## 3 Methodology
### Detection Algorithm  
Algorithm 1 illustrates the detection scheme that processes input from a dataset. The algorithm consists of two main functions: detect and preprocess. The algorithm receives input data from a dataset. The preprocess function is called to prepare the input data. The detect function iterates through each data point in the pre-processed data, and for each data point, it compares the value to a specified threshold. If a data point exceeds the threshold, the algorithm appends true to the detection results; otherwise, it appends false. The algorithm returns a list of detection results, indicating which data points met the threshold criteria. The threshold in our detection algorithm is derived using the CSA, which optimizes the threshold by evaluating various candidate values based on their detection accuracy and resource efficiency. Through iterative improvements and replacements, CSA identifies the optimal threshold that balances high detection accuracy with minimal false positives and false negatives. This ensures the threshold is well suited for real-time anomaly detection in the IoTD20 dataset. ```
1 def detect (input_data, threshold):
2# Preprocess the input data
3 preprocessed_data = preprocess(input_data)
4 detection_results = [ ]
5
6# Iterate through each data point in the preprocessed data
7 for data_point in preprocessed_data:
8 if data_point > threshold:
9 detection_results.append (True)
10 else:
11 detection_results.append (False)
12
13 return detection_results
14
15 def preprocess (input_data):
16# Add actual preprocessing steps here if needed
17 return input_dataAlgorithm 2 describes the CSA, where a cuckoo bird lays its eggs in randomly chosen nests. The fitness of each nest is evaluated, and if the fitness of the new solution Fj is better than the current solution, it is replaced with the best solution [7]. This process will be repeated until the set number of iterations is reached. The algorithm starts by defining an objective function and generating an initial population of host nests. It then iterates, using Levy flights to update cuckoo positions and evaluate their fitness. Unfit solutions are abandoned and replaced, while the best solutions are continuously updated. This algorithm is particularly effective for solving complex optimization problems due to its ability to optimize exploration (searching new areas) and exploitation (refining known good solutions). It is also suitable for detecting MitM attacks because it can efficiently search for anomalies in network traffic patterns, which are indicative of such attacks. The CSA is suitable for this study due to its ability to explore and exploit the search space effectively, making it ideal for detecting anomalies in DNS traffic, which are often subtle and difficult to detect. Combining it with the Decision Tree, we aim to improve the detection accuracy and provide a robust solution for mitigating MitM attacks. ```
1 Objective function \(f(x)\), \(x=(\ x_{1},\ x_{2},\ldots,\ x_{d})^{T}\)
2 Generate initial population of n host nests \(x_{i}\) (\(i=1,\ 2,\ \ldots,\ n\))
3 while \(t<\) stop criteria do
4 Get a cuckoo (say \(i\)) randomly by Levy distribution
5 Evaluate its fitness \(F_{i}\)
6 Choose a nest among \(n\) (say \(j\)) randomly
7 Evaluate its fitness \(F_{j}\)
8 if \(F_{i}>F_{j}\) then
9 Replace \(j\) with the new solution
10 end if
11 A fraction of the worst nests are abandoned and replaced by new ones using Levy flight
12 Keep the best solutions and continuously update the current best
13 end while
14 Repeat until the end
```

**Algorithm 2**Cuckoo Search Algorithm

### Cuckoo Search Detection Scheme

The framework in Algorithm 3 is the CSA detection Scheme algorithm designed to optimize the detection of anomalies in data. It begins by defining an objective function that evaluates the accuracy of detection results. The algorithm preprocesses the input data and uses a threshold to determine if each data point is an anomaly.