Intrusion Detection Framework for the Internet of Things Using a Dense Random Neural Network

—The Internet of Things (IoT) devices, networks, and applications have become an integral part of modern societies. Despite their social, economic, and industrial beneﬁts, these devices and networks are frequently targeted by cybercriminals. Hence, IoT applications and networks demand lightweight, fast, and ﬂexible security solutions to overcome these challenges. In this regard, artiﬁcial-intelligence-based solutions with Big Data analytics can produce promising results in the ﬁeld of cyberse-curity. This article proposes a lightweight dense random neural network (DnRaNN) for intrusion detection in the IoT. The proposed scheme is well suited for implementation in resource-constrained IoT networks due to its inherent improved generalization capabilities and distributed nature. The suggested model was evaluated by conducting extensive experiments on a new generation IoT security dataset ToN_IoT. All the experiments were conducted under different hyperparameters and the efﬁciency of the proposed DnRaNN was evaluated through multiple performance metrics. The ﬁndings of the proposed study provide recommendations and insights in binary class and multiclass

T HE Internet of Things (IoT) can be generally described as an extensive network of interconnected smart devices that offer digital services to individuals and industries [1], [2].The IoT plays a significant role in modern industries to acquire real-time information through multiple sensors and actuators.The worldwide acceptance of the IoT in modern industries is revolutionizing the current industry trends in terms of information collection, data analysis, and efficient monitoring of industrial operations.The IoT can enhance the productivity and efficiency of the smart industry through intelligent decision making and remote management.However, the rapid growth of IoT networks can increase security and privacy challenges.In 2016, a cyberattack was launched on power substations in Ukraine [3].The supervisory control and data acquisition (SCADA) system of the smart grid was illegally accessed by the attackers through the information technology network.As a result, more than 225 000 general consumers faced a complete power blackout.Another attack reported in 2016 was a huge distributed denial-of-service (DDoS) attack that compromised accessibility of the Internet on the United States East Coast [4].It was a malicious program that replicated itself by finding, attacking, and infecting vulnerable IoT devices.
The analysis of security and privacy risks in the IoT and the potential solutions to address these challenges became an emerging topic in the field of cybersecurity [5].In existing networks, intrusion detection systems (IDSs) are the most commonly used security models.The IDS monitors real-time Internet traffic and identifies malicious activities within the traffic.The IDS can be classified as anomaly based or signature based.The anomaly based IDS analyzes the Internet traffic and compares it to the previously learned patterns to detect malicious activities [6].On the other hand, the signature-based IDS identifies the intrusions by finding the relationship between the previously learned signatures of known attacks.The anomaly based IDS can identify recent and well-known attacks, but they often have This work is licensed under a Creative Commons Attribution 4.0 License.For more information, see http://creativecommons.org/licenses/by/4.0/ a greater risk of false-positive rates.Signature-based methods are not generally effective IDS to detect new and unknown and threats [7].
In recent years, machine learning (ML) and deep learning (DL) techniques have been used for a variety of security solutions in IoT applications.ML/DL-based solutions with Big Data analytics can produce significant results in the field of cybersecurity.In several studies, DL-based algorithms have gained considerable attention over conventional learning methods because of their better pattern extraction abilities.Modern IoT networks necessitate lightweight security solutions due to the resource-constrained nature of IoT devices.Prior research findings that include evaluation of the suggested solutions using outdated cyber security datasets do not meet modern security criteria.To address these challenges, we propose a novel DL scheme for intrusion detection in an IoT environment.Following are the major contributions of this article.
1) It proposes a novel dense random neural network (DnRaNN) for intrusion detection and classification in IoT networks.2) The proposed scheme is evaluated by conducting extensive experiments on the new generation IoT security dataset ToN_IoT.
3) The performance of the DnRaNN is evaluated in both binary class and multiclass scenarios through multiple performance evaluation parameters including accuracy, precision, recall, and F1 score.4) Finally, it presents a detailed performance comparison of the proposed scheme with some well-known ML/DLbased intrusion detection.The rest of this article is organized as follows.Section II presents a detailed overview of some recent intrusion detection schemes for IoT applications.Section III comprises research methodology that includes the mathematical modeling of a DnRaNN, and details of the proposed architecture.Section IV describes the implementation platform, dataset description, simulations, and discussion of results.Finally, Section V concludes this article.

