# A Novel, Efficient, and Secure Anomaly Detection Technique Using DWU-ODBN for IoT-Enabled Multimedia Communication Systems

Authors: M. Sathya; M. Jeyaselvi; Lalitha Krishnasamy; Mohammad Mazyad Hazzazi; Prashant Kumar Shukla; Piyush Kumar Shukla; Stephen Jeswinde Nuagah
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

The Internet of Things (IoT) is enhancing our lives in a variety of structures, which consists of smarter cities, agribusiness, and e-healthcare, among others. Even though the Internet of Things has many features with the consumer Internet of Things, the open nature of smart devices and their worldwide connection make IoT networks vulnerable to a variety of assaults. Several approaches focused on attack detection in Internet of Things devices, which has the longest calculation times and the lowest accuracy issues. It is proposed in this paper that an attack detection framework for Internet of Things devices, based on the DWU-ODBN method, be developed to alleviate the existing problems. At the end of the process, the proposed method is used to identify the source of the assault. It comprises steps such as preprocessing, feature extraction, feature selection, and classification to identify the source of the attack. A random oversampler is used to preprocess the input data by dealing with NaN values, categorical features, missing values, and unbalanced datasets before being used to deal with the imbalanced dataset. When the data has been preprocessed, it is then sent to the MAD Median-KS test method, which is used to extract features from the dataset. To categorize the data into attack and nonattack categories, the features are classified using the dual weight updation-based optimal deep belief network (DWU-ODBN) classification technique, which is explained in more detail below. According to the results of the experimental assessment, the proposed approach outperforms existing methods in terms of detecting intrusions and assaults. The proposed work achieves 77 seconds to achieve the attack detection with an accuracy rate of 98.1%.


---

## Body

## 1. Introduction

Considering the rapid development of IoT (Internet of Things) [1] technology, researchers and developers are urged to look at new smart services that can extract vital information from IoT data [2]. When physical objects such as mobile devices, home appliances, vehicles, and buildings are implanted with electronics, software, sensors, and network connectivity, the Internet of Things (IoT) came into effect. The Internet of Things (IoT) enables these objects to collect and exchange data with one another. By using the existing network infrastructure, the Internet of Things allows things to be detected, identified, and controlled from a distance. When the Internet of Things is combined with sensors and actuators, it becomes an example of cyber-physical systems, which also incorporate concepts such as intelligent grids, intelligent homes, intelligent cities, and intelligent transportation systems. The IoT has developed as a highly technical area in the current scenario [3]. In many applications, IoT devices have been implemented, including intelligent vehicles, healthcare, environmental monitoring, and personal wearable devices which have increased the volume, variety, speed, and veracity of data that are handled with connected systems (including sensitive data like personal information) [4–11]. The Internet of Things (IoT) builds on the idea of expanding everyday activities via computing and Internet connections to detect, compute, communicate, and control the environment [5, 6]. Along with the growth of IoT ecosystems, the extent and intensity of adverse actions have increased, focused on the resilience of the system, and thus affected latency-sensitive applications [6]. The poor physical safety of the devices [8] enables inside attacks against IoT nodes. It provides useful suggestions about the safety of industrial IoT systems [9]. As attackers tried to reveal the integrity of data and equipment [10], security issues emerged because of the rapid growth of hacking techniques. However, there will be data anomalies [11] and attacks like man-in-the-middle, message changes, authentication attacks, denial-of-service attacks, replay attacks, and eavesdropping which may threaten the viability of the Internet of Things [12]. The bulk of these attacks are slight differences in previously reported incursions (around 99 percent mutations). Security and privacy problems must be solved before IoT devices can be extensively utilized, especially in mission-critical scenarios involving sensitive data [13]. Anomalies or outliers are uncommon, but they can still be important in the event of a credit card transaction; for example, the aberrant conduct of credit card transactions may suggest that a credit card is stolen, whereas strange network traffic patterns can indicate that illegal network access is available [14]. According to the 2019 threat report SonicWALL, in 2018 in Gatlan (2019), more than 327 million threats from the Internet of Things (IoT) were detected globally [15]. As a consequence, assaults on and detection of abnormalities in IoT infrastructure in the IoT industry become an increasing cause of concern [16].In the past, a wide variety of techniques for attack detection were proposed with various scenarios [17]. Computer algorithms based on artificial intelligence (AI) methods and machine learning (ML) have been extensively used to detect anomalous patterns of traffic in the network. While some excellent work has been done on the security issues related to the Internet of Things [18], many solutions designed to prevent security threats cannot be able to protect from new attacks [19]. Consequently, new kinds of attacks or novel variants in current attacks might not be identified [20]. In this paper, an effective anomaly detection system based on DWU-ODBN is proposed to solve the issues that presently exist. The fundamental goal of this work is to develop a new architecture for the IoTto defeat energy-related threats. A denial-of-sleep attack occurs when the nodes remain awake even when there is no traffic, resulting in the battery’s energy being depleted and the node dying as a result of the assault. The lifespan of the IoT will be reduced as a result of this action. The primary goal of this research endeavour is to develop effective defence approaches for identifying and defending against DDoS attacks to prevent them from occurring. The following are the objectives: A review of different IDS in WSN and MANET, identify the steps for launching a denial-of-service attack, and develop and deploy an innovative technique for identifying and isolating rogue agents. Intruders from inside the network are responsible for the energy drain assaults. Aa DWU-ODBN with intrusion detection and prevention was designed and implemented. Attack prevention is made possible by the introduction of a new malicious node alert (MNA). Nodes in the network are alerted using this strategy. It is necessary to build a method that comprises a lightweight monitoring system module and detector module for detecting and preventing sleep deprivation in IoT.The rest of the paper is organized as follows: Section3 of this article explains the proposed approach, Section 4 of the paper includes a test assessment of the proposed methodology, and Section 5 of the paper ends the study with future improvements.


