# Embedding Security Awareness in IoT Systems: A Framework for Providing Change Impact Insights
## 3 Approach
### IoT DDoS Dataset and DNN Model  
As previously outlined, the testbed incorporates a DL pipeline specifically designed to detect DDoS attacks and generate actionable insights that embed _security awareness_ into the testbed. At the core of this pipeline is a deep neural network (DNN) model, trained using 19 carefully selected features from the Edge-IIoTset dataset [54], which contains labeledIoT network traffic spanning three communication protocols. To optimize detection across different DDoS attack types--namely TCP, UDP, and HTTP--protocol-specific feature subsets were identified based on expert recommendations from [55]. For example, in the case of TCP-based DDoS attacks, which exploit the TCP three-way handshake by flooding the target with SYN packets, a set of critical features (referred to as TCP attributes) is selected, as detailed in Table 1. Corresponding feature sets were also derived for UDP and HTTP-based attacks. The DL pipeline consists of several components starting from _ReceivedNetworkTraffic-Data_, which captures traffic data. For simulation purposes within our testbed environment, traffic instances are passed sequentially from the dataset [54]. Next, _PreprocessNetworkTrafficData_ filters out irrelevant or noisy features from the network traffic instance and only includes the selected 19 features. Categorical variables _like http.request.method_, _http.referer_ are label-encoded to facilitate numerical processing. Continuous features are normalized using the MaxAbsScaler, ensuring efficient training convergence. Finally, the _FeedNetworkTrafficDataToDLModel_ module feeds the preprocessed data into the DNN for inference. The model is trained to classify three distinct DDoS attack types, as summarized in Table 2.  
For DDoS attack detection, we employ a modified ResNet50-1D-CNN model, an adaptation of the well-established ResNet50 architecture tailored for one-dimensional network traffic data. ResNet50 is widely recognized for its deep residual learning capabilities [56], which allow the construction of very deep networks without suffering from vanishing gradient issues. Training is performed over 50 epochs, with early stopping and learning rate reduction applied to prevent overfitting and enhance generalization. The final trained model achieves a high accuracy of 99%, demonstrating strong performance and robustness across different DDoS attack types. We selected this model due to its high detection accuracy and its effectiveness on our dataset. However, this work does not advoc \begin{table}
\begin{tabular}{l l} \hline \hline
**TCP Attributes** & **Description** \\ \hline _tcp.flags_ & Flags \\ \hline _tcp.ack_ & Acknowledgment number \\ \hline _tcp.ack\_raw_ & Acknowledgment number (raw) \\ \hline _tcp.checksum_ & checksum \\ \hline _tcp.seq_ & Sequence number \\ \hline _tcp.flags\_ack_ & Acknowledgment \\ \hline _tcp.len_ & TCP segment length \\ \hline _tcp.connection.syn_ & Connection establish request (SYN) \\ \hline _tcp.connection.rst_ & Connection reset (RST) \\ \hline _tcp.connection.fin_ & Connection finish (FIN) \\ \hline _tcp.connection.synack_ & Connection establish request (SYN + ACK) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: TCP Attribute set. \begin{table}
\begin{tabular}{l l} \hline \hline
**Attack Type** & **Description** \\ \hline TCP SYN Flood DDoS attack & Make the victim’s server unavailable to legitimate requests \\ \hline UDP flood DDoS attack & Overwhelm the processing and response capabilities of victim devices \\ \hline HTTP flood DDoS attack & Exploits seemingly legitimate HTTP GET or POST requests to \\ \cline{2-3}  & attack IoT application \\ \hline \hline \end{tabular}
\end{table} 
Table 2: DDoS Attack Types and Description. cate for ResNet50-1D-CNN as a universal solution. The choice of ML/DL models should be determined by each organization's specific security requirements and the nature of their datasets.