II. RELATED WORKS
Cyberattack detection in IoT networks is generally a classification problem.ML/DL techniques can effectively solve this problem.This section presents an overview of some recent ML/DL-based studies for intrusion detection in the IoT.
An efficient attack detection framework significantly contributes to network security.False data injection (FDI) attack is one of the dangerous security problems in IoT networks.This attack aims to mislead IoT application platforms by falsifying the sensor's data from the perception layer.Aboelwafa et al. [8] presented a novel autoencoder for FDI attack detection in IoT networks.Researchers exploited the sensor data correlation in time and space, which can be helpful to identify false data.The results of the experiments demonstrate that the suggested scheme identified the FDI attacks with a higher accuracy.In IoT environments, ML approaches can play a significant role in ensuring security and authorization.In this context, Makkar et al. [9] developed an ML-based security framework for spam detection in IoT devices.In the proposed technique, researchers evaluated five ML models by using different parameters.The spam score is calculated by using the refined input features.The authors conducted extensive experiments on the REFIT smart home dataset to validate the efficiency of the proposed scheme.Jia et al. [10] presented a novel edge-centric ML-based IoT defense system for DDoS attacks on the IoT.The proposed model is used for the detection, identification, and classification of DDoS attacks in IoT environments.The authors generated a large dataset by using DDoS simulators; the SlowHTTPTest, BoNeSi along with the CICDDoS2019 dataset.They compared the proposed scheme with four well-known ML models.The suggested approach outperformed previous state-of-the-art DDoS attack detection systems, according to experimental data.
Several techniques for cyberattack detection and classification have been developed, but very few of them have focused on reducing the complexity of ML models.In the latest study, Huong et al. [11] proposed a novel edge cloud framework that performs attack detection on the edge layer.The proposed multiattack detection mechanism named LocKedge reduces the complexity for deployment in resource-constrained devices while maintaining a higher accuracy.To analyze the effectiveness of the proposed model from multiple aspects, LocKedge was implemented in federated and centralized learning manners.Researchers analyzed the performance of the suggested framework using the BoT-IoT dataset.In experimental findings, the proposed approach demonstrated better performance than eight well-known ML/DL algorithms.In another new work, Bokka et al. [12] developed a deep neural network for cyberattack detection in the smart home.The authors utilized a DS2OS dataset in their experiments.The proposed scheme successfully detected denial-of-service, malicious control, and spying attacks in a smart home environment with higher accuracy, precision, and F1 scores.Smart industries are employing SCADA systems with their plants.However, the integration of SCADA with an industrial system can be vulnerable to multiple cyberattacks.Lu et al. [13] developed a deep belief network (DBN) with population extremal optimization (PEO) for anomaly detection in SCADA-based industrial control systems.In the proposed approach, PEO is utilized to determine the optimal parameters of the neural network.An ensemble learning approach is introduced for the accumulation of the DBN.The proposed model is evaluated on the water storage tank system dataset and the gas pipeline system dataset from the SCADA network traffic.DDoS attacks can destabilize the complete IoT system by sending malicious requests over the network.In other recent research, Rehman et al. [14] introduced a new attack detection approach called DIDDOS to detect real-time DDoS attacks.Researchers utilized recurrent neural networks (RNN), gated recurrent units, and sequential minimal optimization to detect and identify realtime DDoS attacks on IoT networks.The proposed framework is evaluated through several performance parameters including accuracy, precision, recall, and F1 scores.
The majority of the aforementioned studies discussed the validation of the proposed techniques utilizing datasets from previous generations.Most of these datasets are devoid of information concerning recent and specified ranges of threats.Another main challenge with the existing techniques is the compatibility of security solutions with resource-constrained IoT networks.To address these challenges, a lightweight dense random neural network (DnRaNN) is proposed.Extensive experimentation is conducted on the latest generation IoT security dataset ToN_IoT.Multiple performance parameters are defined to assess the efficiency and effectiveness of the proposed technique.

