## 3 Proposed Framework
### Dataset  
The initial dataset is presented with all the information from the log file described above. Making a split for each space in each log row results in ten columns. After inputting the log file and extrapolating a schema, only the columns needed for future training are selected. In particular, the IP address is essential to differentiate the requests made by client made and then the label is created to differentiate licit users from illicit ones. The date is important to create the 30 s periods necessary for the model to perform the training, for the size of the request bytes, and also for the only one to give input to the neural network. The final dataset is structured in such a way as to have periods of 30 steps, each regarding the sum of requests made by an IP address in a small range of time, with three columns: IP, Byte, and Label; the latter identifies the type of user (licit, illicit). The IP column has not been removed because in order to test data in a real environment, where you will not know if it is a licit or illicit request, once the prediction has been made you will need to identify the attacker in case a DDoS attack is in progress. The information exchange in the target application comprises a large amount of healthcare device data, such as IoMT, which is rapidly growing. There is a need for more bandwidth, data storage, and capacity. It sends data to and from local storage devices, online devices, and the Internet. The data is remediated, filtered, and merged under corporate standards. In this case, the Cloud is used as the final layer for metadata processing. Data and metadata analysis are summarized by FN (edge or dew computing (DC)). With FN and dew computing (DC), the proposed fog-IoMT Architecture improves the mobility of IoE (Internet of everything) users. Blockchain (BC) adds a second layer of security to prevent anonymous users from using IoMT devices. The following is the order in which the communication takes place: (a) Wireless Internet access is used to communicate with IoMT devices across a medium distance. TCP/IP is utilized for inter-primary communication, whereas ZigBee and Bluetooth are used for primary communication. (b) Wireless or wired media communicate between Cloud computing, dew computers, and the fog nodes [30]. TCP/IP end-to-end connections are made via a CAT-5/6 optical fiber. There are two sorts of communication: direct and indirect. Figure 10: Simulation results based on the bandwidth and number of rounds. ```
1:Init an Arr \(T_{\mathit{Srt}}\) of size \(B\)
2:Each Int in Arr of \(S\) recrd of type Int
3:Init Arr empty \(B\) whose values are int
4:Initially set to 1,..., \(S\)
5:Sel* a rand key \(K\)r of (PRF) \(F\)
6:Let \(W\) define set of kW \(D_{B}\)
7:For every \(w\) part of \(W\) do
8:Set \(s_{\mathit{sqg}}\)\(F(K_{T},w)\) and \(t\)\(\leftarrow\)\(-\)\(T\



In [22], an anonymous authentication scheme was proposed for wireless body area networks to securely transfer data in the transatlantic communication environment. To address the data privacy preservation, authentication, and integrity solicitudes in healthcare IoT applications, a multi-factor authentication model was proposed in [23]. In this model, the authors used biometric, smart care, and passwords as a combination to enable authentication between the client and server. Consequently, a fine-grained-based authentication model was proposed by [PERSON] et al. [24] to manage the validation of legal IoT devices in a telemedical information system. The authors of [25], presented a software defined-based secure framework for an edge computing-enabled healthcare ecosystem. In this scheme, edge servers were used to verify authorized devices in an operating network. In [26; 27], novel authentication schemes were presented for healthcare IoT networks utilizing a blockchain-based infrastructure. ### Identification of Threats

Under the above scenario, three main types of threats are relevant: information leakage, tampering, and sabotage.