## 2. Literature Survey

Based on the SDx paradigm, Zarei and Fotohi [21] presented a comprehensive framework for the internet of things software-defined (SD-IoT). In addition to the SD-IoT controller package, the frame contained SD-IoT switches coupled to an IoT gateway and IoT devices connected via an IoT gateway. Then, an algorithm for detecting and mitigating DDoS attacks was created utilizing the SD-IoT platform. The cosine similarity of packet-in message rate vectors at border SD-IoT switch ports has been used to evaluate if DDoS assaults have occurred in the IoT. Last but not least, test results showed that the algorithm provided was very good and the framework offered was changed to enhance security in the Internet of Things while dealing with a variety of vulnerable devices. Since it was intended to be used only with directed vectors, the cosine similarity function could not be utilized for normal values.Liu et al. [22] presented a new safe things architecture internet, in which the ensemble machine learning technique can detect IoT sensor risks based on their results. In an Internet of Things environment, the gradient boosting technique was selected with minimum modifying hyperparameters and applied to identify discriminant attacks. In total, the system included a variety of processes, including internet data collection of the things sensor networks (IoT sensor networks), data clearing (data visualization), vectorization, ensemble learning (ensemble learning), and attack detection. First, the feature selection method was utilized to decrease the dataset size, which improved the attack and detection environment. The feature selection method was then utilized to decrease the dataset size. To get the best results, the ensemble gradient boosting technique was employed after the previous stage with only a little hyperparameter adjusting. Attacks on the environment of the IoT sensor were more correctly identified by the model with an accuracy of 99.40%, precision of 99%, and an F1 scoring of 99%, which showed that the model was more efficient. The ensemble method utilized throughout the process required more time to train for learning.The novel lightweight random neural network (RaNN) prediction model has been suggested according to Latif et al. [23]. The collection and monitoring of datasets were the first stages in developing this architecture. The dataset was compiled and assessed according to its data type at this point. Dataset preprocessing was performed in the following step, including data cleansing, visualization, feature engineering, and vectorization. All of these techniques have been utilized to extract data from the data collection. These characteristic vectors were separated into two groups: a training set and a test set, where the two sets split 80 percent to 20 percent. The recommended random neural network was utilized to study the training set employed along with the proposed random neural network. To investigate RaNN-based prediction model performance, a variety of evaluation parameters were calculated and compared with traditional artificial neural network (ANN) performance, the support vector system (SVM), and decision-tab prediction models (DT). The results of this evaluation showed that the proposed RaNN model achieved a 99.20-percent accuracy with a learning rate of 0.01 and a prediction time of 34.51 milliseconds while training with a learning rate of 0.01. The precision of the system was hindered by the random character of the functioning of the network.Chang et al. [24] presented a three-hierarchy joint local-global anomaly detection framework (HADIoT) that provides Internet of Things devices with sensory information generated and transferred to the local edge servers for local data anomaly recognition including data framing, standardization, analysis of principal components, and symbol mapping. The gated recurrent unit was used to focus local AD on the data consistency of certain devices and then sent the processed data from the edge servers for global AD to the cloud server. In the analysis of data pattern correlations between different Internet of Things devices, which were the focus of global AD, the conditional random fields were used. Simulations using a real dataset, the 2012 Information Security Center of Excellence (ISCX) dataset, were also utilized to evaluate the proposed method’s performance for the study. Compared to three benchmarking schemes, the results of the simulation indicated that the proposed framework has been more effective than the benchmarks in terms of true positive rates, false positive rates, precision, exactness, and F score. Due to the low learning efficiency of the GRU, a longer training time was necessary.Guo et al. [25] investigated uncontrolled anomaly detection on Internet multidimensional time series data of things systems and developed a Gaussian GRU-based VAE mixture technique which, in brief, was called GGM-VAE. Specifically utilized to identify correlations between time series data include the gated recurrent unit (GRU), whereas Gaussian mixture priors were used in latent space to characterize multimodal data, which is subsequently used to find correlations between time series data. During the training phase, further development was undertaken under the Bayesian inference criterion (BIC) to select the model best suited to estimate the latent distribution of the Gaussian mixture. According to the results of extensive simulations carried out on four datasets, the approach detected the latest abnormality. Due to the lack of flexibility in the Gaussian model mixing, many calculation errors occurred when creating the multimodal data.


## 3. Proposed Anomaly Detection System Model

Every security vulnerability of different Internet of Things devices that has been deployed in real time may be very difficult to detect and address. This is because many Internet of Things devices are designed with little attention to their safety implications. It is thus important to create ways to prevent these dangers or attacks and to protect IoT devices from malfunctioning or failure. Current IDS and other attack detection methods could not detect attacks that were started dynamically or during the online procedure. To solve the attack issues, efficient secure anomaly detection has been proposed for an IoT context, as detailed in the article. The proposed system is split into four phases: preprocessing, feature extraction, selection of features, and classification. The first of these procedures is preprocessing. Initially, the input data is handled using four steps called NaN value handling, categorical features, missing values, and an imbalanced dataset. The random sampling method is used to handle the imbalanced dataset. Then, the most important features are chosen from the preprocessed data and compared to the originals using the median absolute deviations in the mid-based Kolmogorov-Smirnov test (MAD Median-KS test). The most important properties are then selected from the gathered functions, using the optimization technique based on robust confidence interval chimp, which is explained in full below (RCI-ChOA). Once this is done, we will apply the selected features to the optimum deep faith network based on dual weight update (DWU-ODBN) to translate the categorized output into the attack and nonattack data. Figure1 shows a block diagram with each block indicating a step.Figure 1
Block diagram of the proposed methodology.


### 3.1. Preprocessing

Initially, the data is preprocessed, which includes handling of NAN values, categorical features, unbalanced datasets, and missing values, which occurs both randomly and nonrandomly. After that, the data is processed further. The preprocessing step assists us in obtaining healthier data while also reducing the difficulties associated with the data, which inhibits the flow of data traffic. The following are the stages involved in the preprocessing process.In handling NaN values, NaN is an abbreviation that stands for “Not a Number,” and it is one of the most often used symbols to indicate a missing value in data. To improve the accuracy of attack detection, the input data for an attack detection system must be devoid of NaN values. The following is the procedure for dealing with NAN values in the input data:(1)dnhandlNaN=ψhand_NaNdn,where dn is the input data, ψhand_NaN is the method that handles the NaN values, and dnhandlNaN is the data obtained after handling of NaN values.In handling categorical features, handling categorical characteristics comes next once dealing with NaN values has been completed successfully. Categorical data must be processed in this phase before it can be fed into the machine learning models, which is the last step. Because machine learning models are considered mathematical models, they will not function properly with data that is stored in the texture format. The categorical characteristics may be handled in the following ways:(2)dnhandlctg=ξhand_ctgdn,where ξhand_ctg denotes the method that handles the categorical data values and dnhandlctg is the data obtained after handling of categories.In handling of missing values, in this step, the missing value at random and the missing values not at random are handled. Missing the values from some subsamples of data is considered as missing values at random. If the missing data has a specific structure, then it is known as missing values, not at random. The missing values can be handled as(3)dnhandlmis_val=ζhand_misran,not‐randn,where ζhand_misran,not‐ran is the method that handles the missing values and dnhandlmis_val is the data obtained after handling of missing values.Thus, the final set of preprocessed data is obtained as(4)dnpp=d1,d2,d3,⋯⋯⋯dN,where dnpp denotes the preprocessed data and N is the number of data. Then, the ratio of attacked and nonattacked data is checked to get the balanced and imbalanced data as
(5)dnpp=dnbalifAdnpp=NAdnpp,dnimbalifAdnpp≠NAdnpp,where dnbal shows the balanced data, dnimbal shows the imbalanced data, A describes the attacked data, and NA describes the nonattacked data. From the obtained data, the balanced data is contributed to the next phase and the imbalanced data is handled using a random over sampler.In handling of imbalanced dataset, here, the imbalanced datadnimbal is balanced with the help of a random oversampler. The random oversampler produces the balanced data using arbitrarily repeating the instances from the minority class and extreme them to the exercise input. The oversampling of data is
(6)dnimbal⟶oversamplingdnbal.After that, the balanced data obtained with the help of oversampling is subjected to the feature extraction phase.