III. RESEARCH METHODOLOGY
This section discusses the detailed mathematical model of the proposed DnRaNN and highlights the performance evaluation metrics.

A. Random Neural Network (RaNN)
The RaNN was introduced by Gelenbe in 1989 [15].An RaNN mimics the behavior of biological neurons with its "integrate and fire" system.The RaNN is used in several applications including image processing, optimization, communication systems, cybersecurity, classification, and pattern recognition [16].The RaNN has several key advantages.First, it can efficiently represent signal transmission through the human brain.It provides easy-to-understand complex stochastic behaviors among neurons through simple mathematical modeling.Second, it has better generalization capabilities because of its probability constraints.Third, it has established mathematical properties that can simplify complex computations [16].Fourth, it is an ideal algorithm for deployment in resource-constrained hardware and IoT devices because of its highly distributed nature [17], [18].
1) Mathematical Model of RaNN: Consider an RaNN model comprised of N neurons.Each neuron receives excitatory and inhibitory spikes from some external sources that can be sensors or cells.The arrival occurs to the cell n ∈ {1, . . ., N}.The rate of occurrence for excitatory and inhibitory spikes can be denoted as rates ψ + n and ψ − n , respectively.In the RaNN model, each neuron can be represented by its internal state s n (t) at time t ≥ 0. If s n (t) > 0. The arrival of an inhibitory spike to neuron n at time t can then cause the reduction of the internal state by one unit s n (t If s n (t) = 0, then the arrival of an inhibitory spike to a cell has no impact.On the other hand, the arrival of an excitatory spike will always increase the s n (t) by +1.
The neuron n is "excited" if its internal state Here, R n > 0 is its "firing rate," such that R −1 n is the average firing delay of the excited nth neuron.
At time t ≥ 0, neurons can interact in the following manners.If neuron α is excited, such that s α (t) > 0, then its internal state drops by 1, and we have s α (t + ) = s α (t) − 1. Neuron α can either send an excitatory spike to neuron β with probability ϕ + (α, β), which results in s α (t + ) = s α (t) − 1 and s β (t + ) = s β (t) + 1, or it can send an inhibitory spike to neuron j with probability ϕ − (α, β) so that s β (t + ) = s β (t) + 1 and In another case neuron α can "trigger" neuron β with probability ϕ(α, β) so that s α (t When the neuron α triggers neuron β, both s α (t + ) = s α (t) − 1 and s β (t + ) = s β (t) − 1, and one of two things may happen.First, we have s n (t + ) = s n (t) + 1 with probability δ(β, n) so that neurons α and β together have incremented the state of neuron n.A trigger allows two neurons α and β to increase the excitation level of a third neuron n by +1, while neurons α and β are both depleted by −1.Second, the trigger moves on to the neuron n with probability σ(β, n), and then, this sequence will be repeated.
Note that When neuron α fires, the corresponding spike is lost, or it leaves the network with the probability α .
Cells in the different layers of the human brain communicate with each other through simultaneous firing patterns of densely packed somas.An extended work of the RaNN algorithm was presented in [19] and [20], using a branch theory of stochastic networks.In the following, we will exploit this framework for DL.
2) Modeling of Soma-to-Soma Interactions: Let μ(n) = (α 1 , . . ., α m ) be any ordered sequence of distinct numbers where α β ∈ {1, . . ., N} and The probability of excitation for the neuron n can be described by the following expression: where the variables in (3) are of the form (5) Here, we set ϕ(α, β) = σ(α, β) to simplify the expression.The simplified equation can be presented as follows: and 3) Clusters of Densely Connected Cells: Now, we consider the construction of clusters of densely interconnected cells.First, in a network D(d) that contains d identically connected cells, the external excitatory and inhibitory arrival of spikes is represented by ψ + and ψ − .Each connected cell has a firing rate R and its state is denoted by γ.Each cell receives inhibitory input from the state of some cell h, which does not belong to D(d).Thus, for any cell h ∈ D(d), we have an inhibitory weight ω − ≡ ω − ,h > 0 from to h.
For any α, β ∈ D(d), we have ω + α,β = ω − α,β = 0, but whenever one of the cells fires, it triggers the firing of the other cells with ϕ(α, β) = ϕ d and δ(α, β) = 1−ϕ d .As a result, we have This can be reduced to where the aforementioned equation can be represented as a second-degree polynomial in terms of γ as follows: ) Under the conditions that d ≥ 2, ϕ ≤ 1, ψ + > 0, ψ − > 0, and R > 0 and ψ − ≥ ψ + , this equation can easily be solved for its positive roots, where one of them is less than 1.This is the only one of interest because γ is a probability.

