## 3 Methodology
### Detection Algorithm
Figure 2: Proposed Model. ## 5 Objective Function

The CSA's objective function is computed using Statistical Process Control (SPC). SPC is an advanced method designed to measure and control quality by monitoring ongoing processes. It is a practical approach that continuously improves monitoring. Using the Expected Weighted Moving Average (EWMA), the most recent security attacks are assigned the highest weights, while older attacks are assigned decreasing weights over time. This ensures that EWMA is more responsive to recent security attack changes, making it highly useful for fast decisions. The EWMA utilizes a smoothing parameter \(\lambda\) and control limit L. Thus, increasing \(\lambda\) (closer to 1) makes the chart less sensitive to small shifts and minimizes false positives. Smaller \(\lambda\) values make the EWMA more sensitive to minor variations, enhancing early detection. The objective function can be calculated as follows:

\[\text{MinJ}(\text{L},\text{h})=\text{w1}*\text{FAR}+\text{w2}*\text{DD}\]

where FAR is the false alarm rate, DD Is the detection delay, L (for Shewhart or EWMA charts) are the decision parameters, and w1 \(\wedge\) w2 There are weights to show the relative importance of false positives and detection speed. Figure 3 shows the statistical process control used to control the values of the objective function to minimize the false positives while improving the detection accuracy of the proposed model. An emergency action might be required when the process exceeds the upper limit baseline. ## 6 Experimental Simulation Results

Table 1 presents the key parameters and their corresponding values in this study. These parameters define the framework for implementing and evaluating the proposed anomaly-based detection scheme to mitigate MitM attacks on DNSs. The simulations and experiments are conducted on Kaggle, which provides a collaborative environment with access to powerful computational resources. The implementation of the detection scheme is performed using Python 3.10, a versatile and widely used programming language. The study employs several algorithms to detect anomalies, including Decision Tree, CSA, Support Vector Machine (SVM), and Local Outlier Factor (LOF). Our study utilizes two datasets for training and evaluation. IoTID20 is a dataset specifically designed

Figure 3: Statistical Process Control. for intrusion detection in IoT networks. It contains various types of network traffic data, including normal and attack scenarios, and the Intrusion Detection Dataset (IDD). This comprehensive dataset includes a wide range of network intrusion types. It is used to evaluate the performance of detection algorithms in identifying various attacks. The performance of the detection schemes is evaluated using precision, recall, F1-score, and accuracy. The objective function used in this study is based on SPC, a quality control method that uses statistical techniques to monitor and control processes. The population size ranges from 10 to 20, reducing the number of feature subsets explored in each iteration. The number of iterations is focused between (20-50); limiting the number of iterations prevents the CSA from running excessively long. Our discovery rate ranges from 0.2 to 0.4 because a moderate abandonment rate encourages the exploration of new feature subsets without prematurely converging to a potentially suboptimal solution. ### Dataset

The proposed model was evaluated using a publicly available IoTID20 dataset [20], which was created by the SECLAB at the University of Jyvaskyla and the Canadian Institute for Cybersecurity, for anomaly detection in IoT networks. This dataset was designed to provide realistic IoT network traffic data, including normal and anomaly behavior. The dataset comprises 625,783 instances, with 500,000 instances for the training set and 127,783 for the testing set.