# DeepDCA: Novel Network-Based Detection of IoT Attacks Using Artificial Immune System
## 6 DeepDCA: Deep Learning Dendritic Cell Algorithm
### Anomaly Metrics: \(Mcav\) and \(K_{\alpha}\)
\begin{table}
\begin{tabular}{l l c c c} \hline \hline \multirow{2}{*}{**Feature**} & **Attack** & **Frequency** & \multirow{2}{*}{**Training**} & \multirow{2}{*}{**Test**} \\  & **Type** & **Count** & & \\ \hline
**Normal** & Non & 3,668,045 & 2,567,631 & 1,100,413 \\ \hline
**Information** & Keylogging & 73 & 51 & 22 \\ \cline{2-5}
**Theft** & Data theft & 6 & 4 & 2 \\ \hline
**Information** & Service scanning & 73,168 & 51,217 & 21,951 \\ \cline{2-5}
**gathering** & OS & 17,914 & 12,540 & 5374 \\  & Fingerprinting & & & \\ \hline
**DoS** & DoS TCP & 615,800 & 431,060 & 184,740 \\ \cline{2-5}
**DoS** & DoS UDP & 1,032,975 & 723,082 & 30,9893 \\ \cline{2-5}  & DoS HTTP & 1485 & 1039 & 446 \\ \hline
**DDoS** & DDoS TCP & 977,380 & 684,166 & 293,214 \\ \cline{2-5}
**DDoS** & DDoS UDP & 948,255 & 663,778 & 284,477 \\ \cline{2-5}  & DDoS HTTP & 989 & 692 & 297 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Frequency distribution of considered features. \begin{table}
\begin{tabular}{c c} \hline \hline \multicolumn{1}{c}{**Name**} & **Value** \\ \hline Rows & 3,668,045 \\ \hline Columns & 47 \\ \hline Discrete columns & 7 \\ \hline Continuous columns & 40 \\ \hline All missing columns & 0 \\ \hline Missing observations & 0 \\ \hline Complete Rows & 3,668,045 \\ \hline Memory allocation & 13.6 Mb \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Statistical Description for The Dataset. ### Feature Selection

Feature selection is a primary step to enhance IDS performance, reduce the computational cost and improve accuracy. In the original dataset, a selection of the 10 best features has been provided (see Table 5). In this work, we used the best 10 features and adopted the Information Gain (IG) approach to decide which features are more important. Figure 5 shows information gain for each feature. The features ('seq', 'DstIP','srate', 'SrcIP','max'), are the most discriminative attribute. While the rest ('mean','stddev','min','state_number', 'drate') have small maximum information gain (smaller than 0.5), which little contribute to intrusion detection. ### DeepDCA-Based Classification

#### 7.5.1 Initialization

In this phase, we initialized the population of DCA with size up to a limit of 100 cells. Then, an array size named antigens set to store antigen per iteration. Finally, initialize the output parameters \(K\) and \(CSMK\) to zero. Figure 5: Features Ranking Based on Information Gain. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Feature** & **Data Type** & **Description** \\ \hline
**pkSeqID** & Ordinal & Row Identifier \\ \hline
**Seq** & Numerical & Argus sequence number \\ \hline
**Mean** & Numerical & Average duration of aggregated records \\ \hline
**Stddev** & Numerical & Standard deviation of aggregated records \\ \hline
**Min** & Numerical & Minimum duration of aggregated records \\ \hline
**Max** & Numerical & Maximum duration of aggregated records \\ \hline
**Srate** & Numerical & Source-to-destination packets per second \\ \hline
**Drate** & Numerical & Destination-to-source packets per second \\ \hline
**NINConn PSrcIP** & Numerical & Total Number of packets per source IP \\ \hline
**NINConn PDstIP** & Numerical & Total Number of packets per Destination IP \\ \hline \hline \end{tabular}
\end{table} 
Table 5: BoT-IoT best 10 features Description. #### 7.5.2 Signals and Antigen

The antigen represented by an attribute of the dataset which identifies the traffic packets uniquely, in our case the antigen is \"pkSeqID\" attribute. For the Signals, SNN models meant to implement a parametrized signal extraction process for the DCA. It defined to have 1 input layer with six neurons equal to the number of input features, one hidden layer, and 1 output neuron for the binary classification.. The Model was trained in 125 epochs. The task of the hidden layer neurons would be to encode the decision for a threshold and transform the input attributes into signals normalized into the interval [0, 1] (hence, _sigmoid_ activation).