### 3.2. Feature Extraction

Following that, to gain knowledge of the balanced data, the work has developed a median absolute deviation around the median-based Kolmogorov-Smirnov test (MAD Median-KS test) that passages techniques from the net and uses arithmetical examination to detect abnormalities originating from compromised IoT devices. The MAD Median-KS test takes into account the distribution similarity and eliminates the repeated distribution data, and it applies to both continuous and discrete data. It is important to note that the current Kolmogorov-Smirnov test only focuses on the highest difference value, which is affected by outliers and decreases the accuracy of identifying the attack. To get around this, the researchers utilized median absolute deviations around the median in their research.In the MAD median-KS test, the features for the input data is computed as(7)σks=α.Λn∂dnbal−ΛiΓdnbal,where α is the constant that disregards the abnormality induced by the outliers, Λn denotes the median of the distribution functions, ∂,Γ are the two distribution functions of the sample dnbal, Λi is the median of Γ which observes the features of the data. The extracted features such as duration, protocol type, service, flag, root_shell, count, server_count, and etcare denoted as
(8)dnf=d1f1,d1f2,d1f3,.⋯⋯⋯dnfk,where f denotes the number of features extracted from the input data and fk denotes the kth feature of nth data.


### 3.3. Feature Selection

To maintain a superior computational speed and accuracy, the robust confidence interval-based chimp optimization method is used to extract and select important features after feature extraction (RCI-ChOA). The random updation of parameters in the existing chimp optimization algorithm leads to inaccurate model driving and chasing of prey, which results in the selection of features that are not relevant to the problem; therefore, to overcome this problem, the work has used robust confidence interval to update the parameters.The ChOA algorithm simulates the social behavior of individual intelligence as well as the sexual drive of chimpanzees throughout a hunting expedition.According to the retrieved characteristics, the chimp population that lives in a fission-fusion society is divided into four groups: (a) drivers, (b) barriers, (c) chasers, and (d) attackers (see Figure1). This procedure is divided into two phases: the exploration stage and the exploitation stage, which are both important stages in the chimpanzees’ hunting process. The exploration stage consists of driving, blocking, and pursuing, while the exploitation stage consists of assaulting the target and completing the mission.When driving, the drivers simply follow the prey and do not make any effort to capture them. To impede the prey’s entrance, the chimpanzees took up positions in trees and obstructed the prey’s path. If you are pursuing something, you are trying to catch that something. In exploitation, the attackers [26] forecast the most advantageous path to take to assault the victim.The driving and chasing of the prey can be modeled mathematically as(9)R=ν.χpq−ϑ.χcq,(10)χcq+1=χpq−υ.R,where ν and υ are the coefficient vectors ν=2φ2, ϑ is the chaotic vector computed concerning various chaotic maps, and χpq and χcq are the position of the prey and a chimp at the number of current iterations q. The chaotic vector ϑ expresses the effect of the sexual motivation of chimps during the hunting process. The coefficient vectors are calculated as
(11)υ=I2φ1−1,(12)v=2φ2,where I is the parameter that reduces nonlinearly from 2.5 to 0 in both exploration and exploitation stages and φ1,φ2 are the parameters updated using robust confidence intervals Con.IntH,F. The robust confidence intervals are calculated as
(13)Con.IntH,F=med±εγ/2,n−1σn,where γ denotes the confidence coefficient, ε is the percentage point of the confidence interval, σ is the sample standard deviation, and med denotes the sample median. Then, the fitness is evaluated based on the computation time and accuracy of the system.For attacking the prey, the attackers find the position of the prey with the help of a driver, barrier, and chasers. The chimps also attack the prey based on chaotic strategy. Here, two approaches are employed as exploring the location of the prey and encircling the prey. Since the initial position of the prey was unknown, the attacker, driver, barrier, and chaser update the position of the prey. The position updation can be expressed as(14)Rattacker=ν1∗χA−ϑ1∗χ,(15)Rbarrier=ν3∗χB−ϑ3∗χ,(16)Rchaser=ν2∗χCh−ϑ2∗χ,(17)Rdriver=ν4∗χD−ϑ4∗χ.The four optimal solutions are stored, and other chimps are required to update their solutions. If the random vectors ofν lies in 1,−1, then the next position of the chimp can be at any location in the middle of its current position and the position of prey. The location of the chimp can be updated as
(18)χ1=χA−υ1.Rattacker,(19)χ2=χCh−υ2.Rchaser,(20)χ3=χB−υ3.Rbarrier,(21)χ4=χD−υ4.Rdriver.From the obtained locations, the position of the Chimp can be updated as(22)χq+1=χ1+χ2+χ3+χ44.The hunting process of chimps can be affected by social benefits like support and sex. This motivates chimps to forget their contribution to the hunting process. So, the chaotic maps are used in the final stage of attacking the prey which helps chimps to lessen the local optima and slow convergence rate problems. The probability of choosing the normal position updation and chaotic map-based position updation is determined by the parameterη∈0,1 as
(23)χcq+1=χpq+1−ϑ.R,ifη<0.5,ςmpos,ifη>0.5,where ςm denotes the chaotic map-based position updation process. Based on the updated position, the prey has been attacked by the attackers [27]. The hunting process will be stopped when the movement of the prey was stopped. The pseudocode of the RCI-ChOA method is shown in Figure 2,Figure 2
The performance of proposed RCI-ChOA based on fitness vs. iteration.Algorithm1 explains the steps involved in the RCI-ChOA method. In the same way as the hunting behavior of the chimps, the optimal features dnfopt are selected from the extracted features.Algorithm 1: Pseudocode of the RCI-ChOA method
Input: Extracted features dnfOutput: Selected features dnfoptBeginInitialize population dnf, coefficient vectors v,ϑ,υ, maximum number of iterationqmaxCalculate fitness for each chimpsSetq=0Whileq≤qmaxUpdatev,ϑ,υUpdate position using Rattacker, Rchaser, Rbarrier, RdriverEvaluate fitness of the position of chimpsIfμ<0.5&&ν∈0,1 {Update position of the chimps using χpq+1−ϑ.RElse{Update position of the chimps using ςmpos}End ifUpdatev,ϑ,υCalculate fitness of the current position of the chimpSetq=q+1End whileReturn selected features dnfoptEnd


