## 4 Proposed Methodology
### The WSN-DS Dataset  
The WSN-DS dataset used in this study is a comprehensive dataset collected from real-world sensor networks, specifically designed for evaluating IDS. The dataset was obtained from Prince Sultan University, Saudi Arabia, and consists of a vast collection of sensor readings and network traffic data. The dataset can be accessed at [[https://www.kaggle.com/datasets/bassamkasasbeh1/wsnds](https://www.kaggle.com/datasets/bassamkasasbeh1/wsnds)]([https://www.kaggle.com/datasets/bassamkasasbeh1/wsnds](https://www.kaggle.com/datasets/bassamkasasbeh1/wsnds)) accessed on 19 June 2024. The types of attacks and the total number of samples are detailed below.  
WSN-DS comprises various types of attacks that can occur in WSNs, including the following:  
* Blackhole Attacks: A blackhole attack is a type of security threat where a malicious node in the network selectively drops or discards data packets, without sending them to their anticipated terminal. The purpose of a blackhole attack is to disrupt communication within the network by making the malicious node appear as an attractive route for data traffic.
* Greyhole Attacks: A grayhole attack is a type of security threat where a malicious node selectively drops or modifies data packets, rather than dropping all packets like in a blackhole attack. The goal of a grayhole attack is to disrupt communication in the network while remaining stealthy and difficult to detect.
* Flooding Attacks: A flooding attack is a type of Denial of Service (DoS) attack where an attacker deliberately sends a large volume of packets or messages to the network with the intention of overwhelming its resources. The goal of a flooding attack is to consume the network's bandwidth, energy, or processing capabilities, leading to a disruption in communication and potentially causing legitimate messages to be dropped or delayed.
* TDMA/Scheduling: TDMA/scheduling is a channel access method used to allocate time slots to nodes for transmitting and receiving data. TDMA is a scheduling algorithm that divides the communication channel into time slots, with each node assigned a specific time slot during which it can transmit or receive data.  
There are a total of 374,661 samples in the WSN-DS dataset. Out of 374,661 instances, there are 340,066 normal nodes; 10,049 blackhole attacks; 14,596 grayhole attacks; 6638 TDMA/scheduling attacks; and 3312 flooding attacks. The dataset description can be accessed from [30] and its feature importance can be found in [35; 36; 37].  
The dataset utilized in this investigation was carefully inspected to check for null values, missing values, and value ranges. It was discovered that the dataset was clean and devoid of any missing or null values. This indicated that the dataset was suitable for direct use in the classification task without the need for any specific data pre-processing techniques. The range of values in the dataset was also inspected to ensure that all values fall within the expected range for each feature, which further confirmed the value and appropriateness of the dataset for analysis.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & **Nomal** & **Blackhole** & **Grayhole** & **Flooding** & **TDMA** & **Total** \\ \hline No. of testing samples & & & & & & \\ (20\%) & 67,979 & 2030 & 2943 & 618 & 1363 & 74,933 \\ No. of training samples & & & & & & \\ (80\%) & 272,087 & 8019 & 11653 & 2694 & 5275 & 299,728 \\ \% of proportion & 90.77 & 2.68 & 3.9 & 0.88 & 1.77 & 374,661 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Breakdown of WSN-DS dataset.