4) RaNN With Multiple Clusters:
In this subsection, we describe the construction of a multiple cluster-based DL architecture.This DL framework contains K clusters D(d) each with d hidden cells.For the kth cluster, k = 1, . . ., K, the state of each of its identical cells is denoted by γ k .In addition, U input cells do not belong to these K clusters and the state of the lth cell l = 1, . . ., L is denoted by γl .
Each hidden cell in the clusters k, with k ∈ {1, . . ., K}, receives inhibitory input from each of the L input cells.Thus, for each cell in the kth cluster, we have inhibitory weights ω − l,k > 0 from the lth input cell to each cell in the kth cluster.The lth input cell will have a total inhibitory "exit" weight or total inhibitory firing rate R − l to all of the clusters, which are of value Then, from ( 9) and (10), we have yielding a second-degree polynomial for each of the γ k as where x Its positive root can be described as When all the parameters d, and y k = y, with k = 1, . . ., K are the same for all of the clusters, we will have (20) The resulting activation function given by ( 20) is highly nonlinear and goes beyond the capabilities of conventional activation functions like the Sigmoid, Tansig, and Sine functions.The activation of the cluster (20) depends on parameters d, ϕ, ψ + , ψ − , and R. The curves of ξ(η) versus η under different parameters for a cluster with 20 cells satisfy the conditions derived for (10)

B. Proposed DnRaNN Architecture
The main idea of a DnRaNN is extracted from the structure of the human brain.Several important areas in the human brain contain dense clusters of cells.These clusters may contain similar cells or a variety of different cells.Because of the density of their arrangement, these clusters can allow for substantial communication through synapses and dendrites [21].Therefore, a mathematical model of dense clusters is developed that can model both soma-to-soma interactions and synapses to create a DnRaNN whose proposed framework is presented in Fig. 1.This model contains one input layer, four cluster hidden layers, and one output layer.The framework of dense clusters allows the formulation of multilayer architecture, in which each layer contains a finite number of dense nuclei.The cells in each nucleus communicate with each other in a fully connected architecture by using synapse and soma-to-soma interactions.The communication framework among the hidden layers is based on a traditional multilayer feed-forward architecture.The nuclei of the first layer receive the excitation signal from an input layer.After that, every cell in each nucleus creates an inhibitory projection to the layer above.Finally, the gradient descent algorithm efficiently trains the neural network.

C. Performance Evaluation Metrics
Several evaluation metrics such as accuracy, precision, recall, and F1 score are used to analyze the performance of the proposed DnRaNN.
1) Accuracy (AC): It determines the ratio of correctly predicted observations to the total number of observations by the IDS.It can be mathematically described as 2) Precision (PR): It determines the ratio of correctly predicted malicious observations to the total number of observations classified as an attack by IDS.It can be mathematically described as 3) Recall (RC): It determines the ratio of correctly predicted malicious observations to the correctly predicted malicious observations and incorrectly predicted normal observations.It can be mathematically described as 4) F1 Score (F1): It determines the weighted average of precision and recall.It maintains the balance between PR and RC by considering positive and negative results.It can be mathematically described as

IV. SIMULATIONS AND RESULTS
This section presents the experimental methodology, simulations, and discussion of results.

A. Simulation Platform
The simulation and performance evaluation of the proposed DnRaNN are conducted on the Hewlett-Packard Pavilion Gaming Desktop TG01-2260xt workstation.This workstation contains an 11th generation Intel Core i7 11700 processor with 8-GB DDR4-2933 SDRAM.An Nvidia GeForce GTX 1660 Super (6-GB GDDR6) graphic card ensures the smooth execution of the simulations.

