Safety assessment model for DoS attacks detection in wireless communication and network OS environments

Abstract

Wireless networks and communications have witnessed tremendous development and growth in recent periods and up until now, as there is a group of diverse networks such as the well-known wireless communication networks and others that are not linked to an infrastructure such as telephone networks, sensors and wireless networks, especially in important applications that work to send and receive important data and information in relatively unsafe environments, cybersecurity technologies pose an important challenge in protecting unsafe networks in terms of their impact on reducing crime. Detecting hacking in electronic networks and penetration testing. Therefore, these environments must be monitored and protected from hacking and malicious attacks. In this manuscript, a correspondence model is designed to discuss the algorithm in the environment of wireless communication systems and distributed computing by adopting the protocol data enhancement to the network using structured construction and diversity algorithm to improve the effectiveness of the intrusion detection system. Next, a multi-label convolutional neural network model is used to detect business transactions. An CNN was trained on the WSN-DS dataset using 5-Fold in CV technique with three hidden layers. The highest Precision values 0.951 of Grayhole attack for multi-classification.

Keywords

Wireless communications networks DoS attacks CNN cybersecurity

1. Introduction

With the increasing use of communication and networking software, the security assessment of computer network environment and operating systems - where most users of networked computers need to secure their data in the client and server environment.^1–3 The networking and communication applications has raised many concerns about the possibility of threatening the networks used and violating the security and privacy of data and information.^4,5

Due to the special use of Internet applications over computer networks, cyber-attacks and the use of unauthorized applications have increased. This increase has posed a threat to the availability of the service and consumer privacy.^6,7 The main goal of designing network intrusion detection systems (IDS) is to detect anomalous traffic behaviors that firewalls may not be able to detect.⁸

Machine learning algorithms and deep learning are the basic material and IDS in networks. Because it is important, the dependency is more important in discovering the tools used and alerting the attack in the stations of the properties in the place that contains the data to detect the intrusion.⁹ For this reason, the procedure of selecting characters and important infections.¹⁰ The system is located on an important page in the pre-classification and detection stage, without the wrong selection of features causing incomplete results, without active feature selection algorithms as more important. IDS are divided into three main types: signature-based protection systems, network anomaly detection systems, and hybrid detection systems of the two types mentioned above.¹¹

Anomaly-based IDS excel at detecting zero-day attacks by identifying behaviors that deviate from established normal activities. However, their effectiveness in detecting known attacks is generally lower compared to signature-based systems. To address the limitations of both approaches, hybrid IDS have been developed. These systems combine the strengths of both signature-based and anomaly-based methods, allowing them to detect both known and unknown threats.¹²

A network sequence detection system was adopted using machine learning and neural network methodologies, which is important in the field of IDS. Machine learning techniques have recently emerged as promising solutions for the development of IDS. Machine learning includes a set of methods that use mathematical models to automatically identify, analyze, and extract patterns from data.^11,13

Intrusion detection involves continuously monitoring and modeling normal network behaviors, which allows potential threats to be identified by detecting deviations from established patterns. They are particularly important because they indicate the emergence of rare and potentially dangerous conditions, such as atypical traffic patterns that indicate ongoing attacks or unauthorized data transfers. These anomalies fall into three categories: individual anomalies, contextual anomalies, and mass anomalies. These can lead to DoS (DoS) within the system and other devices, user-to-root (U2R) attacks, and remote-to-local (R2L) attacks.¹⁴ Using machine learning as an anomaly detection mechanism to distinguish between benign and malicious traffic is a topic of contemporary research that shows promising results. in most approaches, packets or traffic flows are represented using key features such as packet size, protocol, and inter-packet interval.^15,16

Most researchers face problems in the stages of detecting attacks on wireless networks, which are constantly changing due to the real-time handling of them. Among these challenges and problems is classifying the binary attack separately from the multi-classification, which depends on the type of attack itself and not only on its impact.

