# A Dense Neural Network Approach for Detecting Clone ID Attacks on the RPL Protocol of the IoT
## 4 Proposed Framework
### Data Pre-Processing  
In this subsection, the pre-processing steps aimed at cleaning and preparing the data set for posterior phases, such as training and model evaluation, are detailed. In a first data exploration, categorical values were codified or transformed into discrete numerical sequences. Secondly, characteristics that contained outliers that affect the statistical variance and sparseness of the whole data set were scaled and standardized. Finally, due to the unbalanced nature of class samples, a data compensation technique to undersample the class distribution was applied. The sequence of steps used to process each data set is listed in Algorithm 1, and described as follows:  
* _Data set balancing_: As stated in [49], the samples within network captures are considerably smaller than those from benign applications, leading to the possibility of overfitting and classification downgrading. That being the case, algorithm estimations may always generalize the majority class features, overlapping the minority ones [50]; for example, in [51] the importance of data set balancing regarding a cervical cancer prediction model (CCPM) using risk factors as inputs was emphasized. In this case, the authors balanced their data set by using a synthetic minority over-sampling technique (SMOTE), due to their use of a Random Forest classifier. Although SMOTE performs better than other re-sampling techniques in traditional machine learning scenarios, in accordance with [52], Random Over-Sampling methods are better, as, \begin{table}
\begin{tabular}{l l l l} \hline \hline
**No.** & **Field Name** & **Description** & **Type of Feature** \\ \hline
1 & frame.cap\_len & Frame length stored into the capture file & Numerical \\
2 & frame.len & Frame length on the wire & Numerical \\
3 & frame.number & Frame Number & Numerical \\
4 & frame.time\_delta & Time delta from previous captured frame & Numerical \\
5 & frame.time\_epoch & Epoch Time & Numerical \\
6 & frame.time\_relative & Time since reference or first frame & Numerical \\
7 & wpan.ack\_request & Acknowledge Request & Categorical \\
8 & wpan.dst\_addr\_mode & Destination Addressing Mode & Categorical \\
9 & wpan.fcf & Frame Control Field & Numerical \\
10 & wpan.fcs & Frame Check Sequence & Numerical \\
11 & wpan.frame\_length & Frame Length & Numerical \\
12 & wpan.pending & Frame Pending & Categorical \\
13 & wpan.seq\_no & Sequence Number & Numerical \\
14 & glowpan.pattern & Pattern & Categorical \\
15 & ipv6.dst & Destination & Categorical \\
16 & ipv6.plen & Payload Length & Numerical \\
17 & ipv6.src & Source & Categorical \\
18 & icmpv6.checksum & Checksum & Numerical \\
19 & icmpv6.code & Code & Categorical \\
20 & class & Normal or attack class & Numerical \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Feature descriptions for the data set. in a real network traffic detection and filtering scenario, the generation of SMOTE samples could not be practical for high dimensional data. It would also not be ideal to use under-sampling, as it has been shown that, by removing samples from a majority class, key evidence that may be useful in feature engineering procedures could be lost. Therefore in the pre-processing stage in this proposal, a Random Over-Sampling (ROS) procedure was performed with no replacement. * _Value transformation_: Features that contain nominal and categorical data, such as IPv6 source and destination addresses (_ipv6_src_ and _ipv6_dst_), were transformed into discrete values (Label Encoding), in a range between 0 (the first _IPv6_ host) and \(n\) (the last one). In the case that a feature was comprised of a categorical sequence (i.e., \(\{ipv6\_dst,ipv6\_src,icmpv6\_code,wpan\_dst\_addr\_mode,wpan\_fcf,\) and \(\textit{sixlowpan\_pattern}\}\)), the transformation was a reduction to a sparse numerical array using One-Hot Encoding (OHE). After the conversion, each series were replaced by values between 0 (representing the absence of addresses) and 1 (active values).