# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 4 Experiment and Result  
To evaluate the framework's effectiveness in interpreting and generating reports across various attack scenarios, we conducted experiments using several instances from three primary DDoS attack types. The framework successfully generates detailed reports by parsing the LIME outputs, offering insights into which system components and associated security requirements are impacted. These reports also include the _IF_s of the affected components. As illustrated in Figure 8, the LIME explanation for a DDoS_TCP instance highlights that the most influential features in the model's prediction originate from the DDoS_TCP feature set. Notably, these features include the activation of the TCP SYN flag (_tcp.connection.syn_ = 1.0) and the absence of normal connection termination indicators such as FIN, RST, and SYN-ACK flags, all of which were set to zero. This combination is characteristic of a TCP SYN flood--a common DDoS technique that overwhelms the target system by initiating numerous incomplete TCP handshakes. Additional contributing features included minimal acknowledgment values (_tcp.ack, tcp.ack_raw_) and a low composite flag value (_tcp.flags_ = 0.08). Although some features slightly contradicted the prediction--such as the presence of a valid checksum or the absence of UDP-related fields--they were insufficient to override the dominant SYN-based attack signature. This instance demonstrates the model's capacity to identify protocol-specific patterns and effectively differentiate malicious TCP behaviors from legitimate network traffic. The framework successfully generates a report that pinpoints the affected security goals and system components based on the condition changes in the _DDoS_TCP_ feature set, as illustrated in Figure 9 (partial report). The directly impacted goals include _G-16, G-21,  
Figure 8: LIME explanation for one network traffic instance (TCP based DDoS attack). \(G\)-22, and \(G\)-23. Due to the interdependencies within the SAC, the _SendTriggerToActuator_ process in the Edge Layer is also affected. This component has an _IF_ of 0.086, as detailed in Table 3. The degradation of the _SendTriggerToActuator_ functionality subsequently affects additional goals due to the hierarchical and functional linkages. These include \(G\)-12, \(G\)-10, \(SI\)-4 Requirement, and \(SI\)-4 Main, all of which are listed as affected goals in the generated report (see Figure 9). Similarly, we conducted an experiment on a _DDoS_HTTP_ attack scenario, and the framework successfully generated a corresponding report, as in the instance shown in Figure 10.  
The experimental results demonstrate that our developed security awareness component can generate interpretation reports by incorporating relevant attributes and their dynamic conditions, as identified by the integrated deep learning (DL) model. This overcomes a key limitation of the approach proposed in [38], which depends on a predefined threat model to interpret uncertain changes. Furthermore, the generated report not only identifies the affected functionalities but also includes their Importance Factors (IFs), reflecting their significance within the overall system. This provides valuable insights for conducting change impact analysis--an aspect not addressed by the approach in [37]. This work lays the foundation for building intelligent, secure, and trustworthy IoT infrastructures capable of recognizing uncertain environmental changes and reasoning over potential mitigation strategies based on contextual insights. However, the highly dynamic nature of IoT system operations, along with the diverse techniques employed in  
Figure 9: Generated JSON report (partial) in a structured form for a DDoS_TCP attack scenario. DDoS attacks, makes devising effective mitigation strategies particularly challenging. A comprehensive survey on DDoS mitigation in IoT applications [59] categorizes such attacks into three primary types: (i) application-layer attacks; (ii) resource exhaustion attacks; and (iii) volumetric attacks.