### 3.4. Classification

The last stage involves training and evaluating the selected features over a dual weight updation-based optimal deep belief network (DWU-ODBN) classification system to detect and classify attacks [28]. Semisupervised classification algorithms, in contrast to supervised classification techniques, are capable of coping with adversarial attacks as well as uncertain attacks, which makes them more robust. As a result of the technique’s low error rate as well as its low false alarm rate (FAR), it can detect assaults more quickly and reliably. There are two RBM layers in the DBN, each of which consists of a single observable coating and one concealed coating. There are three RBM layers in the DBN. MLP is composed of three layers: the input layer, a hidden layer, and a final output layer. The input layer is the smallest of the three layers, and it is composed of the hidden layer and the final output layer. Only between the visible layer neurons and the hidden layer neurons does the connection form in DBN; the link does not form between the visible layer neurons and the hidden layer neurons in other words. However, there is no joining amid the visible nerve cell in the brain and the hidden neurons in other parts of the body.Dual weight updation is used to enhance the accuracy of the classification process while simultaneously reducing the error rate of the classification process. Examples of weight updates in the proposed classification technique include stochastic gradient descent with momentum (SGDM), which has a higher convergent rate than gradient descent, and weight updates in the proposed classification technique include the best neighbor direction-based seagull optimization algorithm, which has a higher convergent rate than gradient descent (BND-SOA). Due to inaccuracy in the existing seagull optimization, the construction of the best neighbor direction results in high variance and standard deviation, which may result in poor convergence for updating weight as well as a long computation time for the update weight to be done. To overcome this barrier, the best neighbor direction based on Euclidean distance is determined.The selected characteristics are presented as the input to the visible layer of the first RBM in DBN, which is the visible layer of the first RBM at the start of the simulation. The output of the visible layer is then mapped to the hidden layer of the first RBM, and the process is repeated until the output of the visible layer is no longer visible. These modifications to RBM weights are accomplished via the use of SGDM.(24)ϖi=λϖi−1+1−λG−i,(25)hi+1=hi−τϖi,where λ is the momentum coefficient, τ is the step size, hi+1 is the intermediate model parameter, and G−i is the gradient of the weight values. The output of the hidden layer is expressed as
(26)Φhid_out1=RBs1+∑iΦvis_out1ϖivis_hid1,where R is the activation function, Bs1 represents the bias of the hidden units, Φvis_out1 is the output of the visible layer, and ϖivis_hid1 is the weight values between the visible and hidden neurons using the SGDM method.
(27)Φhid_out2=RBs2+∑iΦhid_out1ϖivis_hid2,where ϖhid_vis is the weight values between the visible and hidden neurons of the second RBM, Φhid_out1 is the output from the previous RBM, and Bs2 denotes the bias of the hidden units. Then, the output obtained from the second RBM is inputted to the MLP.The MLP contains two weight vectors between the input and hidden layer and amid the hidden and output layer. In the MLP layer, the optimal weight values are updated using the BND-SOA method. The SOA method is the inspiration for migrating and attacking behaviors of the seagulls. During migration, a group of seagulls shifts their position to another position. In this migration process, it needs to consider three conditions which are detailed below:(i)
Collision avoidance: to avoid collision between the search agents, the position of the new search agent is computed as(28)DSA=E×CSApz,where E is the variable that represents the search agent’s movement behavior and reduces from its maximum frequency to zero, CSAp denotes the current position of new search agent, and DSA is the position of the search agents which does not involve in collision with other search agents(ii)
The movement regards the best neighbor’s direction: once the collision has been avoided, the search agents move by facing the direction of the best search agent. The movement of the search agents is expressed using the Euclidian distance as(29)MtSA=2×E2×Q∑z=1zmaxCBSAzp−CSAzp2,where Q∈0,1 is the random parameter and CSAzp is the position of search agent towards the position MtSA of the best search agent CBSAzp at z(iii)
Endure close to the best search agent: the position of the search agent is updated regarding the position of the best search agent as(30)LSA=DSA+MtSA,where LSA is the distance between DSA and MtSA.After that, in the attacking action, the seagulls change the speed and angle of attack continuously. The change can be done using their weights and wings and makes spiral movement behavior in the air. The spiral movement behavior is defined inXx,Yy, and Zz plane as
(31)Xx=rad×cosu,(32)Yy=rad×sinu,(33)Zz=rad×u,where each turn in the spiral contains a certain radius and is denoted as rad and u∈0,2π is the random number. Then, the fitness is evaluated based on the error rate of the MLP layer. The updated position can be calculated using the spiraling action as
(34)CSApz=LSA×Xx×Yy×Zz+CBSApz,where CSApz is responsible for storing the best position of the search agents and updating the position of other search agents. In this way, the weight values for the MLP layer ϖiMLP are selected.Concerning the input values, the output of the hidden layer in MLP is denoted as(35)Φhid_outMLP=∑i=1KΦhid_out2ϖiip_hidMLPBsMLP,where ϖiip_hidMLP is the weight value between the input and hidden layers of the MLP, K is the number of neurons in the hidden layer, and Bs2 is the bias of the hidden neuron in MLP. Based on the output of the hidden layer, the output vector is calculated as
(36)Φop_outMLP=∑k=1Kϖkhid_outMLPΦhid_outMLPBi,where ϖkhid_outMLP is the weight value between the hidden and output layer. The output unit contains two classes of data as attack and nonattack. The proposed system detects adversarial attacks and uncertain attacks as well. Adversarial attacks mean the data are modified in such a way that, they cannot be detectable to the human eye.


## 3.1. Preprocessing

Initially, the data is preprocessed, which includes handling of NAN values, categorical features, unbalanced datasets, and missing values, which occurs both randomly and nonrandomly. After that, the data is processed further. The preprocessing step assists us in obtaining healthier data while also reducing the difficulties associated with the data, which inhibits the flow of data traffic. The following are the stages involved in the preprocessing process.In handling NaN values, NaN is an abbreviation that stands for “Not a Number,” and it is one of the most often used symbols to indicate a missing value in data. To improve the accuracy of attack detection, the input data for an attack detection system must be devoid of NaN values. The following is the procedure for dealing with NAN values in the input data:(1)dnhandlNaN=ψhand_NaNdn,where dn is the input data, ψhand_NaN is the method that handles the NaN values, and dnhandlNaN is the data obtained after handling of NaN values.In handling categorical features, handling categorical characteristics comes next once dealing with NaN values has been completed successfully. Categorical data must be processed in this phase before it can be fed into the machine learning models, which is the last step. Because machine learning models are considered mathematical models, they will not function properly with data that is stored in the texture format. The categorical characteristics may be handled in the following ways:(2)dnhandlctg=ξhand_ctgdn,where ξhand_ctg denotes the method that handles the categorical data values and dnhandlctg is the data obtained after handling of categories.In handling of missing values, in this step, the missing value at random and the missing values not at random are handled. Missing the values from some subsamples of data is considered as missing values at random. If the missing data has a specific structure, then it is known as missing values, not at random. The missing values can be handled as(3)dnhandlmis_val=ζhand_misran,not‐randn,where ζhand_misran,not‐ran is the method that handles the missing values and dnhandlmis_val is the data obtained after handling of missing values.Thus, the final set of preprocessed data is obtained as(4)dnpp=d1,d2,d3,⋯⋯⋯dN,where dnpp denotes the preprocessed data and N is the number of data. Then, the ratio of attacked and nonattacked data is checked to get the balanced and imbalanced data as
(5)dnpp=dnbalifAdnpp=NAdnpp,dnimbalifAdnpp≠NAdnpp,where dnbal shows the balanced data, dnimbal shows the imbalanced data, A describes the attacked data, and NA describes the nonattacked data. From the obtained data, the balanced data is contributed to the next phase and the imbalanced data is handled using a random over sampler.In handling of imbalanced dataset, here, the imbalanced datadnimbal is balanced with the help of a random oversampler. The random oversampler produces the balanced data using arbitrarily repeating the instances from the minority class and extreme them to the exercise input. The oversampling of data is
(6)dnimbal⟶oversamplingdnbal.After that, the balanced data obtained with the help of oversampling is subjected to the feature extraction phase.


