# Protocol-Specific and Sensor Network-Inherited Attack Detection in IoT Using Machine Learning
## 3 Methodology
### Modeling Phase in SEMMA
#### 3.5.1 Fundamental Parameters for ProSenAD  
The core parameters for developing the LGBM-based ProSenAD model include the following: (1) task, (2) objective, (3) boosting, (4) number of iterations, (5) learning rate, and (6) number of leaves. These parameters are fundamental for achieving the objective of attack detection in RPL-based IoT networks through the ProSenAD model. The aforementioned parameters have several metrics that can be used for building the model. They are explained further in this section.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{2}{c}{**Instance**} & \multicolumn{3}{c}{**Number/Value**} \\ \cline{3-5}  & & **Normal** & **PS-R** & **SN-W** \\ \hline \multirow{5}{*}{DIORedConst} & The DIO redundancy & The threshold value is & & \\  & constant set for & set to 10 in the & & \\  & controlling the & simulated benign & & \\  & redundant DIOs and & network, and a total of & & \\  & maintaining a & 816 values are found in & & \\  & stable network & the normal & & \\  & & traffic dataset & & \\ \hline \multirow{2}{*}{Lost} & Lost packets during the & Minimum calculated in & & 610 instances are \\  & attack simulation & normal traffic & Not considered & & observed in the SN-W \\  & & attack traffic dataset, and & & \\  & & & & \\  & Smallest hop count & & & 1244 instances are \\  & broadcasted by & Average calculated in & & \\  & malicious nodes & normal traffic & Not considered & & \\  & & & & \\ \hline \multirow{2}{*}{Class label} & Normal & 0 & Not applicable & Not applicable \\ \cline{2-5}  & PS-R & Not applicable & 1 & Not applicable \\ \cline{2-5}  & SN-W & Not applicable & Not applicable & 2 \\ \hline \hline \end{tabular}
\end{table}
Table 4: _Cont._The LGBM is typically used for binary classification as in [12]. However, our task is to optimize it for multiclass classification. Therefore, the most suitable and fundamental core metrics from the first parameter are selected for ProSenAD. They include, train, predict/test. From the second parameter, multiclass and softmax objective function is selected following the research objective of this paper. Other metrics from the second parameter employed by the ProSenAD include the determination of multiclass classification application metrics, and the number of classes. The multiclass application metrics include direct multiclass classification and binary one-vs-all-based multiclass classification. Furthermore, the third parameter allows for the implementation of the following methods: (1) gradient-based one-side sampling, (2) dropouts meet multiple additive regression trees, (3) random forest, and (4) conventional gradient boosting decision tree. By default, LGBM employs gradient boosting decision tree for some iterations before activating gradient-based one-side sampling depending on the learning rate. However, it should be tuned with other metrics for enhanced performance. For instance, if the learning rate is set to 0.1, then LGBM will run gradient boosting decision tree for the first ten iterations internally, followed by gradient-based one side sampling starting from the eleventh iteration. Therefore, we have experimented with the aforementioned metrics and tuned them accordingly to get optimal results.  
The _number of iterations_ parameter consists of metrics for the number of trees, number of rounds, number of estimators, and number of iterations. The default number of trees created by the model in multiclass classification is equal to the multiple of the number of classes and number of iterations. However, it can be exploited and tuned to meet the requirements and achieve the target accordingly. The fifth and sixth parameters, that is, _learning rate_ and _number of leaves_, can also be tuned based on the model performance. ProSenAD incorporates these parameters and hyperparameters for building the attack detection model for RPL-based IoT networks. The next section covers the learning control parameters considered for ProSenAD.