## 4 The Proposed MRMR-SATIDS System
### Applying SATIDS to an IoT system
As seen in Figure 9, SATIDS has its highest performance when using MRMR-FS, two LSTM layers and 500 hidden layers: 97.5% accuracy and 98.05% F1-score. In the case of detecting a backdoor attack, as shown in Figure 10, the system has almost the highest performance when using MRMR-FS, two LSTM layers and 500 hidden layers: 97% precision and 97.28% F1-score. The detection rate values are almost equal in all cases. Figure 11 and 12 represent the performance of the proposed SATIDS system in detecting DOS and ransomware attacks, respectively. As shown, the network has its highest performance when using three LSTM layers and 500 hidden layers when using the MRMR-FS technique. The performance of the proposed SATIDS system in detecting DDOS, injection, and scanning attacks, is shown in Figures 13-15, respectively. As seen in Figures 13-15, the network also has its highest performance when using three LSTM layers and 500 hidden layers without using the FS technique. Figure 10: Detecting a backdoor attack. Figure 9: Performance comparison of the proposed system using ToN-IoT dataset. Figure 11: Detecting a DOS attack. Figure 12: Detecting a ransomware attack. Figure 8:0 Detecting a DDOS attack. The proposed SATIDS network achieves its highest performance when detecting password attack when using two LSTM layers and 500 hidden layers without using the FS technique as shown in Figure 8:1 SATIDS has its highest performance in detecting XSS attack when using three LSTM layers 400 hidden layers as shown in Figure 8:2

#### 5.2.2 InSDN Dataset

Figures 18-23 show the performance metrics of SATIDS system when using the InSDN dataset for classifying the type of received traffic. The system has its highest performance when using two LSTM layers and 500 hidden layers with MRMR-FS for detecting normal/anomaly traffic, DDOS attack, and probe attack as in Figures 18-20, respectively. Figure 8:3 Detecting an injection attack. Figure 8:4 Detecting a scanning attack. Figure 8:5 Detecting a password attack. Figure 8:6 Detecting an XSS attack. Figure 8:7 Performance comparison of the proposed system using the InSDN dataset. Figure 8:8 Detecting a DOS attack. Figure 8:9 Detecting a DDOS attack. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+ \text{FN}}\]0 Detecting a probe attack. ### Implementing the Proposed SATIDS System in an IoT System

The MRMR-SATIDS algorithm is implemented in an IoT that contains 250 (225 normal nodes + 25 attacked nods) randomly distributed nodes. The region is divided into eight clusters (seventh level hierarchy). To conserve power, the routing protocol is used. By applying both the MRMR-SATIDS trained algorithm and the EHRT routing protocol, the IoT network saves the device's power and data during the transmission process. Figure 24 depicts the alert messages that the CHs generate when an attacker node is detected. These messages contain the node ID and the cluster number. BS saves the node IDs in a blacklist and declares it to other nodes. Figure 25 represents the network lifetime after 400 rounds. The red curve represents the network lifetime without applying the MRMR-SATIDS security technique, while the green curve represents the network lifetime when applying the MRMR-SATIDS security technique. As shown in Figure 25, the difference between the two curves as the security algorithm prevents attack nodes from being CHs. Despite of the decrease of network lifetime by 5.33% when using our proposed security system, the system security increased. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**TechniqueParameter** & **Normal** & **Backdoor** & **DDOS** & **DOS** & **Injection** & **Ransomware** & **XSS** \\ \hline MRMR-SATIDS & 98.1 & 99.8 & 91.3 & 96.9 & 92.8 & 98.1 & 92.7 \\ \hline Random Forest (RF) [28] & 100 & 99.98 & 90.40 & 91.97 & 93.53 & 99.4 & 85.47 \\ \hline Naive Bayes (NB) [28] & 100 & 99.22 & 26.8 & 91.7 & 92.96 & 79.98 & 19.02 \\ \hline GRAD-Transform [28] & 100 & 100 & 91 & 99 & 90 & 98 & 93 \\ \hline \hline \end{tabular}
\end{table}