To address the limitations faced by researchers in this field, the proposed approach entails integrating deep learning into IDS with both binary and multiclassification based on the dynamic threshold of the DNN classifier to classify the type of attack. The proposed approach aims to take advantage of deep learning model, such as its ability to train on its own and handle large amounts of data.

2. Related works

Cybersecurity is a critical challenge for current and future generations of networks. Although many articles have been published on the development of IDS.

Ioannou, C., et al. (2017)¹⁷ proposed a generalized approach for anomaly-based intrusion detection (IDS), using binary logistic regression (BLR) statistics. The researchers named the proposed system mIDS, which mainly classifies local sensor activity as normal or malicious. The proposal was evaluated using routing layer attacks and the system achieved a classification accuracy of 88% in detecting malicious activity.

Ioannou, C. and V. Vassiliou (2018)¹⁸ Once again, the researcher used his mIDS system to monitor and detect attacks based on the local node. The proposed system relied on local node parameters of benign and malicious behaviors to detect network anomalies within the associated node. mIDS was tested in an environment where attacks are present at the network layer. The results showed that the proposal achieved an accuracy of up to 96% in attack detection.

Hu, Z., et al. (2020)¹⁹ employed a fusion of Convolutional Neural Network (CNN) with Adaptive Synthetic Sampling techniques to improve the efficacy of IDS. A consolidated approach was implemented to improve the accuracy and resilience of the IDS in efficiently detect and identify network intrusion. This model need for further evaluation across diverse datasets and network environments

Derweesh, M. S., et al. (2024),²⁰ a system is proposed to detect the nature of the attack and classify the network data of suspicious attacks based on binary classification into normal and dangerous attacks. In the initial steps, the authors adopt preprocessing operations to prepare the data for normal or attack classification by the proposed classifier, such as feature normalization and feature selection. A CNN model is built using the KDD99 dataset, and then the CNN model is used to find outliers.

Alazawi, S. A. H., et al. (2024).²¹ A method for detecting intrusion attacks based on analysing the natural behavior of the system is presented by constructing a special convolutional network to achieve this goal. Classification and detection of intrusion detection programs are of vital importance. The results of the proposed CNN are compared with the regular machine learning method (SVM), with feature selection by association for both methods. The same datasets are used to train and test both CNN and SVM. Some metrics are defined to evaluate the performance of classification and prediction models for a specific type of regular attacks, denial of service attacks, and BOT attacks, where SVM and CNN achieved an accuracy of 85.58% and 95.59%, respectively.

Albarka Umar, M., et al. (2020).²² Hybrid feature and candidate selection algorithms were designed for network intrusion detection based on envelope with tar tree classifier to guide the decision selection in attack type. Machine learning algorithms adopted - UNSW-NB15 dataset was used for training data. Experimental results show that the proposed approach, although effective, is computationally time-consuming compared to the filter-based methods while achieving similar results. It is also found that there are unobserved issues related to the consistency of the UNSW-NB15 dataset., the accuracy of the system was up to 91 percent.

Abdulhameed, A. A., et al. (2024)²³ Designing a Network Intrusion Detection Model. Since Deep Neural Networks (DNNs) are classical deep learning models known for their strong classification performance, which makes them popular in intrusion detection alongside other machine learning algorithms, they have been chosen to improve dataset-based intrusion classification models for IDS. The developed coronavirus algorithm is adopted to improve the system performance by identifying optimal features. The test results showed exceptional performance on the NSL-KDD dataset, where the proposed CNN model achieved 99.3% accuracy for multi-class classification, while the decision tree (DT) achieved 88.64% accuracy for anomaly detection in two-class classification.

Dharini, N., et al. (2023),²⁴ the authors used Matrix Laboratory to collect data on wireless sensor network attacks. The proposed method included evaluating the performance of a set of machines learning techniques and calculating the time required to build classification models for the collected dataset. The XGBoost algorithm achieved an accuracy of 99.16%, while the Bagging algorithm demonstrated efficient performance, achieving an accuracy of 99.8%. XGBoost outperformed the others in terms of speed when measuring the time factor.