## 3.2. Feature Extraction

Following that, to gain knowledge of the balanced data, the work has developed a median absolute deviation around the median-based Kolmogorov-Smirnov test (MAD Median-KS test) that passages techniques from the net and uses arithmetical examination to detect abnormalities originating from compromised IoT devices. The MAD Median-KS test takes into account the distribution similarity and eliminates the repeated distribution data, and it applies to both continuous and discrete data. It is important to note that the current Kolmogorov-Smirnov test only focuses on the highest difference value, which is affected by outliers and decreases the accuracy of identifying the attack. To get around this, the researchers utilized median absolute deviations around the median in their research.In the MAD median-KS test, the features for the input data is computed as(7)σks=α.Λn∂dnbal−ΛiΓdnbal,where α is the constant that disregards the abnormality induced by the outliers, Λn denotes the median of the distribution functions, ∂,Γ are the two distribution functions of the sample dnbal, Λi is the median of Γ which observes the features of the data. The extracted features such as duration, protocol type, service, flag, root_shell, count, server_count, and etcare denoted as
(8)dnf=d1f1,d1f2,d1f3,.⋯⋯⋯dnfk,where f denotes the number of features extracted from the input data and fk denotes the kth feature of nth data.


## 3.3. Feature Selection

To maintain a superior computational speed and accuracy, the robust confidence interval-based chimp optimization method is used to extract and select important features after feature extraction (RCI-ChOA). The random updation of parameters in the existing chimp optimization algorithm leads to inaccurate model driving and chasing of prey, which results in the selection of features that are not relevant to the problem; therefore, to overcome this problem, the work has used robust confidence interval to update the parameters.The ChOA algorithm simulates the social behavior of individual intelligence as well as the sexual drive of chimpanzees throughout a hunting expedition.According to the retrieved characteristics, the chimp population that lives in a fission-fusion society is divided into four groups: (a) drivers, (b) barriers, (c) chasers, and (d) attackers (see Figure1). This procedure is divided into two phases: the exploration stage and the exploitation stage, which are both important stages in the chimpanzees’ hunting process. The exploration stage consists of driving, blocking, and pursuing, while the exploitation stage consists of assaulting the target and completing the mission.When driving, the drivers simply follow the prey and do not make any effort to capture them. To impede the prey’s entrance, the chimpanzees took up positions in trees and obstructed the prey’s path. If you are pursuing something, you are trying to catch that something. In exploitation, the attackers [26] forecast the most advantageous path to take to assault the victim.The driving and chasing of the prey can be modeled mathematically as(9)R=ν.χpq−ϑ.χcq,(10)χcq+1=χpq−υ.R,where ν and υ are the coefficient vectors ν=2φ2, ϑ is the chaotic vector computed concerning various chaotic maps, and χpq and χcq are the position of the prey and a chimp at the number of current iterations q. The chaotic vector ϑ expresses the effect of the sexual motivation of chimps during the hunting process. The coefficient vectors are calculated as
(11)υ=I2φ1−1,(12)v=2φ2,where I is the parameter that reduces nonlinearly from 2.5 to 0 in both exploration and exploitation stages and φ1,φ2 are the parameters updated using robust confidence intervals Con.IntH,F. The robust confidence intervals are calculated as
(13)Con.IntH,F=med±εγ/2,n−1σn,where γ denotes the confidence coefficient, ε is the percentage point of the confidence interval, σ is the sample standard deviation, and med denotes the sample median. Then, the fitness is evaluated based on the computation time and accuracy of the system.For attacking the prey, the attackers find the position of the prey with the help of a driver, barrier, and chasers. The chimps also attack the prey based on chaotic strategy. Here, two approaches are employed as exploring the location of the prey and encircling the prey. Since the initial position of the prey was unknown, the attacker, driver, barrier, and chaser update the position of the prey. The position updation can be expressed as(14)Rattacker=ν1∗χA−ϑ1∗χ,(15)Rbarrier=ν3∗χB−ϑ3∗χ,(16)Rchaser=ν2∗χCh−ϑ2∗χ,(17)Rdriver=ν4∗χD−ϑ4∗χ.The four optimal solutions are stored, and other chimps are required to update their solutions. If the random vectors ofν lies in 1,−1, then the next position of the chimp can be at any location in the middle of its current position and the position of prey. The location of the chimp can be updated as
(18)χ1=χA−υ1.Rattacker,(19)χ2=χCh−υ2.Rchaser,(20)χ3=χB−υ3.Rbarrier,(21)χ4=χD−υ4.Rdriver.From the obtained locations, the position of the Chimp can be updated as(22)χq+1=χ1+χ2+χ3+χ44.The hunting process of chimps can be affected by social benefits like support and sex. This motivates chimps to forget their contribution to the hunting process. So, the chaotic maps are used in the final stage of attacking the prey which helps chimps to lessen the local optima and slow convergence rate problems. The probability of choosing the normal position updation and chaotic map-based position updation is determined by the parameterη∈0,1 as
(23)χcq+1=χpq+1−ϑ.R,ifη<0.5,ςmpos,ifη>0.5,where ςm denotes the chaotic map-based position updation process. Based on the updated position, the prey has been attacked by the attackers [27]. The hunting process will be stopped when the movement of the prey was stopped. The pseudocode of the RCI-ChOA method is shown in Figure 2,Figure 2
The performance of proposed RCI-ChOA based on fitness vs. iteration.Algorithm1 explains the steps involved in the RCI-ChOA method. In the same way as the hunting behavior of the chimps, the optimal features dnfopt are selected from the extracted features.Algorithm 1: Pseudocode of the RCI-ChOA method
Input: Extracted features dnfOutput: Selected features dnfoptBeginInitialize population dnf, coefficient vectors v,ϑ,υ, maximum number of iterationqmaxCalculate fitness for each chimpsSetq=0Whileq≤qmaxUpdatev,ϑ,υUpdate position using Rattacker, Rchaser, Rbarrier, RdriverEvaluate fitness of the position of chimpsIfμ<0.5&&ν∈0,1 {Update position of the chimps using χpq+1−ϑ.RElse{Update position of the chimps using ςmpos}End ifUpdatev,ϑ,υCalculate fitness of the current position of the chimpSetq=q+1End whileReturn selected features dnfoptEnd


