## 4 The Proposed MRMR-SATIDS System
### Applying SATIDS to an IoT system  
After testing, the SATIDS is applied to a large-scale IoT with mobile nodes. To simulate this environment, 250 sensor nodes are distributed randomly at a 300 m \(\times\) 300 m region divided into eight clusters (seventh level hierarchy) as shown in Figure 8. BS is located at (0,0). The initial energy of each node is set to 0.2 J and its threshold energy is 50 mJ. Each node uses 50 nJ/bit for the transmission and reception process. Energy dissipation is 100 pJ/bit and the data packet size is set to 4000 bits. Attacked nodes are randomly distributed between the clusters. Algorithm 2 presents SATIDS's procedures to secure an IoT system. AFSA with a modified fitness function is used to optimize a clustering approach based on EHRT. As compared to selecting a single cluster behavior, the fitness function has been adjusted so that optimal CHs for each cluster are selected. Cluster formation and the optimal CHs election are the two phases of the EHRT technique (described in Section 3.5). Algorithm 2 summarizes the application of the proposed MRMR-SATIDS to an IoT network. ``` OUTPUT Detecting the source of the anomaly traffic and determine the attack type INPUT Randomly distributed IoT nodes CHs are selected according to EHRT algorithm Each CH aggregates traffic from its neighboring nodes CHs uses the proposed SATIDS to detect any anomaly traffic from neighboring nodes Determine the ID of this node and send its ID to the BS BS saves the ID of attacked nodes in a blacklist and shares it with other nodes FOR the received traffic from CHs BS uses the proposed SATIDS to scan received traffic from all CHs IF any attacked CH is detected BS declares its ID and the election process is repeated in that cluster to elect another CH END IF END FOR

Figure 8: Eight cluster IoT network. ## 5 Experimental Evaluation

### Performance Metrics

Using MATLAB on an Intel Core-i7 processor with 8 GB RAM on the Windows 10 platform, the proposed SATIDS system was simulated, trained, and tested. The performance of the proposed system was analyzed using the confusion matrix, which is a table structure commonly used for multi-class assessment. It consists of four main values determined for each class [17]:

* True Positive (TP): The number of normal observations in dataset traffic classified correctly as normal by the technique. * True Negative (TN): The number of intrusion observations in the IoT network properly classified by the algorithm as intrusions. * False Positive (FP): The number of normal IoT traffic observations wrongly identified by the algorithm as abnormal. * False Negative (FN): The number of abnormal observations wrongly identified by the algorithm in IoT network traffic as normal observations. To prove the efficiency of the proposed system, the number of LSTM layers and hidden layers in each LSTM layer were varied and the following performance metrics of detecting different types of attack were recorded using the whole features and compared with using MRMR-FS technique. * Accuracy: The ratio of correctly calculated observations by the network to the total number of samples present in the determined dataset. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+ \text{FN}}\] (12)
* Precision: The number of correctly detected observations, divided by the total number of observations that the model identifies as an attack. \[\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}}\] (13)
* Detection rate (DR): The ratio of the correct observations observed by the model to the total number of tests. \[\text{DR}=\frac{\text{TP}}{\text{TP}+\text{FN}}\] (14)
* F1-score: Evaluating the test accuracy by calculating the average weight of the detection rate. \[\text{F1}-\text{score}=2*\frac{\text{Precision}*\text{Recall}}{\text{ Precision}+\text{Recall}}\] (15)

### Results and Discussion

#### 5.2.1 ToN-IoT Dataset

Figure 9 presents the performance of the proposed SATIDS system with and without using MRMR-FS when detecting normal/anomaly traffic.