# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
## 3 Methodology
### Dataset Selection and Data Preprocessing  
We used WSN-DS [13], a specialized simulation-based dataset collected for hierarchically cluster-based WSNs in this study. Network-layer attacks, including selective forwarding, spoofing, blackhole, wormhole, Sybil, sinkhole, hello flood, and altered or replayed routing information, are the most common attacks targeting WSNs. Four types of inside network-layer DoS attacks, Grayhole, Blackhole, Flooding, and TDMA scheduling, were used based on the employed dataset. An attack is called Grayhole when malicious cluster heads (CHs) selectively drop some packets before forwarding messages to the BS. The malicious CHs discard every packet that has to be forwarded to the BS during a Blackhole attack. A flooding attack occurs when a malicious node falsely identifies itself as a CH and repeatedly sends signals that drain the other sensors' power. Another attack type, TDMA scheduling, occurs when a malicious CH assigns multiple cluster members to deliver data in the same time slot, resulting in packet collision and data loss.  
Several dataset specifications, such as high variation in class types and sizes, dataset dimensionality, and class imbalance, can degrade the ML model's learning process performance. We extracted several balanced datasets for our experiments due to this problem. Table 1 lists the specifications of the original imbalanced WSN-DS dataset and the extracted balanced dataset. Table 2 presents a set of single-class datasets for each considered attack.  
The balanced dataset version, which extracts four different types of attacks, consists of 26,000 samples, with 3250 samples for each attack type. A balanced dataset prevents classifiers from being biased toward the majority class [28]. The dataset size was also reduced to approximately 10% of the original dataset, which is preferred in the context of learning models for WSNs to lower computation and memory needs. We looked at the sample size for each type of attack in the original dataset to determine if the TDMA Scheduling size represented the minimum number of classes, then used that as a base number for individual attack datasets, for an approximate number of 3250 samples per dataset for each type of attack.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Class** & **Size** & **Proportion (\%)** & **Total** \\ \hline \multirow{4}{*}{Original Imbalanced Dataset} & Normal & 340,066 & 90.77 & \\  & Grayhole & 14,596 & 3.90 & \\  & Blackhole & 10,049 & 2.68 & 374,661 \\  & Flooding & 6638 & 1.77 & \\  & Scheduling & 3312 & 0.88 & \\ \hline \multirow{4}{*}{Extracted Balanced Dataset} & Normal & 13,000 & 50 & \\  & Grayhole & 3250 & 12.5 & \\ \cline{1-1}  & Blackhole & 3250 & 12.5 & \\ \cline{1-1}  & Flooding & 3250 & 12.5 & \\ \cline{1-1}  & Scheduling & 3250 & 12.5 & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Original and extracted balanced datasets.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Class Type** & **Size** & **Proportion (\%)** & **Total Size** \\ \hline \multirow{2}{*}{Grayhole Dataset} & Normal & 3250 & 50 & \\  & Grayhole & 3250 & 50 & 6500 \\ \hline \multirow{2}{*}{Blackhole Dataset} & Normal & 3250 & 50 & \\  & Blackhole & 3250 & 50 & 6500 \\ \hline \multirow{2}{*}{Flooding Dataset} & Normal & 3250 & 50 & \\  & Flooding & 3250 & 50 & 6500 \\ \hline \multirow{2}{*}{TDMA Dataset} & Normal & 3250 & 50 & 6500 \\ \cline{1-1}  & TDMA & 3250 & 50 & 6500 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Extracted single-class datasets.