. Euclidean distance is a widely used distance metric that may be used to determine the separation between two places. KNN predicts a test point's class for classification tasks based on the majority class of the k's closest neighbors. For regression tasks, KNN predicts the value of a test point based on the average value of the k nearest neighbors. The value of k is a hyperparameter that can be chosen by the user. While a bigger value of k can result in smoother choice boundaries but may be less sensitive to local patterns in the data, a smaller value of k can result in more complex decision boundaries and may be more susceptible to noise in the data.  
\[(x,y)=\sqrt{\sum_{i=1}^{n}(x_{i}-y_{i})^{2}} \tag{4}\]  
The confusion matrix is given below for TON-IOT and BOT-IOT representing binary and multiple-class classification for each (Case 1 to Case 4) for 15 features (Table 8). It is observed that in all cases the FP and FN values are zero. Therefore, maximum accuracies will be achieved and this determines that the proposed model is robust. The subsequent ROC curves are given for BOT-IOT and TON-IOT with 15 features for multiple-class and binary classifications. When the steepness of the ROC curve reaches the top left corner then it is considered an excellent model, hence, in this case all of them are very good models (Figure 9). AUC scores provide a summary measure of the model's discriminatory power; a higher AUC indicates a more effective DDoS attack detection model. Hence, all of the models are proven effective in this case, with KNN. KNN is a significant algorithm for detecting DDoS attacks in IoT devices.  
KNN offers an intuitive approach to identifying anomalous patterns in IoT network traffic based on the similarity principle. By measuring distances between data points, KNN can classify traffic as normal or malicious, making it effective in detecting DDoS attacks by identifying deviations from normal patterns. KNN can be trained using labeled datasets, improving detection accuracy over time. Its versatility allows integration with other algorithms, enhancing overall detection performance. In summary, KNN provides an effective and interpretable approach for detecting DDoS attacks in IoT devices, enhancing security and mitigating potential disruptions caused by malicious activities.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & **Case 1 (All Attacks)** & & & **Case 2 (DDoS Attacks)** & \\ \hline True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ \hline Class 0 (Normal) & 59,925 & 0 & Class 0 (Normal) & 60,055 & 0 \\ Class 1 (Attack) & 0 & 32,284 & Class 1 (Attack) & 0 & 3945 \\  & **Case 3 (All Attacks)** & & & **Case 4 (DDoS attacks)** & \\ True/Predict & Class 0 (Normal) & Class 1 (Attack) & True/Predict & Class 0 (Normal) & Class 1 (Attack) \\ Class 0 (Normal) & 733,603 & 1 & Class 0 (Normal) & 385,326 & 0 \\ Class 1 (Attack) & 0 & 101 & Class 1 (Attack) & 0 & 95 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Confusion matrix for TON-IOT (Case 1 and Case 2), BOTIOT (Case 3 and Case 4), and KNN (15 features).