#  Generalized Parton Distribution Functions via Quantum Simulation of Quantum
Field Theory in light-front coordinates.

Gary Goldstein, Carter Gustin
Tufts University
Medford, M.A.
{gary.goldstein<EMAIL_ADDRESS>
###### Abstract

Quantum simulation of quantum field theories offers a new way to investigate
properties of the fundamental constituents of matter. We develop quantum
simulation algorithms based on the light-front formulation of relativistic
field theories. The process of quantizing the system in light-cone coordinates
will be explained for Hamiltonian formulation, which becomes block diagonal,
each block approximating the Fock space with a certain harmonic resolution K.
We analyze Yukawa theories in 1+1D and 2+1D. We compute the analogues of
parton distribution functions and generalized parton distribution functions
for mesonic composite particles – like hadrons - in these theories. The
dependence of such analyses on the scaling of the number of qubits is compared
with other schemes and conventional computations. There is a notable advantage
to the light-front formulation.

##  1 Formalism

###  1.1 The Hadronic Model in 2 + 1D

A fermionic field [1] [2], $\psi$, interacting with a bosonic field, $\phi$,
can be described by the Yukawa model Lagrangian

$\displaystyle\mathcal{L}=\frac{1}{2}\partial^{\mu}\phi$
$\displaystyle\partial_{\mu}\phi-\frac{1}{2}m_{B}^{2}\phi^{2}+\frac{i}{2}\bar{\psi}\gamma^{\mu}\partial_{\mu}\psi$
(1.1)
$\displaystyle-\frac{i}{2}\partial_{\mu}\bar{\psi}\gamma^{\mu}\psi-(m_{F}+\lambda\phi)\bar{\psi}\psi$

where $m_{B},m_{F}$ are the bare bosonic and fermionic masses (for single
flavor particles), respectively. $\lambda$ describes the coupling between the
fields. Light-front (LF) coordinates describe the motion of a (massless)
particle moving at the speed of light on the light-cone and will be utilized
throughout this paper. Given equal time coordinates
$x^{\mu}=(x^{0},x^{1},x^{2},x^{3})=(ct,x,y,z)$, the coordinate transformation
to LF coordinates is:

$x^{\pm}=x^{0}\pm x^{3}.$ (1.2)

The fields are given as

$\phi(x)=\sum_{n=1}^{\Lambda}\frac{1}{(4\pi
n)^{\frac{1}{2}}}(a_{n}e^{-ik_{n}^{\nu}x_{\nu}}+a_{n}^{\dagger}e^{ik_{n}^{\nu}x_{\nu}})$
(1.3)

and

$\psi(x)=\sum_{n=1}^{\Lambda}\frac{u}{(2L)^{\frac{1}{2}}}(b_{n}e^{-ik_{n}^{\nu}x_{\nu}}+d_{n}^{\dagger}e^{ik_{n}^{\nu}x_{\nu}})$
(1.4)

with discretized single-particle light-cone momenta

$k_{n}^{+}=\frac{2\pi}{L}n;\hskip 28.45274ptn=1,2,...\Lambda$ (1.5)

where $\Lambda$ is the momentum cut-off which must be chosen by hand, and $L$
is the size of the box which the fields are quantized onto. Luckily, in LF
coordinates, there are three constants of motion (which constitute a complete
set of commuting observables): $Q$ the charge, $P^{+}$ the LF momentum, and
$P^{-}$ the LF energy, which isolate the dependence of the box size, $L$. In
LF coordinates,
$Q=\sum_{n}(b_{n}^{\dagger}b_{n}-d_{n}^{\dagger}d_{n}),P^{+}=\frac{2\pi}{L}K,P^{-}=\frac{L}{2\pi}H$,
where a new operator, $K$ the harmonic resolution

$K=\sum_{n}n(a_{n}^{\dagger}a_{n}+b_{n}^{\dagger}b_{n}+d_{n}^{\dagger}d_{n})$
(1.6)

gives the total momentum of the hadron. Physically, one can think of each
parton inside the hadron having light-cone momentum $k^{+}$ and the harmonic
resolution $K$ (the total LF hadronic momentum) is the sum of all of the
individual parton momenta.