## 3.4. Classification

The last stage involves training and evaluating the selected features over a dual weight updation-based optimal deep belief network (DWU-ODBN) classification system to detect and classify attacks [28]. Semisupervised classification algorithms, in contrast to supervised classification techniques, are capable of coping with adversarial attacks as well as uncertain attacks, which makes them more robust. As a result of the technique’s low error rate as well as its low false alarm rate (FAR), it can detect assaults more quickly and reliably. There are two RBM layers in the DBN, each of which consists of a single observable coating and one concealed coating. There are three RBM layers in the DBN. MLP is composed of three layers: the input layer, a hidden layer, and a final output layer. The input layer is the smallest of the three layers, and it is composed of the hidden layer and the final output layer. Only between the visible layer neurons and the hidden layer neurons does the connection form in DBN; the link does not form between the visible layer neurons and the hidden layer neurons in other words. However, there is no joining amid the visible nerve cell in the brain and the hidden neurons in other parts of the body.Dual weight updation is used to enhance the accuracy of the classification process while simultaneously reducing the error rate of the classification process. Examples of weight updates in the proposed classification technique include stochastic gradient descent with momentum (SGDM), which has a higher convergent rate than gradient descent, and weight updates in the proposed classification technique include the best neighbor direction-based seagull optimization algorithm, which has a higher convergent rate than gradient descent (BND-SOA). Due to inaccuracy in the existing seagull optimization, the construction of the best neighbor direction results in high variance and standard deviation, which may result in poor convergence for updating weight as well as a long computation time for the update weight to be done. To overcome this barrier, the best neighbor direction based on Euclidean distance is determined.The selected characteristics are presented as the input to the visible layer of the first RBM in DBN, which is the visible layer of the first RBM at the start of the simulation. The output of the visible layer is then mapped to the hidden layer of the first RBM, and the process is repeated until the output of the visible layer is no longer visible. These modifications to RBM weights are accomplished via the use of SGDM.(24)ϖi=λϖi−1+1−λG−i,(25)hi+1=hi−τϖi,where λ is the momentum coefficient, τ is the step size, hi+1 is the intermediate model parameter, and G−i is the gradient of the weight values. The output of the hidden layer is expressed as
(26)Φhid_out1=RBs1+∑iΦvis_out1ϖivis_hid1,where R is the activation function, Bs1 represents the bias of the hidden units, Φvis_out1 is the output of the visible layer, and ϖivis_hid1 is the weight values between the visible and hidden neurons using the SGDM method.
(27)Φhid_out2=RBs2+∑iΦhid_out1ϖivis_hid2,where ϖhid_vis is the weight values between the visible and hidden neurons of the second RBM, Φhid_out1 is the output from the previous RBM, and Bs2 denotes the bias of the hidden units. Then, the output obtained from the second RBM is inputted to the MLP.The MLP contains two weight vectors between the input and hidden layer and amid the hidden and output layer. In the MLP layer, the optimal weight values are updated using the BND-SOA method. The SOA method is the inspiration for migrating and attacking behaviors of the seagulls. During migration, a group of seagulls shifts their position to another position. In this migration process, it needs to consider three conditions which are detailed below:(i)
Collision avoidance: to avoid collision between the search agents, the position of the new search agent is computed as(28)DSA=E×CSApz,where E is the variable that represents the search agent’s movement behavior and reduces from its maximum frequency to zero, CSAp denotes the current position of new search agent, and DSA is the position of the search agents which does not involve in collision with other search agents(ii)
The movement regards the best neighbor’s direction: once the collision has been avoided, the search agents move by facing the direction of the best search agent. The movement of the search agents is expressed using the Euclidian distance as(29)MtSA=2×E2×Q∑z=1zmaxCBSAzp−CSAzp2,where Q∈0,1 is the random parameter and CSAzp is the position of search agent towards the position MtSA of the best search agent CBSAzp at z(iii)
Endure close to the best search agent: the position of the search agent is updated regarding the position of the best search agent as(30)LSA=DSA+MtSA,where LSA is the distance between DSA and MtSA.After that, in the attacking action, the seagulls change the speed and angle of attack continuously. The change can be done using their weights and wings and makes spiral movement behavior in the air. The spiral movement behavior is defined inXx,Yy, and Zz plane as
(31)Xx=rad×cosu,(32)Yy=rad×sinu,(33)Zz=rad×u,where each turn in the spiral contains a certain radius and is denoted as rad and u∈0,2π is the random number. Then, the fitness is evaluated based on the error rate of the MLP layer. The updated position can be calculated using the spiraling action as
(34)CSApz=LSA×Xx×Yy×Zz+CBSApz,where CSApz is responsible for storing the best position of the search agents and updating the position of other search agents. In this way, the weight values for the MLP layer ϖiMLP are selected.Concerning the input values, the output of the hidden layer in MLP is denoted as(35)Φhid_outMLP=∑i=1KΦhid_out2ϖiip_hidMLPBsMLP,where ϖiip_hidMLP is the weight value between the input and hidden layers of the MLP, K is the number of neurons in the hidden layer, and Bs2 is the bias of the hidden neuron in MLP. Based on the output of the hidden layer, the output vector is calculated as
(36)Φop_outMLP=∑k=1Kϖkhid_outMLPΦhid_outMLPBi,where ϖkhid_outMLP is the weight value between the hidden and output layer. The output unit contains two classes of data as attack and nonattack. The proposed system detects adversarial attacks and uncertain attacks as well. Adversarial attacks mean the data are modified in such a way that, they cannot be detectable to the human eye.


## 4. Results and Discussion

In this part, the efficacy of the suggested irregularity discovery outline for use in the Net of Belongings setting is assessed using case studies. The experiments for assessing the suggested system are carried out using the Python programming language’s working platform.


### 4.1. Database Description

The NSL-KDDCUP99 dataset is utilized in this study for experimental assessment. KDD Cup’99 is a dataset that is often used in the development of intrusion detection systems. Per network connection, the dataset includes a total of 41 characteristics. The characteristics are divided into several categories. Eighty percent of the data in the dataset is utilized for training, whereas only twenty percent of the data is used for testing.


### 4.2. Performance Evaluation of Feature Selection Technique

Based on the fitness vs. iteration trade-off, this section evaluates the performance of the proposed RCI-ChOA technique. The suggested technique is compared to the current SPA, SSO, particle swarm optimization (PSO), and chimp optimization algorithm (ChOA) methods to determine its suitability for the task at hand.In discussion, fitness versus iteration is used to assess the performance of the proposed and current techniques, as shown in Table1. The number of iterations required for the analysis is shown in Table 1 and ranges from 10 to 50. The suggested technique has a fitness value of 129 for the 10 number iterations that are included in the analysis. For 10 iterations, the current SSO and PSO techniques have fitness values of 82 and 86, respectively, while the existing SPA and ChOA methods have fitness values of 73 and 110, respectively. When the suggested technique is evaluated for its fitness throughout the remaining number of iterations, it scores 152 for 20 iterations, 178 for 30 iterations, 198 for 40 iterations, and 210 for 50 iterations, according to the findings. According to the suggested approach, current methods have poorer fitness for the number of iterations in comparison to the new method. The discussion demonstrates that the suggested approach outperforms the current methods in terms of overall performance. Figure 2 depicts a graphical depiction of the fitness versus iteration analysis in terms of fitness,Table 1
Evaluation of proposed RCI-ChOA based on fitness vs. iteration.
Techniques/iteration1020304050SPA73106121137162SSO82111129146170PSO86108140153181ChOA110137144175188Proposed RCI-ChOA129152178198210


