# Lightweight Model for Botnet Attack Detection in Software Defined Network-Orchestrated IoT
## 4 Experimental Results and Discussion
NB, LR, and KNN have the shortest running times, as shown in Table 6; however, they perform poorly in terms of classification when compared to the suggested model. Figure 5 communicates the running time result of each model visually, and we can see that the proposed model achieves a lower running time compared to SVM and XG-boost. Similarly, from Figure 6 we can observe that the precision, recall, F1 score, and accuracy of the proposed models are better compared to the existing model. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Attack Type/Label**} & \multicolumn{3}{c}{**With Batch Normalization before GAP**} & \multicolumn{3}{c}{**Without Batch Normalization before GAP**} \\ \cline{2-7}  & **Precision (\%)** & **Recall (\%)** & **F1 Score** & **Precision (\%)** & **Recall (\%)** & **F1 Score** \\ \hline DDoS & 98 & 100 & 0.99 & 100 & 99 & 0.99 \\ \hline DoS & 100 & 98 & 0.99 & 98 & 100 & 0.99 \\ \hline Fuzzing & 100 & 100 & 1.00 & 100 & 100 & 1.00 \\ \hline Normal & 100 & 100 & 1.00 & 100 & 1.00 \\ \hline OS Fingerprinting & 100 & 94 & 0.97 & 100 & 97 & 0.99 \\ \hline Port Scanning & 95 & 100 & 0.97 & 97 & 100 & 0.99 \\ \hline
**Average** & **99** & **99** & **0.99** & **99** & **0.99** \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The \(5\times 5\) with and without batch normalization before the global average pooling. Figure 5: Comparison of models in terms of run time. As presented in Table 6, our proposed model has fewer parameters compared to pre-trained models and less model size compared to both pre-trained models and traditional machine learning techniques, which makes the proposed model be installed and perform well in low computational resource machines like IoT devices. Similarly, from the experimental result, we found that our proposed model outperforms both pre-trained models and traditional machine learning algorithms in terms of precision, recall, F1 score and accuracy as indicated in Table 7. Besides, the proposed approach can identify any malware on the devices in milliseconds. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model Architecture** & **Loss** & **Size (KB)** &
\begin{tabular}{c} **Number of** \\ **Parameters** \\ \end{tabular} & **Time (Milliseconds)** \\ \hline NB & - & 3.65 & - & 0.0010 \\ \hline LR & - & 2.29 & - & 0.0030 \\ \hline KNN & - & 327 & - & 0.0030 \\ \hline SVM & - & 6000 & - & 1.500 \\ \hline XGB & - & 2700 & - & 0.140 \\ \hline RF (10 initially selected features) & - & 2700 & - & 0.140 \\ \hline RF (10 best-selected features) & - & 2700 & - & 0.140 \\ \hline VGG-16 & - & 512.43 MB & in millions & in minutes \\ \hline VGG-19 & - & 542.34 MB & in millions & in minutes \\ \hline Inception-V3 & - & 91.55 MB & in millions & in minutes \\ \hline
3 \(\times\) 3 with\_BN & 0.051 & 122 & 19542 & 0.1130 \\ \hline
3 \(\times\) 3 without\_BN & 0.023 & 118 & 19414 & 0.1080 \\ \hline
5 \(\times\) 5 with\_BN & 0.031 & 240 & 48982 & 0.1080 \\ \hline
5 \(\times\) 5 without\_BN & 0.022 & 237 & 48854 & 0.1073 \\ \hline
3 \(\times\) 3\_5 \(\times\) 5 with\_BN & 0.011 & 349 & 68070 & 0.1230 \\ \hline
3 \(\times\) 3\_5 \(\times\) 5 without\_BN & 0.014 & 342 & 67814 & 0.1170 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of the proposed approach with previous works in terms of size, running time, and a number of parameters. Figure 6: Comparison of models in terms of accuracy, precision, recall, and F1 score.