# Lightweight Model for Botnet Attack Detection in Software Defined Network-Orchestrated IoT
## 3 Materials and Methods
### Proposed Approach
While a kernel of size 3 is used in the 3 \(\times\) 3 architecture, a kernel of size 5 is utilized in the 5 \(\times\) 5 architecture. The third model put forth in this study is a combination of the 3 \(\times\) 3 and 5 \(\times\) 5 designs. With the employment of the 3 \(\times\) 3 and 5 \(\times\) 5 in parallel, the output from the GAP layer is concatenated to produce 128 features. The preliminary step in designing a lightweight model is to reduce the number of filters used in the architecture. The first and second CONV2D layer has a filter number of 16, while the third, and fourth CONV2D layers use a filter number of 32. Secondly, MaxPool with two kernel sizes is used only once after the second Conv2D layer. The third method to reduce the required number of parameters is using GAP instead of flattening the layer. For instance, using flatten for the (7, 7, 32) feature map will result in around 1568 output neurons, whereas GAP will only result in 32 neurons, which is significantly less than what would be produced with flattening. One dense layer and the final output layer come after the pooling of the global averages. Since there is no parameter to tune at the global average pooling layer, overfitting is prevented, which gives it an advantage over the flattening layer [45]. The spatial size of the output volume in each layer is calculated by using input size \(W1\) (\(W2\) will be the output volume), filter size \(F\), stride \(S\), and the amount of zero padding \(P\) based on the following Equation (1) as indicated in [46]:  
\[W2=\frac{W1-F+2P}{S}+1. \tag{1}\]  
The second convolution layer receives the output of the first convolution as an input. We can calculate the output of the next convolution layer by using the above equation. In the first layer, \(W1\) is a 28 \(\times\) 28 \(\times\) 3 color image is given to the model, and this spatial volume will be changed after the first convolution. The initial size of filter \(F\) is 3 \(\times\) 3, stride \(S\) is 2, and the same padding, based on the above Equation (1). The final result is ((\(28-3+2(1))/2)+1=14.5\). This is not an integer value so the libraries convert this number into 14. Therefore, the next convolution output value is 14 \(\times\) 14 \(\times\) 3,  
\[P=\frac{F-1}{2}, \tag{2}\]  
where \(P\) is padding and \(F\) is the filter (kernel). By using Equation (2), we can determine the kernel or filter size as indicated in Equation (3):  
\[F=2P+1. \tag{3}\]  
In the first convolutional layer, we have zero padding of 1 and by using Equation (3) we can get filter size \(F=2(1)+1=3\). Therefore, the filter is 3 \(\times\) 3. The reason that we are using a smaller kernel is that if we use a larger kernel, we may start losing details in some smaller features (where 3 \(\times\) 3 would detect them better). In other words using smaller-sized convolution helps to identify much smaller features that are used to distinguish between the input image and the probability of losing an important feature is much less because the size of our dataset is very small. Figure 2: Proposed lightweight deep learning architecture \(3\times 3\_5\times 5\)-based convolution without batch normalization before the GAP.