3. WSN-Operating system

A WSN operating system selection is a challenging task which requires balancing a number of factors. These consist of the OS's system requirements, its ability to accommodate the particular requirements of the application, and its interoperability with other devices.²⁵ As shown in Figure 1, the architecture and platform support, memory limitations, and computational capabilities of the microcontroller unit (MCU) utilized in the sensor nodes are all included in the system requirements. The OS's suitability for the desired application is determined by its features, including memory management, multitasking, multithreading, and synchronization.^26,27 Furthermore, the extent to which an OS supports peripheral devices from simple sensors to advanced wireless communication protocols can significantly impact the overall functionality and efficiency of the WSN.

Figure 1.

Software architecture of a WSN node.^25,27

The dataset includes 17 features of the wireless sensor network monitoring environment for 374,000 cases and is classified as either a natural (non-malicious) attack or an abnormally effective attack.

4. Research methodology

The general structure of the proposed system requires performing some necessary procedures on the data set in order to use it in the classification model, such as data pre-processing operations by data normalization and data balancing.

The proposed model for attack detection includes two stages: the first is the pre-processing stage, and the second stage is the multi-classification stage based on the dynamic threshold of the DNN classifier to classify the type of attack.

4.1 Preprocessing operations

The dataset is built from within the wireless network by monitoring the transmitted and received packets. A WSN dataset was created to four types of denial-of-service attacks classes as well as normal behavior when there are no attacks. In this study, the attributes of WSNs and the challenges they face when using the Low Energy Aware Cluster Hierarchy (LEACH) routing protocol were considered.²⁸ This choice was made because LEACH is one of the most popular hierarchical routing protocols in WSNs, which consumes limited power and is characterized by its simplicity. The resulting dataset is called WSN-DS dataset, it contains four types of DoS attacks which are Blackhole, Grayhole, Scheduling, and Flooding attacks, and includes instance where there was not attack.²⁹

4.1.1 Dataset balancing

The WSN-DS dataset has various distributions that are not equal or skewed. This ranges from a slight to a severe imbalance in terms of balance. This imbalance poses a challenge to the classifier's parameters, as most algorithms assume that the classes are equal in distribution.^30,31 Table 1 and Figure 2 including the distribution of features for WSN-DS dataset in multi-classification.

Table 1.
Dos distribution in multi classification.

WSN-DS dataset

Attack type Amount Percent

Normal 340066 90.766

Blackhole 10049 2.682

Grayhole 14596 3.895

Scheduling 6638 1.771

Flooding 3312 0.883

WSN-DS dataset
Normal	340066	90.766
Blackhole	10049	2.682
Grayhole	14596	3.895
Scheduling	6638	1.771
Flooding	3312	0.883

Figure 2.

Percent of attacks in WSN-DS dataset.

Hence, it was important to balance and clean the data sets before entering them into the workbook as part of the pre-processing stage. Equ.1 is used for the calculation of the imbalance ratio:^32,33

Imbalance Ratio = \frac{{max C_{i}}}{{min C_{i}}}

(1)

Where: Ci shows the data size in the class i.

4.1.2 Feature selection

Feature selection is a common and useful technique to reduce computational cost, data, and increase accuracy.^34,35 Feature ranking and selection is usually applied for dimensionality reduction which in turn lowers model computational cost. The features of the initial dataset were reduced by using the information gain algorithm which is then relied upon to classify the data after the pre-processing stage operations. The calculation of the IG is mainly based on identifying the best feature.