B. ToN_IoT Dataset
The ToN_IoT is a new generation open-source dataset.It was generated at the Cyber Range and IoT Labs of the University of New South Wales Australia [22].It can be accessed from the ToN_IoT repository [23].This dataset contains a total of 1 379 274 samples, of which 270 279 are normal and 1 108 995 are attack samples.The ten classes are benign, DoS, DDoS, scanning, backdoor, ransomware, cross-site scripting (XSS), data injection, man-in-the-middle, and password cracking attacks.

C. Dataset Preparation
Data preparation is an essential stage to prepare and clean the data before feeding it into any ML/DL algorithm, to accelerate the learning process and achieve a good accuracy.At this stage, several operations can be performed such as elimination of unnecessary features, conversion of nonnumerical features, and replacement of missing values with suitable data.In this article, we applied a two-step process for data preparation, which includes both data preprocessing and data normalization.
1) Data Preprocessing: In this stage, the categorical features with nominal values are converted into numerical values to ensure data compatibility with the input of the neural network.In this work, the categorical features are converted into numerical values by applying label encoding.Because data, time, and time stamp features have no impact and contribution on the output prediction, these columns are eliminated in preprocessing.
2) Data Normalization: Because model is biased toward large values, some features in the dataset contain larger values as compared to others, thereby it may reduce the accuracy of results.In data normalization, the data are mapped in the range between 0.0 and 1.0 without disturbing the normality of data behavior.In this work, we have used min-max scaling for data normalization [24].
Here, x and y represent the original and normalized values, respectively.The minimum and maximum values of the features are represented by x max and x min , respectively.

D. Hyperparameter Selection
Hyperparameters are the variables that determine the network structure and control the learning process.In our experiments, the main framework of the DnRaNN is fixed [25].To ensure the best performance of the proposed DnRaNN, we determine the optimal hyperparameters by conducting extensive experiments.These hyperparameters include learning rate, momentum, number of epochs, and batch size.
1) Learning Rate: This parameter controls the learning speed of ML/DL models.A lower learning rate can help the model to learn better but can increase the training time, and the process can get stuck.On the other hand, a high learning rate can allow fast training but can cause a large output error.Therefore, the selection of an appropriate learning rate helps to ensure the optimum performance of the ML/DL model.In this article, we define five values of learning rates to obtain the best performance.
2) Momentum: This parameter helps to determine the direction of the next stage based on the knowledge of the previous stage.It helps to prevent oscillations in the model.Multiple experiments found that a suitable choice of momentum lies between 0.5 and 0.9.
3) Number of Epochs: In terms of ML/DL, an epoch refers to one cycle through the full training dataset.Usually, training an ML/DL model takes more than a few epochs.In our experiments, we conducted all the simulations for 100 epochs.
4) Batch Size: This parameter is related to the gradient descent algorithm, which controls the number of training samples to be processed before the model's internal parameters are changed.The popular default values for batch size are 32, 64, and 128.

