## 5 Experimental Design Analysis of Results
### Training-Building a Model  
Features in the NSL-KDD dataset represent following characteristics: (i) basic TCP connection, (ii) packet content features, (iii) time window-based traffic features. The aforementioned study [30] used the following features for the experiments (id - feature name): _6-dst_bytes_, _41-dst_host_srv_rer_rate_, _10-hot_, _12-logged_in_, _14-root_shell_, _22-is_guest_login_, _29-same_srv_rate_, _37-dst_host_srv_diff_host_rate_, _5-src_bytes_. Two types of the most common traffic found in the dataset were selected: _\"normal\"_--Class ID 0 and _\"neptune\"_ (sub-type of DOS)--Class ID 1. For _software part_, _ArduinoANN_ implementation [46] (on Arduino IDE v1.8.9) of neural network was used with the following parameters: training epochs-max \(2^{32-1}\), learning rate = 0.3, momentum = 0.9, input nodes = 9, hidden nodes = 5, weights initialization = 0.5, error threshold = 0.001. The original implementation was designed to recognize binary data from digits on LCD array to number, while it was extended to be able to handle real-valued data from KDD dataset. For _hardware part_, Arduino Uno Rev3 board and USBtinyISP programmer with connection at 9600 haud rate for serial monitor was utilized. The _space complexity_ evaluation is given in Table 2 and basically represents that the training data are stored as 20 data samples with 9 features in 4-Byte real value and a class label in 2-Byte integer. In reality, the difference between storing 2 samples and  
Figure 3: Example of space and computational complexity of single-layer ANN. 20 samples will be equal to 720 Bytes/18 = 40 Bytes per each network packet stored in the memory for the model training. The main limitation at the training phase is the limited amount of SRAM (2 KBytes). Table 3 demonstrates the performance evaluation and time complexity of different epochs. It took 1 second and 326 milliseconds to train the ANN model with 16 epochs (until the error threshold has been reached). The _micros()_ function was used to measure the time. To thoroughly evaluate the performance, we utilized the training error calculation function during each training epoch in the Neural Network: \(E=\frac{1}{2\cdot M}\cdot\sum_{i=1}^{M}(y_{target}^{i}-y_{actual}^{i})^{2}\) with error terminating criteria: \(\epsilon=10^{-3}\). This is similar to regression-based loss function Mean Square Error (MSE) used in popular Keras library [51] for any type of classification problems. Such an approach gives a better understanding of per-epoch performance improvement in comparison to conventional classification-based metrics such that accuracy where one would need to utilize _round()_ function to approximately determine where the tested sample belongs to Class 0 or Class 1. This is a proof-of-concept work and we believe that setting higher values of \(\epsilon\) will have a negative impact on the stopping criteria in a real-world case with erroneous and imprecise data. Furthermore, this helps to take into consideration the trade-off between accuracy and training time as some of the real-world problems cannot guarantee 100% accuracy while using the Machine Learning community-accepted ANN method. In this work, we did not focus on the performance aspects of ANN as this was heavily tested and validated before. However, we can state that the main parameters that generally influence the performance and training time are number of training epochs \(M\), training error threshold \(\epsilon\) and number of layers in the neural network. As of now, ANN implementation for Arduino UNO Rev3 cannot incorporate higher complexity due to the resource-constrained environment issues with the memory considerations stated in Table 2. Having a bigger size of memory would allow utilization of more advanced ML techniques. So, it can be seen that ANN can be trained on Arduino UNO Rev3 with limited training data in a reasonable amount of time.