## 3 The Proposed Lightweight IDS Model
### Stage I: Intrusion Detection Model  
At the primary stage, the PODCNN-LWID technique applies the DCNN model for the intrusion identification process. CNNs are established with the concept of local connectivity. The spatial extension of all the connectivity is suggested as the receptive domain of nodes [18]. The local connectivity is accomplished by exchanging weight sums in the NN with Convs. In all the layers of the CNN, the input is Conv, with the weighted matrix (filter) to generate a feature map. The local connectivity and shared weight feature of CNNs decrease the entire amount of learnable parameters, resulting in further effective training. The deep CNN is generally separated into two important parts: the primary part is comprised of the order of two one-dimensional Conv blocks, with Conv1D layers of 32 and 64 channels in the first and second blocks, respectively, a Batchnorm layer, an ReLU activation function, and a max-pooling 1D layer. Other parts comprise the order of the fully connected (FC) layers. In two important Conv blocks, the input signal is encrypted by decreasing their length and improving the number of channels. Figure 2 showcases the infrastructure of the CNN.  
The resultant second Conv block is concatenated, with input signals employing the remaining skip connections. However, it utilizes the network maintenance data as input at the deeper layers. Next, by concatenating the input signal and resultant Conv blocks, the FC layer is utilized for the final decision layer that creates the outcome. The resultant value of the Conv 1D layer with input size \(\left(N,\ C_{in},\ L\right)\) and output \(\left(N,\ C_{out},\ L_{out}\right)\) is:  
\[out\ \left(N_{i},\ C_{out_{j}}\right)=bias\ \left(C_{out_{j}}\right)+\sum_{k=0 }^{C_{in}-1}\ weight\ \left(C_{out_{j}},\ k\right)*input\ \left(N_{i},\ k\right) \tag{1}\]  
where \(*\) refers to the valid cross-correlation function (in this work, it is the Conv function), \(N_{i}\) signifies the batch-size \(i^{th}\), \(C_{out_{j}}\) signifies the channel \(j^{th}\), and \(L\) denotes the length of signal orders (when the input is image, width and height are employed rather than length). The length of resultant signal order is computed by utilizing the equation:  
\[L_{out}=\left[\frac{L_{in}+2\times padding-dilation\times\left(kernelsize-1 \right)-1}{stride}+1\right] \tag{2}\]  
where:  
* stride implies the stride of cross-correlation;
* padding signifies the number of zero-paddings on both sides;
* dilation denotes the space amongst the kernel element;
* kernelsize stands for the size of the Conv kernel.  
In order to achieve the max-pooling 1D, the resultant value with input size \(\left(N,\ C,\ L\right)\) and outcome \(\left(N,\ C,\ L_{out}\right)\) is represented as:  
\[out\ \left(N_{j},\ C_{out_{j}}\right)=m=\max_{m=0,...,kernel_{size_{-1}}} input\big{(}N_{i},\ C_{j},\ stride\times k+m\big{)} \tag{3}\]  
Figure 2: Structure of CNN.  
in which \(N_{i}\) signifies the input \(i^{th};C_{j}\) represents the channel \(j^{th}\).  
* kernelsize denotes the size of windows needed to obtain max over;
* stride indicates the stride of windows;
* padding demonstrates the number of zeros added on both sides;
* dilation represents the parameter that deals with the stride of elements from the window. The length of the resultant signal order to the max-pooling 1D layer is computed utilizing the same equation from the ConvID layer.