E. Simulations and Result Analysis
The ToN_IoT dataset is split into training and testing datasets with the ratio of 80% and 20%, respectively.The class distribution of the ToN_IoT dataset is presented in Table I.The 22 most prominent features are used as input of the neural network.A detailed analysis is performed for both binary class and multiclass scenarios.
1) Result Analysis of Binary Classification: The performance of the proposed DnRaNN was first evaluated for the binary class scenario.Initially, we set the batch size as 32,  momentum as 0.55, and a range of learning rates: 0.001, 0.005, 0.01, 0.10, 1.00, and 2.00.We performed a simulation for 100 epochs by keeping the batch size and momentum at fixed values and recorded the results at the aforementioned learning rates.The performance of the proposed model for the defined hyperparameters is presented in Table II.The best train and test accuracies attained are 99.22% and 99.15%, respectively, for the learning rate of 0.10.The other performance scores at this learning rate also indicate the satisfactory performance of the DnRaNN.For the learning rate of 0.001, 0.005, and 0.01, the model achieved an accuracy higher than 98%.At a higher learning rate of 1.00 and 2.00, the accuracy and other performance scores indicate a lower performance of the proposed model.A detailed performance comparison using these parameters is presented using the confusion matrices shown in Fig. 2. At the second stage, we set the batch size as 64, momentum as 0.70, and the same range of learning rates as we had used in our first experiment.The performance using the defined hyperparameters is presented in Table III.The best train and test   accuracies attained are 98.80% and 98.20%, respectively, for the learning rate of 0.01.The other performance scores at this learning rate indicate a superior performance of the DnRaNN.For the learning rates of 0.001, 0.005, and 0.10, the model achieved train and test accuracy higher than 97%.Again, for higher learning rates of 1.00 and 2.00, the accuracy and other performance scores indicate an unsatisfactory performance of the proposed model.A detailed performance comparison of these parameters is presented using the confusion matrices shown in Fig. 3.At the third stage, we set the batch size as 32, momentum as 0.82 and the same range of learning rates as in our previous two experiments.The performance at the given hyperparameters is presented in Table IV.The best train and test accuracies are attained as 98.66% and 98.17%, respectively, for the learning rate of 0.10.The other performance scores at this learning rate indicate a good performance of the DnRaNN.For the learning rates of 0.001, 0.005, and 0.01, the model achieved train and test accuracies between 97% and 98%.Again, for the higher learning rates of 1.00 and 2.00, the accuracy and other performances were decreased.A detailed performance comparison for these  parameters is presented using the confusion matrices shown in Fig. 4.
The overall performance comparison for binary classification indicates that the proposed DnRaNN model achieved the optimum results at the learning rate of 0.10, batch size 32, and momentum 0.55.
2) Result Analysis of Multiclass Classification: As described earlier, the ToN_IoT dataset contains ten classes.Therefore, in the second phase of experimentation, we evaluated the efficiency of the proposed DnRaNN in a multiclass scenario.As in the binary class experiments, we initially set the batch size as 32, momentum as 0.55 and learning rates as 0.001, 0.005, 0.01, 0.10, 1.00, and 2.00.We executed the simulation for 100 epochs by keeping the batch size and momentum at fixed values and recorded the results at the aforementioned learning rates.The performance of the model at the predefined hyperparameters is presented in Table V.The results demonstrate that the proposed model attained a higher attack detection accuracy for the learning rate of 0.01.The best train and test accuracies are recorded as 99.11% and 99.05%, respectively.For the learning rates of 0.001, 0.005, and 0.10, the model achieved train and test accuracy between 97% and 98%.For higher learning rates of 1.0 and 2.0, the model attained low accuracy scores between 85% and 95%.As the model achieved higher performance scores at the learning rate of 0.01, we analyzed the attack detection performance for each class at this learning rate.The bar graph in Fig. 5 presents a comparative analysis of actual and predicted results of the proposed DnRaNN algorithm.
At the second stage, we set the batch size as 64, momentum as 0.70, and the same range of learning rates as in our  first experiment.The performance of the proposed algorithm at predefined hyperparameters is presented in Table VI.The results demonstrate that the proposed model achieved higher attack detection accuracy for the learning rate of 0.01.The train and test accuracies are recorded as 99.07%and 98.98%, respectively.At the learning rates of 0.001, 0.005, and 0.10, the model attained train and test accuracies between 97.50% and 98%.As in the previous experiment, the model achieved lower performance scores at a higher learning rate.Again, the proposed model demonstrated a higher performance for the learning rate of 0.01, so we analyzed the attack detection performance for each class at this learning rate.The bar graph in Fig. 6 presents a comparative analysis of actual and predicted results of the proposed DnRaNN algorithm.
At the third stage, we set the batch size as 32, momentum as 0.82, and the same range of learning rates as in our previous two experiments.The performance of the proposed model at the predefined hyperparameters is presented in Table VII.The results demonstrate that the proposed model achieved a higher attack detection accuracy for the learning rate of 0.01.The best train and test accuracies are recorded as 98.83% and 98.77%, respectively.For other learning rates, 0.001, 0.005, and 0.10, the model attained train and test accuracies between 97.0% and 98%.As in the previous experiments, the model achieved lower performance scores at higher learning rates.Because our model demonstrated a higher performance at the learning rate of 0.01, we analyzed the attack detection performance for each class at this learning rate.The bar graph in Fig. 7 presents a comparative