### 4.3. Performance Evaluation of Classification Technique

The accuracy, sensitivity, specificity, precision,F measure, FPR, FNR, and MCC of the proposed DWU-ODBN technique are compared to the current ENN, CNN, SVM, and DBN methods in this section, as well as the existing ENN, CNN, SVM, and DBN methods. Following that, a comparison of the calculation time and attack detection time of the proposed and current techniques is provided.In discussion, several quality indicators are used to assess the presence of the planned and current techniques, which are summarised in Table2. For a classifier to be efficient, its accuracy, sensitivity, specificity, precision, F measure, and MCC values should all be greater than their current levels. The FPR and FNR are negative numbers that are often lower to achieve better categorization. As seen in the above table, the current SVM achieves low-level performance. Additionally, the current ENN, CNN, and DBN techniques have medium-level performance, according to the researchers. However, the suggested DWU-ODBN approach outperforms all other methods in terms of performance measures. In addition, it should be highlighted that the suggested approach exhibits improvement across all measures and outperforms the current ENN, CNN, SVM, and DBN methods in terms of overall performance.Table 2
Performance analysis of proposed DWU-ODBN based on quality metrics.
Performance metrics/techniquesENNCNNSVMDBNProposed DWU-ODBNAccuracy92.1491.5194.8493.2697.34Specificity86.6787.5785.8293.3993.42Sensitivity89.6990.4885.5491.6295.61Precision92.3790.6287.6395.8397.43F measures93.5293.3989.2994.6297.72FPR46.4644.2559.4231.5111.04FNR42.9349.6456.5838.588.39MCC85.4482.8780.5288.2894.65In discussion, in the above Figure3, the accuracy, sensitivity, specificity, and precision of the proposed and current techniques are evaluated about one another. The proposed method achieves classification accuracy of 97.34 percent, whereas the existing ENN, CNN, SVM, and DBN methods achieve accuracy of 92.14 percent, 91.51 percent, 94.84 percent, and 93.26 percent, respectively, which is lower than the proposed DWU-ODBN method. The proposed method outperforms the existing methods by a wide margin. The suggested approach also has better sensitivity, specificity, and precision than the current methods, with 95.61 percent, 93.42 percent, and 97.43 percent, respectively, compared to the existing methods. It is apparent from the above study that the suggested DWU-ODBN technique outdoes the other current methods in terms of overall performance.Figure 3
The performance analysis of the proposed DWU-ODBN based on accuracy, specificity, sensitivity, and precision.In discussion, on the right, you can see how the proposed and current techniques compare in terms of F measure, FPR, FNR, and MCC in Figure 4. While the proposed method has an FPR of 11.04 percent and an FNR of 8.39 percent, existing ENN, CNN, SVM, and DBN methods have FPRs of 46.46 percent, 44.25 percent, 59.42 percent, and 31.51 percent, respectively, and FNRs of 42.93 percent, 49.64 percent, 56.58 percent, and 38.58 percent, respectively, which are higher than the proposed DWU-ODBN method. Similarly, the F measure and MCC of the suggested approach are 97.72 percent and 94.65 percent, respectively, which are greater than those of the current methods. According to the findings of the preceding study, the suggested approach produces superior outcomes for all metrics than the current methods.Figure 4
The performance of the proposed DWU-ODBN concerningF measure, FRR, FNR, and MCC.In discussion, Figure5 compares the detection rates of the proposed and current techniques for detecting attacks. This study estimates the rate at which attacks are detected for two types of information: attack data and nonattack data. For the assault data, the proposed approach achieves a detection rate of 98.06 percent, while the current methods achieve a detection rate of 76.25 percent for ENN, 88.29 percent for CNN, 77.15 percent for SVM, and 86.36 percent for DBN, respectively. The suggested approach obtains a detection rate of 99.88 percent in the case of data that is not subjected to an assault. In comparison, the current ENN, CNN, SVM, and DBN techniques obtained rates of 77.76 percent, 87.56 percent, 78.65 percent, and 90.60 percent in the study, respectively. According to the results of the study, the suggested approach achieved the greatest detection rate for both attack data and nonattack data, whereas the detection rates of the current methods were much lower than the proposed method’s detection rate. According to the results of the study, the suggested approach outperforms the current methods in terms of performance.Figure 5
The attack detection rate of the proposed and existing methods.In discussion, Figure6 compares the calculation times of the proposed DWU-ODBN technique with those of the current ENN, CNN, SVM, and DBN methods, among others. The study is carried out on several different datasets, including KDD99, NSL-KDDCUP99, CIDDS-001, and UNSW-NB15. The calculation time should be kept to a minimum for an efficient classifier. The suggested approach takes 77 seconds to compute for the KDD99 dataset, 78 seconds to compute for the NSL-KDDCU99 dataset, 71 seconds to compute for the CIDDS-001 dataset, and 62 seconds to compute for the UNSW-NB15 dataset. When compared to the suggested approach, the current methods need a longer calculation time for all datasets. The results of the study indicate that the suggested approach is more effective at detecting assaults than the already available techniques.Figure 6
The computation time of the proposed and existing methods.The result and analysis consider the feature selection, classification based on the performance metrics such as accuracy, sensitivity, specificity, precision,F measure, FPR, FNR, and MCC, attack detection rate, and computation time. These parameters were broadly compared against existing techniques. Further, the parameters would be designed based on the real-time scenario. This will be incorporated in the future work of this article.


## 4.1. Database Description

The NSL-KDDCUP99 dataset is utilized in this study for experimental assessment. KDD Cup’99 is a dataset that is often used in the development of intrusion detection systems. Per network connection, the dataset includes a total of 41 characteristics. The characteristics are divided into several categories. Eighty percent of the data in the dataset is utilized for training, whereas only twenty percent of the data is used for testing.


## 4.2. Performance Evaluation of Feature Selection Technique

Based on the fitness vs. iteration trade-off, this section evaluates the performance of the proposed RCI-ChOA technique. The suggested technique is compared to the current SPA, SSO, particle swarm optimization (PSO), and chimp optimization algorithm (ChOA) methods to determine its suitability for the task at hand.In discussion, fitness versus iteration is used to assess the performance of the proposed and current techniques, as shown in Table1. The number of iterations required for the analysis is shown in Table 1 and ranges from 10 to 50. The suggested technique has a fitness value of 129 for the 10 number iterations that are included in the analysis. For 10 iterations, the current SSO and PSO techniques have fitness values of 82 and 86, respectively, while the existing SPA and ChOA methods have fitness values of 73 and 110, respectively. When the suggested technique is evaluated for its fitness throughout the remaining number of iterations, it scores 152 for 20 iterations, 178 for 30 iterations, 198 for 40 iterations, and 210 for 50 iterations, according to the findings. According to the suggested approach, current methods have poorer fitness for the number of iterations in comparison to the new method. The discussion demonstrates that the suggested approach outperforms the current methods in terms of overall performance. Figure 2 depicts a graphical depiction of the fitness versus iteration analysis in terms of fitness,Table 1
Evaluation of proposed RCI-ChOA based on fitness vs. iteration.
Techniques/iteration1020304050SPA73106121137162SSO82111129146170PSO86108140153181ChOA110137144175188Proposed RCI-ChOA129152178198210