G a i n (A) = I n f o (D) - I n f o_{A} (D)

(2)

The feature ‘A’ with the highest Information Gain, Gain ‘A’, is chosen as the split feature at node N. This is equivalent to saying that we want to divide by attribute ‘A’, which will serve as “best classification,” therefore, the amount of information required to complete the classification of the data set is small.^36,37

Entropy is used to count inconstancy of a set by using the likelihood of a certain feature or attribute. IG is inverse of Entropy. The plan of Entropy to analyse multiclass ‘more than 2’ is shown below^36,37

E (X) = \sum_{i = 1}^{K} P (X_{i}) lo g_{2} P (X_{i})

(3)

K is the number of classes. And IG of feature X and the class labels Y are calculated as follows:

\begin{aligned} I G (X, Y) & = E (X) - E (X | Y) \end{aligned}

(4)

\begin{aligned} E (X | Y) & = - \sum_{i} P (y_{i}) \sum_{j} P (x_{i} | y_{j}) l o g_{2} (P (x_{i} | y_{j})) \end{aligned}

(5)

E(X) is Entropy of X and E (X|Y) is Entropy of X after remark Y. Now IG is a filter method, it can scale well with the multi dimensions of data. It is also relevant with many classifiers to being classified independent.^36,37

4.2 Id – WSN model

In the proposed ID – WSN model, the data set was divided into 80% for training and 20% for testing, which helps in achieving optimization for model learning and evaluation accurately.

The two basic layers of the ID – WSN model are the multiple classification part using the CNN model, and the binary classification part using the KNN classifier, where the second part of the model produces the outputs of the first part and then classifies the ID – WSN data into normal user or an untrusted attacker.

The K-NN algorithm understands that the label k in the sample space is far from the sample to be classified. The sample falls into a specific class in the case where it should already be done k does so as well.²⁹ There are several scales for measuring distances; the most commonly used is the Euclidean distance scale.³⁰

CNN model in the first part is consists of nine convolutional layers depending on problem complexity. The first layer contains 16 filters, the second layer contains 32 filters, and the last one contains 64 filters. These filters are necessary to break the problem of facial emotion recognition, which is according to previous studies a nonlinear problem. Kernel size for all filters is 3,

A max-pooling layer is added with a 1 × 2 to reduce the size of a tensor to half of its current size and stride of 1 after each layer. The max pooling layer reduces the spatial dimensions of the length and width, and therefore the number of parameters will decrease, which reduces the computations because once it is known that there is a feature then its exact location is not as important as its relative location to other features.

The nine convolutional layers are followed by a FC linear layer with 1024 neurons to allow processing on the entire data. A ReLU activation function is used on the output of FC layer, which increases the nonlinear properties of the decision function, by replacing the negative values of each pixel in the activation map with zero.

5. Results performance

In order to evaluate the proposed classification and detection models, we relied on the confusion matrix to extract and from the metrics used to evaluate the classifier performance, TPR, TNR, Precision, Recall, F-measure.

K-NN and CNN algorithms are evaluated using three metrics commonly used in the machine learning community: recall, precision, and F-measure (FP) - items incorrectly classified as belonging to a given class; false negatives (FN) - items incorrectly classified as not belonging to a given class; and true negatives (TN) - items correctly classified as not belonging to a given class.

Table 2 shows the improvement of the CNN training accuracy over 100 epochs, and the variation between the loss values and training accuracy as the CNN training epoch increases. As shown in Figure 3, the highest training accuracy was achieved at epoch 100, where the accuracy reached 0.9886 with a training time of 1.005 s, and the lowest loss value was achieved at the same epoch.

Table 2.
CNN training performance.

