## 3 Methodology
### Self-Attention Mechanism
```
0: Dataset D = {(\(x_{i},y_{i}\))\({}_{i}^{N}=\)1 with feature vectors \(x_{i}\in\mathbb{R}^{d}\), labels \(y_{i}\) {1,...,C} Output: Trained model M, predicted labels \(\hat{y}\), performance metrics
1: function TrainHybridIDS(D, E, B)
2:# Step 1: Preprocessing
3: Normalize each feature in X using Z-score:
4:\(\quad\)X \(\leftarrow\) (X--mean(X))/std(X)
5: Encode labels y into one-hot vectors: Y \(\in\) R'{N\(\times\)C}
6: (X_train, Y_train), (X_test, Y_test) \(\leftarrow\) TrainTestSplit(X, Y, ratio = 0.8)
7:
8:# Step 2: Handle class imbalance
9: (X_bal, Y_bal) \(\leftarrow\) SMOTE(X_train, Y_train)
10: Reshape X_bal to shape (N, d, 1) for Conv1D input
11:
12:# Step 3: Build model M
13: Define input shape: (d, 1)
14:x \(\leftarrow\) Conv1D(filters = 32, kernel_size = 3, activation = ReLU)(input)
15:x \(\leftarrow\) MaxPooling1D(pool_size = 2)(x)
16:x \(\leftarrow\) GRU(units = 64, return_sequences = True)(x)
17:x \(\leftarrow\) Dropout(0.3)(x)
18:x \(\leftarrow\) GRU(units = 64, return_sequences = True)(x)
19:x \(\leftarrow\) Dense(units = 64, activation = ReLU)(x)
20:
21:# Self-Attention Mechanism
22:Q \(\leftarrow\) x \(\cdot\) W_q; K \(\leftarrow\) x \(\cdot\) W_k; V \(\leftarrow\) x \(\cdot\) W_v
23:A \(\leftarrow\) softmax(Q \(\cdot\) K\({}^{\text{T}}\))
24:x_attn \(\leftarrow\) A \(\cdot\) V
25:
26:x \(\leftarrow\) GlobalAveragePooling1D()(x_attn)
27:output \(\leftarrow\) Dense(C, activation = softmax)(x)

## 4 Experimental Setup

### Dataset

WSN-DS is a dataset specifically designed for intrusion detection systems in WSNs. These Denial of Service (DoS) attacks include Blackhole, Grayhole, Flooding, and Scheduling. Following the preprocessing of data from Network Simulator 2 (NS-2) using the Low Energy Adaptive Clustering Hierarchy (LEACH) method, 23 characteristics were identified [8]. Moreover, each partitioned subset simulates a unique node in the network, with the model learning from traffic-related attributes such as packet frequency, hop count, and routing paths. This focus ensures that intrusion detection is based on anomalous communication behaviors rather than environmental fluctuations. Table 3 provides dataset statistics. ### Evaluation Matrices

To thoroughly evaluate the reliability of the proposed Conv1D-GRU-Self-Attention model, a range of assessment metrics was utilized. These metrics provide insight into diverse facets of model performance, encompassing overall accuracy and its capacity to identify and differentiate between various intrusion types in a WSN environment. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Label** & **Description** & **Number of Instances** & **Percentage (\%)** \\ \hline
**Normal** & Legitimate, attack-free network behavior & 25,000 & 25.0\% \\ \hline
**Blackhole** & Node drops all received packets & 20,000 & 20.0\% \\ \hline
**Grayhole** & Node selectively drops packets & 15,000 & 15.0\% \\ \hline
**Flooding** & Node sends excessive packets & 20,000 & 20.0\% \\ \hline
**Scheduling** & Node disrupts time-slot allocations & 20,000 & 20.0\% \\ \hline
**Total** & & **100,000** & **100\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 3: WSN-DS dataset statistics. Accuracy: Accuracy denotes the ratio of accurately predicted cases to the total number of forecasts. This metric provides an overall assessment of performance across all classes and is particularly effective when the dataset is balanced. \[\text{Accuracy}=\frac{\text{TP}+\text{TN}}{\text{TP}+\text{TN}+\text{FP}+\text{ FN}} \tag{8}\]

where TP = true positives, TN = true negatives, FP = false positives, and FN = false negatives

Precision: Precision quantifies the ratio of accurately predicted positive cases to the total instances projected as positive. Minimizing false alarms (false positives) is crucial in intrusion detection settings. \[\text{Precision}=\frac{\text{TP}}{\text{TP}+\text{FP}} \tag{9}\]

Recall: Also referred to as sensitivity or true positive rate, recall is the ratio of accurately detected genuine positive events.