## 4 Proposed Model  
### Proposed Hybrid Model  
In the present study, deceptive patch solutions and window size manipulation represent an innovative hybrid technique developed to prevent and detect cyberattacks. Window size manipulation is a technique for the more effective detection of anomalies and attacks in time series data used in cybersecurity analysis. The addition of noise is often used to increase the robustness and generalization ability of the model. This technique creates fake data that are similar to accurate data, making it more challenging for attackers to access accurate data, thereby increasing the cybersecurity. The proposed model aims to show that deceptive patch solutions and window size manipulation methods can be used in the field of cybersecurity and are complementary to each other. In the context of DoS attacks, window size manipulation can refer to the TCP window size, which determines the amount of data that can be sent before an acknowledgment is received. By manipulating the window size, attackers can potentially amplify their attacks by sending more data without waiting for acknowledgments. Minimal and hardly detectable changes are added to the dataset obtained by applying window size manipulation, rather than classical deceptive patch models with adversarial attacks. In terms of minimal and hardly detectable changes added to the dataset obtained by applying window size manipulation, this could indicate stealthy tactics used by attackers to make their DoS attacks harder to detect. The effects of manipulating the window size are as follows.  
A large window size allows the model to understand a broader context. For example, a large window size in a time series forecast can help the model to learn about long-term dependencies and trends. In contrast, a small window size can help the model to learn more general features because it relies on less contextual information. However, it can also prevent the model from missing critical long-term dependencies or complex structures.  
The interval selection of the window size value is aimed at choosing the appropriate window size for the most accurate result of the model. Effectively adjusting the window size is critical for the early detection of security breaches and the ability to respond accurately. In the training of the created dataset, attention mechanisms, which are among the deep learning models that were previously run on the dataset, were preferred to benefit from the structure of the model, which determines which parts of the input data should be focused on and helps to obtain more accurate and effective results. The training and testing process was performed using the model developed using the attention mechanisms algorithm.  
The model shown in Figure 4 is trained using deceptive patching technology and window size manipulation techniques. Combining these two methods, the hybrid model provides a more comprehensive and flexible cybersecurity solution. This hybrid model can make ICSs more resilient to cyberthreats, while helping cybersecurity experts to manage threats more quickly and effectively.  
The methods used in the proposed framework are explained briefly in the following sections.