Epoch Time Elapsed Loss Training Accuracy

1 2.006 s 0.3826 0.8358

2 1.001 s 0.1782 0.9336

3 1.006 s 0.1297 0.9542

4 1.006 s 0.1081 0.9638

5 1.007 s 0.0953 0.968

6 1.006 s 0.085 0.972

7 1.007 s 0.0805 0.9731

8 1.007 s 0.0717 0.9759

9 1.006 s 0.067 0.9774

10 1.005 s 0.0623 0.9783

11 1.006 s 0.0606 0.9795

12 1.006 s 0.0538 0.982

13 1.006 s 0.0516 0.9826

14 1.006 s 0.0496 0.9838

15 1.006 s 0.0441 0.9856

21 1.006 s 0.0344 0.9884

22 1.006 s 0.0316 0.991

36 1.006 s 0.0189 0.9943

40 1.008 s 0.0152 0.9865

100 1.008 s 0.0062 0.9886

Epoch	Time Elapsed	Loss	Training Accuracy
1	2.006 s	0.3826	0.8358
2	1.001 s	0.1782	0.9336
3	1.006 s	0.1297	0.9542
4	1.006 s	0.1081	0.9638
5	1.007 s	0.0953	0.968
6	1.006 s	0.085	0.972
7	1.007 s	0.0805	0.9731
8	1.007 s	0.0717	0.9759
9	1.006 s	0.067	0.9774
10	1.005 s	0.0623	0.9783
11	1.006 s	0.0606	0.9795
12	1.006 s	0.0538	0.982
13	1.006 s	0.0516	0.9826
14	1.006 s	0.0496	0.9838
15	1.006 s	0.0441	0.9856
21	1.006 s	0.0344	0.9884
22	1.006 s	0.0316	0.991
36	1.006 s	0.0189	0.9943
40	1.008 s	0.0152	0.9865
100	1.008 s	0.0062	0.9886

Figure 3.

CNN training performance.

Table 3.

Performance measures for CNN multiclass.

Performance Measures	Blackhole	Grayhole	Scheduling	Flooding
TPR	0.933	0.911	0.886	0.911
TNR	0.807	0.880	0.866	0.939
Precision	0.868	0.951	0.669	0.856
Recall	0.933	0.968	0.868	0.911
F-measure	0.887	0.908	0.755	0.870

The performance measures for applying CNN classifier on the ID – WSN is shown in Table 3 and Figure 3 Result show that CNN model can be used for ID – WSN prediction effectively with 0.958 precision rate for Grayhole class. Table 4 and Figure 4 show the performance measures for applying KNN classifier.

Table 4.

Performance measures for KNN multiclass for ID – WSN.

Performance Measures	Blackhole	Grayhole	Scheduling	Flooding
TPR	0.824	0.886	0.778	0.775
TNR	0.796	0.798	0.803	0.891
Precision	0.802	0.887	0.613	0.881
Recall	0.824	0.886	0.778	0.762
F-measure	0.887	0.890	0.706	0.815

Figure 4.

CNN performance for ID – WSN.

Figure 5.

KNN performance for ID – WSN.

Figure 5 shows Recall, Precision, and F_measure values for the used KNN algorithm on ID – WSN. Were KNN having the highest values in Grayhole class in Recall, Precision, and F_measure measurement, the TNR is highest values for Flooding class. Scheduling class has lowest values in all performance measures.

6. Conclusions

Creating reliable security plans with minimal operating expenses is sometimes hampered by the particular protocols and operational needs of wireless sensor networks (WSNs). This study identifies the security issues in WSNs as a crucial and exciting field for further investigation, underscoring the ongoing need for research in this area. This work shows the efficacy of the proposed CNN-based classifier by classifying WSN-specific attacks in binary and multi-class formats. According to experimental data, the method not only outperforms previous research in terms of accuracy but also offers valuable information on the types and classifications of threats unique to a certain network. These findings highlight how crucial it is to incorporate security features early on when designing WSN protocols. According to the results, the suggested CNN classifier is a useful instrument for choosing the best protocols for certain real-time applications while maintaining security and efficiency. Further research avenues may concentrate on expanding this framework to encompass a wider variety of network layers, protocols, and threats in addition to investigating the use of different machine learning classifiers. Furthermore, including adaptive security measures and real-time monitoring systems might improve WSNs’ resilience and suitability for a range of situations.

Footnotes

ORCID iDs

Alyaa Al-Barrak

Sundos A Hameed Alazawi

Abbas A Abdulhameed

Funding

The authors received no financial support for the research, authorship, and/or publication of this article.