F. Performance Comparison With the Well-Known ML/DL-Based IDS
To analyze the effectiveness of the proposed DnRaNN further, we compared its performance with some well-known ML and DL-based algorithms for the ToN_IoT dataset.These algorithms  include artificial neural network (ANN), support vector machine (SVM), random forest (RF), autoencoder (AE), deep belief network (DBN), and the RNN.For a better performance comparison, we maintained the training and testing dataset split ratio as 80% and 20%, respectively.All these algorithms were implemented in the Python simulation environment.We evaluated the performance of the proposed DnRaNN with other ML/DL algorithms in both binary class and multiclass scenarios.A detailed comparison for binary classification is shown in Fig. 8.According to this figure, the intrusion detection accuracy and other scores of ANN, SVM, and DBN for the ToN_IoT dataset are obtained between 95% and 97.50%.The intrusion detection performances of RF, AE, and RNN were less than 95%.
In the second phase, the performance of the ML/DL-based model is evaluated for the multiclass scenario.A brief comparison is presented in Fig. 9.The two classifiers ANN and SVM achieved a higher attack detection accuracy as greater than 96% and the performance scores for all the remaining classifiers were between 90% and 95%.In summary, the performance of the proposed DnRaNN is superior for both binary class and multiclass scenarios, as compared to the other ML/DL-based intrusion detection models.

V. CONCLUSION
In this article, a novel DnRaNN technique was proposed for cyberattack detection in an IoT environment.To evaluate the effectiveness of the proposed algorithm, extensive experiments were conducted on the new generation ToN_IoT dataset.We defined multiple parameters including accuracy, precision, recall, and F1 score for the performance evaluation.The efficiency of the proposed approach was evaluated in both binary and multiclass scenarios.In the binary class evaluation, the DnRaNN achieved a higher attack detection accuracy of 99.14%.For binary class scenarios, other performance scores are also higher than 99%.In multiclass evaluation, the DnRaNN obtained 99.05% attack detection accuracy.The proposed scheme successfully classified nine different attacks on the IoT with a high detection accuracy.To analyze the effectiveness of the proposed model further, its performance was compared with some well-known ML/DL-based intrusion detection schemes.The experimental findings of the proposed model proved its higher performance over other ML/DL-based schemes.To enhance the performance of cyberattack detection algorithm in hardware perspectives, a field programmable gate array (FPGA)-based accelerator can be integrated with DnRaNN.

Intrusion
Detection Framework for the Internet of Things Using a Dense Random Neural Network I. INTRODUCTION

Fig. 8 .
Fig. 8. Performance comparison of the state-of-the-art IDS for binary class scenario.

Fig. 9 .
Fig. 9. Performance comparison of the state-of-the-art IDS for multiclass scenario.

TABLE I CLASS
DISTRIBUTION IN THE TON_IOT DATASET TABLE II PERFORMANCE COMPARISON OF THE DNRANN FOR THE BINARY CLASS SCENARIO AT BATCH SIZE: 32, MOMENTUM: 0.55, AND EPOCHS: 100

TABLE III PERFORMANCE
COMPARISON OF THE DNRANN FOR THE BINARY CLASS SCENARIO AT BATCH SIZE: 64, MOMENTUM: 0.70, AND EPOCHS: 100

TABLE IV PERFORMANCE
COMPARISON OF THE DNRANN FOR THE BINARY CLASS SCENARIO AT BATCH SIZE: 32, MOMENTUM: 0.82, AND EPOCHS: 100

TABLE V PERFORMANCE
COMPARISON OF THE DNRANN FOR THE MULTICLASS SCENARIO AT BATCH SIZE: 32, MOMENTUM: 0.55, AND EPOCHS: 100

TABLE VI PERFORMANCE
COMPARISON OF THE DNRANN FOR THE MULTICLASS SCENARIO AT BATCH SIZE: 64, MOMENTUM: 0.70, AND EPOCHS: 100

TABLE VII PERFORMANCE
COMPARISON OF THE DNRANN FOR THE MULTICLASS SCENARIO AT BATCH SIZE: 32, MOMENTUM: 0.82, AND EPOCHS: 100