# Lightweight Model for Botnet Attack Detection in Software Defined Network-Orchestrated IoT
## 3 Materials and Methods
### Proposed Approach  
Object detection [41], time-series data categorization [2; 42], and medical image analysis [43] are only a few of the tasks for which a deep learning architecture has been deployed. Most of these designs use models with numerous layers, producing extremely deep models. Wider models are produced when multiscale architecture is employed. Thus, it is crucial to develop a model that accurately reflects how the model operates. The way we construct the deep learning architecture has an impact on the depth/width of the model and the number of parameters that need to be learned. Overfitting can happen when a model has many parameters, while underfitting can happen when a model has few parameters. A gradient vanishing or gradient explosion may also happen when a model's depth is raised, according to [PERSON] [44]. As a result, developing a model that perfectly matches the computer resource limitation without compromising classification performance requires a lot of trial and careful thought. In this study, the SDN dataset is classified into six groups by using a lightweight deep learning architecture. In addition to having a limited number of parameters and requiring little time to run, the model also has a very low memory requirement. These characteristics enable the model to utilize the available computational resource effectively. The lightweight deep learning model's development method is described in Algorithm 3. ```
1:\(\_\)Z: Initialization of hyper-parameters
2:if Number of Convolutional layers is fixed then
3: Assign an appropriate number of pooling layers
4: Assign an appropriate number of batch normalization
5: Assign an appropriate size of a kernel
6: Build lightweight Model
7:endif
8: Evaluate the appropriateness of lightweight Model
9:if Lightweight Model is not underfit \(\mid\mid\) overfit then
10: Fine-tune the lightweight-Model
11: Go to \(\_Z\)
12:else
13: Go to \(\_W\)
14:endif
15:\(\_\)W: Evaluate-performance of lightweight Model
16:if Acc & R & P & F1 \(\geq\) state-of-the-art-result then
17: Check memory-requirement of lightweight \(\leq\) IoT-devices
18: Check computational resources are upto-IoT devices
19: Check computational time is minimum
20:if Lightweight Model satisfied IoT devices constraints then
21: Save Model & Model weights
22: Go to \(\_Z\)
23:endif
24:endif
```  
**Algorithm 3** Designing a constraint-based lightweight model for IoT devices. As presented in Algorithm 3, for less memory space and computational time requirements, three different lightweight architectures (3 \(\times\) 3, 5 \(\times\) 5, and 3 \(\times\) 3-5 \(\times\) 5 that vary in the size of kernels are proposed, and the 3 \(\times\) 3-5 \(\times\) 5 model architecture is depicted in Figure 2. These three models come in two variations, one with batch normalization (BN), and the other without. The proposed 3 \(\times\) 3 and 5 \(\times\) 5 architectures with the final BN have _Input_\(\rightarrow\)_CONV2D\(\rightarrow\)_ACT_\(\rightarrow\)_BN_\(\rightarrow\)_CONV2D_\(\rightarrow\)_ACT_\(\rightarrow\)_BN_\(\rightarrow\)_MAXPOOL_\(\rightarrow\)_CONV2D_\(\rightarrow\)_ACT_\(\rightarrow\)_BN_\(\rightarrow\)_CONV2D_\(\rightarrow\)_ACT_\(\rightarrow\)_BN_\(\rightarrow\)_GAP_\(\rightarrow\)_FC_ layers. The input size is (28, 28, 3), which indicates that the input image contains RGB channels and dimensions of 28 in both width and height. In the 3 \(\times\) 3 architecture, the size of the feature map after the first, second, third, and fourth Conv2D layers is (14, 14, 16), (12, 12, 16), (9, 9, 32), and (7, 7, 32), respectively. It is (14, 14, 16), (10, 10, 16), (5, 5, 32), and (1, 1, 32) for the 5 \(\times\) 5 architecture. The difference in the feature map is due to the kernel size difference, which can be calculated with Equation (1). The other proposed modification to this architecture is the removal of BN just before the global average pooling (GAP). The size of the kernels used is the only distinction between the 3 \(\times\) 3 and 5 \(\times\) 5 architectures.