## 5 Experimental Design Analysis of Results
### Testing-Attack Detection Phase  
While there can be found many ML libraries for IoT gateways, to authors' knowledge, there have not been tested and developed many ML approaches for end-point IoT nodes that can contribute towards this. Most of the works mentioned earlier use data analytic and ML for the analysis of data extracted from IoT devices, which is done on more powerful machines. The testing phase includes a comparison of the network packet that arrives against the previously training model. It is similar to IDS/Intrusion Prevention Systems \begin{table}
\begin{tabular}{l c c} \hline \hline
**Space Compeavity** & **Flash, Bytes (\%)** & **SRAM, Bytes (\%)** \\ \hline
**Full memory** & 32,256 (100\%) & 2048 (100\%) \\ \hline
**2 training packets** (9 f) & 8276 (25\%) & 970 (47\%) \\ \hline
**20 training packets** (9 f) & 8960 (27\%) & 1690 (82\%) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Space complexity of the ANN model training on Arduino Uno Rev3. \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Epoch ID** & 1 & 10 & 16 \\ \hline
**Output Error** & 2.08758 & 0.01587 & 0.00946 \\ \hline
**Time (per epoch), \(\mathbf{10^{-6}s}\)** & 28,752 & 29,808 & 29,756 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Computation complexity and performance of the ANN training phase. (IPS) systems when the network traffic is inspected and being compared against predefined signatures. Table 4 demonstrates the difference between model accuracy and time to classify a single network packet, while measured during the first/last epoch. To practically reflect the _computational complexity_ of the training phase, we can say that the average time needed to evaluate a single network packet based on 9 characteristics on the Arduino UNO Rev3 using trained ANN model is 1643 \(\upmu\)s. It will be equal approximately to 600 network packets/s. However, these are the ideal conditions and more study is needed using an actual network extension board. From the study [30], we can see that it takes up to 40 \(\upmu\)s for an ML model to classify a questioned network traffic packet on a multi-core system. At the same time, the extensive benchmark of the different extension shields for Arduino UNO Rev3 gives the data transfer rate ranging from 79.27 KBytes/s up to 329.60 KBytes/s. Using a rough estimation, we can see that the following packet rate range can be expected [30]:  
\[Rate_{min}=\frac{79.27\times 10^{3}\text{\leavevmode\
obreak\ \text{Bytes}}/\text{s}}{8 \text{\leavevmode\
obreak\ \text{bytes}}/\text{packet}}\approx 943\text{\leavevmode\
obreak\ \text{ packets}}/\text{s} \tag{3}\]  
\[Rate_{max}=\frac{329.60\times 10^{3}\text{\leavevmode\
obreak\ \text{Bytes}}/\text{s}}{1538 \text{\leavevmode\
obreak\ \text{bytes}}/\text{packet}}\approx 214\text{\leavevmode\
obreak\ \text{ packets}}/\text{s} \tag{4}\]  
At the same time, the _space complexity_ for the ready-to-use ANN model will be as follows: \((N+1)\cdot H\) weights in the hidden layer, \(H+1\) weights in the output later, number of input nodes \(N\), number of hidden \(H\) and number of output layer \(O\), where \(N\) is a number of input features, \(H\) is a number of hidden layers, \(O\) is a number of output nodes. For this specific case, we can evaluate the model will require, respectively, 50 4-Byte real weights, 6 4-Byte real weights, 1 2-Byte integer, 1 2-Byte integer, and 1 2-Byte integer. Such guesstimate gives roughly 230 Bytes needed to store the ANN model on the IoT node (Arduino UNO Rev3). **Digital Evidences Analysis in the IoT ecosystem. ** One of the important considerations while using Computational Intelligence in Cybersecurity is the ability to derive an explanation of the cyber incident. Moreover, the data can be used as evidence in case of an investigation. From the perspective of IoT, this is a challenging task due to: (i) limited data storage, (ii) limited logging (username, timestamps, non-repudiation), (iii) mostly proprietary protocols and data formats, (iv) absence of wide support by Digital Forensics tools.