## 4.3. Performance Evaluation of Classification Technique

The accuracy, sensitivity, specificity, precision,F measure, FPR, FNR, and MCC of the proposed DWU-ODBN technique are compared to the current ENN, CNN, SVM, and DBN methods in this section, as well as the existing ENN, CNN, SVM, and DBN methods. Following that, a comparison of the calculation time and attack detection time of the proposed and current techniques is provided.In discussion, several quality indicators are used to assess the presence of the planned and current techniques, which are summarised in Table2. For a classifier to be efficient, its accuracy, sensitivity, specificity, precision, F measure, and MCC values should all be greater than their current levels. The FPR and FNR are negative numbers that are often lower to achieve better categorization. As seen in the above table, the current SVM achieves low-level performance. Additionally, the current ENN, CNN, and DBN techniques have medium-level performance, according to the researchers. However, the suggested DWU-ODBN approach outperforms all other methods in terms of performance measures. In addition, it should be highlighted that the suggested approach exhibits improvement across all measures and outperforms the current ENN, CNN, SVM, and DBN methods in terms of overall performance.Table 2
Performance analysis of proposed DWU-ODBN based on quality metrics.
Performance metrics/techniquesENNCNNSVMDBNProposed DWU-ODBNAccuracy92.1491.5194.8493.2697.34Specificity86.6787.5785.8293.3993.42Sensitivity89.6990.4885.5491.6295.61Precision92.3790.6287.6395.8397.43F measures93.5293.3989.2994.6297.72FPR46.4644.2559.4231.5111.04FNR42.9349.6456.5838.588.39MCC85.4482.8780.5288.2894.65In discussion, in the above Figure3, the accuracy, sensitivity, specificity, and precision of the proposed and current techniques are evaluated about one another. The proposed method achieves classification accuracy of 97.34 percent, whereas the existing ENN, CNN, SVM, and DBN methods achieve accuracy of 92.14 percent, 91.51 percent, 94.84 percent, and 93.26 percent, respectively, which is lower than the proposed DWU-ODBN method. The proposed method outperforms the existing methods by a wide margin. The suggested approach also has better sensitivity, specificity, and precision than the current methods, with 95.61 percent, 93.42 percent, and 97.43 percent, respectively, compared to the existing methods. It is apparent from the above study that the suggested DWU-ODBN technique outdoes the other current methods in terms of overall performance.Figure 3
The performance analysis of the proposed DWU-ODBN based on accuracy, specificity, sensitivity, and precision.In discussion, on the right, you can see how the proposed and current techniques compare in terms of F measure, FPR, FNR, and MCC in Figure 4. While the proposed method has an FPR of 11.04 percent and an FNR of 8.39 percent, existing ENN, CNN, SVM, and DBN methods have FPRs of 46.46 percent, 44.25 percent, 59.42 percent, and 31.51 percent, respectively, and FNRs of 42.93 percent, 49.64 percent, 56.58 percent, and 38.58 percent, respectively, which are higher than the proposed DWU-ODBN method. Similarly, the F measure and MCC of the suggested approach are 97.72 percent and 94.65 percent, respectively, which are greater than those of the current methods. According to the findings of the preceding study, the suggested approach produces superior outcomes for all metrics than the current methods.Figure 4
The performance of the proposed DWU-ODBN concerningF measure, FRR, FNR, and MCC.In discussion, Figure5 compares the detection rates of the proposed and current techniques for detecting attacks. This study estimates the rate at which attacks are detected for two types of information: attack data and nonattack data. For the assault data, the proposed approach achieves a detection rate of 98.06 percent, while the current methods achieve a detection rate of 76.25 percent for ENN, 88.29 percent for CNN, 77.15 percent for SVM, and 86.36 percent for DBN, respectively. The suggested approach obtains a detection rate of 99.88 percent in the case of data that is not subjected to an assault. In comparison, the current ENN, CNN, SVM, and DBN techniques obtained rates of 77.76 percent, 87.56 percent, 78.65 percent, and 90.60 percent in the study, respectively. According to the results of the study, the suggested approach achieved the greatest detection rate for both attack data and nonattack data, whereas the detection rates of the current methods were much lower than the proposed method’s detection rate. According to the results of the study, the suggested approach outperforms the current methods in terms of performance.Figure 5
The attack detection rate of the proposed and existing methods.In discussion, Figure6 compares the calculation times of the proposed DWU-ODBN technique with those of the current ENN, CNN, SVM, and DBN methods, among others. The study is carried out on several different datasets, including KDD99, NSL-KDDCUP99, CIDDS-001, and UNSW-NB15. The calculation time should be kept to a minimum for an efficient classifier. The suggested approach takes 77 seconds to compute for the KDD99 dataset, 78 seconds to compute for the NSL-KDDCU99 dataset, 71 seconds to compute for the CIDDS-001 dataset, and 62 seconds to compute for the UNSW-NB15 dataset. When compared to the suggested approach, the current methods need a longer calculation time for all datasets. The results of the study indicate that the suggested approach is more effective at detecting assaults than the already available techniques.Figure 6
The computation time of the proposed and existing methods.The result and analysis consider the feature selection, classification based on the performance metrics such as accuracy, sensitivity, specificity, precision,F measure, FPR, FNR, and MCC, attack detection rate, and computation time. These parameters were broadly compared against existing techniques. Further, the parameters would be designed based on the real-time scenario. This will be incorporated in the future work of this article.


## 5. Conclusion

Typically, IoT devices are resource-constrained, and those that do have the limited onboard capability for security operations may result in data breaches due to a lack of available functionality. In turn, it makes it more difficult for the system to detect cyberattacks from the network promptly before they impair smart city operations. This article presents a dual weight updating-based optimum deep belief network for attack detection to protect Internet of Things devices from a variety of security threats. The suggested technique is divided into four stages. It is essential to evaluate the presentation of the suggested system in command to use the KDD99 dataset. It is determined how well the suggested RCU-ChOA and DWU-ODBN techniques perform when compared to the already available methods. Although the suggested DWU-ODBN technique is more accurate than the current methods, the accuracy of the proposed method is greater than that of the existing methods. The suggested system has a calculation time of 77 seconds, which is much shorter than the current techniques. In this way, it is concluded that the suggested method outstrips the present approaches in footings of performance. The proposed system attains a 98% accuracy rate in detecting the attack from the malicious node. As we compared various dataset analyses through our proposed work, the proposed work detects the attack within 71 seconds. The proposed method achieves classification accuracy of 97.34 percent, whereas the existing ENN, CNN, SVM, and DBN methods achieve accuracy of 92.14 percent, 91.51 percent, 94.84 percent, and 93.26 percent, respectively, which is lower than the proposed DWU-ODBN method.



---

*Source: 4989410-2021-12-14.xml*