Declaration of conflicting interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

References

Narayan

Kolahi

Waiariki

, et al. Performance analysis of network operating systems in local area networks. In Proceedings of the 2nd WSEAS international conference on computer engineering and applications, 2008, January, pp.186–188.

Qian

Chen

, et al. Fault injection for performance testing of composite web services. Int J Perform Eng 2018; 14: 1314.

Gupta

. Towards performance and dependability benchmarking of distributed fault tolerance protocols. Doctoral dissertation, Université Grenoble Alpes, 2016.

Rao

Deebak

. Security and privacy issues in smart cities/industries: technologies, applications, and challenges. J Ambient Intell Humaniz Comput 2023; 14: 10517–10553.

Jain

Sahoo

Kaubiyal

. Online social networks security and privacy: comprehensive review and analysis. Complex Intell Syst 2021; 7: 2157–2177.

Aslan

Aktuğ

Ozkan-Okay

, et al. A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions. Electronics (Basel) 2023; 12: 1333.

Djenna

Harous

Saidouni

. Internet of things meet internet of threats: new concern cyber security issues of critical cyber infrastructure. Appl Sci 2021; 11: 4580.

Chou

Jiang

. A survey on data-driven network intrusion detection. ACM Comput Surv 2022; 54: 1–36.

Gamage

Samarabandu

. Deep learning methods in network intrusion detection: a survey and an objective comparison. J Netw Comput Appl 2020; 169: 102767.

10.

Alkahtani

Aldhyani

. Intrusion detection system to advance internet of things infrastructure-based deep learning algorithms. Complexity 2021; 2021: 5579851.

11.

Belgrana

Benamrane

Hamaida

, et al. Network intrusion detection system using neural network and condensed nearest neighbors with selection of NSL-KDD influencing features. In 2020 IEEE international conference on internet of things and intelligence system (IoTaIS), 2021, January, pp.23–29. IEEE.

12.

Hameed Alazawi

Abdulhameed

Hassan

, et al. Comparative study on applications of cybersecurity tools for Kali Linux operating system. In AIP Conference proceedings, 2024, September, Vol. 3207, No. 1. AIP Publishing.

13.

Khan

Kashif

Jhaveri

, et al. Deep learning for intrusion detection and security of Internet of things (IoT): current analysis, challenges, and possible solutions. Secur Commun Netw 2022; 2022: 4016073.

14.

Derweesh

Alazawi

SAH

Al-Saleh

. Multi level deep learning model for network anomaly detection. J Al-Qadisiyah Comp Sci Math 2023; 15: 8–19.

15.

Najafimehr

Zarifzadeh

Mostafavi

. DDos attacks and machine-learning-based detection methods: a survey and taxonomy. Eng Rep 2023; 5: e12697.

16.

Salmi

Oughdir

. Performance evaluation of deep learning techniques for DoS attacks detection in wireless sensor network. J Big Data 2023; 10: 17.

17.

Ioannou

Vassiliou

Sergiou

. An intrusion detection system for wireless sensor networks. In 2017 24th international conference on telecommunications (ICT), 2017, May, pp.1–5. IEEE.

18.

Ioannou

Vassiliou

. An intrusion detection system for constrained WSN and IoT nodes based on binary logistic regression. In Proceedings of the 21st ACM international conference on modeling, analysis and simulation of wireless and mobile systems, 2018, October, pp.259–263.

19.

Wang

, et al. A novel wireless network intrusion detection method based on adaptive synthetic sampling and an improved convolutional neural network. IEEE Access 2020; 8: 195741–195751.

20.

Derweesh

Alazawi

SAH

Al-Saleh

. Performance analysis of classification models for network anomaly detection. In International Conference on Forthcoming Networks and Sustainability in the AIoT Era, 2024, January, pp.155–166. Cham: Springer Nature Switzerland.

21.

