## 3 Materials and Methods
### Process Level--Deep Learning Intrusion Detection Systems (IDS)  
A Security Information and Event Management (SIEM) server at the fog layer utilized a deep learning LSTM model to swiftly detect network intrusion attempts by identifying anomalous traffic patterns. The intrusion detection system (IDS) generated alerts that were aggregated and correlated by the SIEM server to facilitate rapid analysis and guided response to contain identified threats. The LSTM model was trained on a dataset consisting of 30 days of normal network traffic containing 1.5 million connecting sessions. Additionally, the training data incorporated 500 examples of known cyberattack traffic, with 100 samples each of Stuxnet, Havex, BlackEnergy2, CRASHOVERRIDE, and TRISIS/TRITON traffic, to enable the model to recognize these and similar anomalous behaviors indicative of threats. Figure 3 shows the pseudocode loads and preprocesses network traffic data, then splits it into training and test sets. An LSTM model is defined and trained to distinguish normal and anomalous traffic. The model is evaluated on the test data and then makes predictions on new traffic data. If an anomaly is detected by predictions falling below a threshold, the system triggers alerts  
Figure 3: The workflow and pseudocode for monitoring the network characteristics. Figure 2: Components and user interface of SCADA system. The sensitivity information has been masked. and automated containment actions like blocking suspicious IP addresses or disabling related user accounts. This outlines an end-to-end LSTM deep learning pipeline for network intrusion detection and containment in a concise manner. Figure 4 shows our recent research [32] and highlights the use of recurrent neural networks (RNNs) as a deep learning (DL) technique for generating representations from raw data in applications like classification, regression, clustering, and pattern recognition. RNNs incorporate Long Short-Term Memory (LSTM) cells with input, forget, and output gates to control signal propagation. The connections between hidden layers are denoted by W, and the weight matrix U connects inputs to the hidden layer. The LSTM's unique architecture addresses the vanishing and exploding gradient problem by allowing gradients to propagate without decay through linear summation of cell states in the hidden layer. This flexibility enables the network to retain recent and past information selectively, empowering the data to determine which information is relevant. However, long-distance dependencies are difficult for standard RNNs to model effectively. LSTM networks address this issue by incorporating a memory cell that can maintain information over long periods of time. This makes LSTM well-suited for processing time series data, enabling tasks like forecasting and classification. The LSTM architecture consists of a chain of repeating modules, each containing four interacting neural layers. These layers are known as cells, and they use structures called gates to control information flow and memory updates. The recurrence weight matrix W connects the previous and current hidden states to propagate relevant context forward. The input weight matrix U transforms current inputs into a hidden representation. Candidate hidden states C are computed based on the current input and the previous hidden state. The cell's internal memory C is updated by combining the previous memory scaled by the forget gate and the new hidden state scaled by the input gate. Figure 5 uses a 3D scatter plot to visualize the LSTM model's analysis of SCADA network traffic over one day. Each point denotes an individual session, colored green if classified as normal or red if deemed threatening. Sessions are positioned along axes, indicating order, connected IP address, and predicted intrusion risk on a 0.0 to 1.0 scale. The prevalence of green points shows the model categorizing most of the traffic as normal. The red points reveal sessions flagged as potential threats.