Alazawi

SAH

Abdulbaqi

Ali

. CNN-based intrusion detection software for network operating system environment. Babylonian J Internet Things 2024; 2024: 79–86.

22.

Umar

Zhanfang

Liu

. A hybrid intrusion detection with decision tree for feature selection. arXiv preprint arXiv:2009.13067, 2020.

23.

Abdulhameed

Alazawi

SAH

Hassan

. An optimized model for network intrusion detection in the network operating system environment. Mesopotam J CyberSecur 2024; 4: 75–85.

24.

Dharini

, et al. Intrusion detection in novel WSN-leach dos attack dataset using machine learning based boosting algorithms. Procedia Comput Sci 2023; 230: 90–99.

25.

Yaqoob

Ashraf

Ferooz

, et al. WSN operating systems for internet of things (IoT): A survey. In 2019 International conference on innovative computing (ICIC), 2019, November, pp.1–7. IEEE.

26.

Ioannou

Vassiliou

. Network attack classification in IoT using support vector machines. J Sens Actuator Netw 2021; 10: 58.

27.

Dener

Okur

, et al. Wsn-bfsf: a new data set for attacks detection in wireless sensor networks. IEEE Internet Things J 2023; 11: 2109–2125.

28.

Boban

Uroš

. Energy efficiency improvement of wireless sensor networks in the digital age. In 2024 47th MIPRO ICT and Electronics Convention (MIPRO), 2024, May, pp.1076–1080. IEEE.

29.

Almomani

Al-Kasasbeh

Al-Akhras

. WSN-DS: a dataset for intrusion detection systems in wireless sensor networks. J Sens 2016; 2016: 4731953.

30.

Dini

Elhanashi

Begni

, et al. Overview on intrusion detection systems design exploiting machine learning for networking cybersecurity. Appl Sci 2023; 13: 7507.

31.

Arslan

. Fasttrafficanalyzer: an efficient method for intrusion detection systems to analyze network traffic. Dicle Üniversitesi Mühendislik Fakültesi Mühendislik Dergisi 2021; 12: 565–572.

32.

Thabtah

Hammoud

Kamalov

, et al. Data imbalance in classification: experimental evaluation. Inf Sci (Ny) 2020; 513: 429–441.

33.

Ramyachitra

Manikandan

. Imbalanced dataset classification and solutions: a review. Int J Comput Bus Res 2014; 5: 1–29.

34.

Jahnke

. Machine learning approaches for failure type detection and predictive maintenance. Technische Universität Darmstadt 2015; 19.

35.

Azhagusundari

Thanamani

. Feature selection based on information gain. Int J Innovat Technol Explor Eng 2013; 2: 18–21.

36.

Han

Pei

Tong

. Data mining: concepts and techniques. Morgan kaufmann, 2022.

37.

Win

Kham

NSM

. Information gain measured feature selection to reduce high dimensional data. Doctoral dissertation, MERAL Portal, 2019.

WSN-DS dataset
Attack type	Amount	Percent
Normal	340066	90.766
Blackhole	10049	2.682
Grayhole	14596	3.895
Scheduling	6638	1.771
Flooding	3312	0.883

Safety assessment model for DoS attacks detection in wireless communication and network OS environments

Abstract

Keywords

1. Introduction

2. Related works

3. WSN-Operating system

4.1 Preprocessing operations

4.1.1 Dataset balancing

Table 1. Dos distribution in multi classification. WSN-DS dataset Attack type Amount Percent Normal 340066 90.766 Blackhole 10049 2.682 Grayhole 14596 3.895 Scheduling 6638 1.771 Flooding 3312 0.883

5. Results performance

Footnotes

ORCID iDs

Funding

Declaration of conflicting interests

References

Table 1.
Dos distribution in multi classification.

WSN-DS dataset

Attack type Amount Percent

Normal 340066 90.766

Blackhole 10049 2.682

Grayhole 14596 3.895

Scheduling 6638 1.771

Flooding 3312 0.883