###  1.2 Fock States

We look at Fock states in second-quantized momentum space for fermions,
antifermions and bosons:

$\ket{i}=\ket*{n_{1},\dots
n_{N};\bar{n}_{1},\dots,\bar{n}_{\bar{N}};\tilde{n}_{1}^{\tilde{m}_{1}},\dots,\tilde{n}_{1}^{\tilde{m}_{\tilde{N}}}}$
(1.7)

which can be built up from the vacuum state $\ket{0}$ via creation opperators
$a_{i}^{\dagger},b_{i}^{\dagger},d_{i}^{\dagger}$ subject to the constraint
$\sum_{i}^{N+\bar{N}+\tilde{N}}\hat{n}_{i}^{+}=K$ and
$\sum_{i}k_{i,\perp}=P_{\perp}$ where $P_{\perp}$ is the total transverse
momentum. The first $N$ terms refer to fermions with $n_{i}\in\\{0,1\\}$, the
second $\bar{N}$ terms refer to antifermions again with
$\bar{n}_{i}\in\\{0,1\\}$, while the final $\tilde{N}$ terms refer to bosons
with $\tilde{m}_{i}$ bosons in a given mode. Note that only occupied modes are
shown in a given Fock state. The set of quantum numbers that each fermion can
take on are $\\{n^{+},\boldsymbol{n_{\perp}},\lambda,c,f\\}$ where $\lambda$
refers to the helicity of the fermion, $c$ is the color, and $f$ is the
flavor. In a given Fock state, instead of each fermionic mode representing a
single quantum number, each fermionic mode represents a set of numbers.

This can obviously increase the number of qubits quite rapidly as there are 2
possible helicities, 3 possible colors and 6 possible flavors for each
$n^{+},\boldsymbol{n}_{\perp}$ so this scales exponentially large as
$n^{+},\boldsymbol{n}_{\perp}$ increase. There are a few ways to decrease the
number of qubits that must be used to represent this system. First, we use the
Tamm-Dancoff cutoff which looks only at the $\ket{q\bar{q}}$ or
$\ket{q\bar{q}g}$ sectors (for the purposes of this paper, we only look at the
$\ket{q\bar{q}}$ sector). With this cutoff, we are essentially looking at
mesonic bound states such as the pion. Additionally, we disregard the
helicity, color and flavor and only keep the quantum numbers $n^{+}$ and
$\boldsymbol{n}_{\perp}$.

###  1.3 The Bound State problem

In this section, the bound state problem will be discussed (note that much of
this information comes from the Pauli, Brodsky, Pinsky paper [3] and the Wölz
paper [Wolz]). The eigenvalue problem we must solve is

$H\ket{\Psi}=\frac{M^{2}+P^{2}_{\perp}}{2P^{+}}\ket{\Psi}.$ (1.8)

$\ket{\Psi}$ is the hadronic statefunction defined in the set of basis Fock
states $\ket{\mu_{n}}$ for the partons. A given Fock state has the form:

$\ket*{q\bar{q}:k_{i}^{+},\vec{k}_{i,\perp}}=b^{\dagger}(q_{1})d^{\dagger}(q_{2})\ket{0}$
(1.9)

where $b^{\dagger}(q_{1})$ creates a quark with the quantum numbers $q_{1}$
and $d^{\dagger}(q_{2})$ creates an antiquark with the quantum numbers
$q_{2}$. There are a finite number of Fock states of this form satisfying
$\sum_{i}k^{+}_{i}=P^{+}$ and $\sum_{i}k_{i,\perp}=P_{\perp}$. This set of
Fock states forms a basis to which the hadronic state $\Psi$ can be written:

$\ket{\Psi}=\sum_{n}\bra{\mu_{n}}\ket{\Psi}\ket{\mu_{n}}.$

Solving the bound state problem using VQE will allow us to determine the
ground state energy as well as the coefficients $\bra{\mu_{n}}\ket{\Psi}$ in
the expansion of $\ket{\Psi}$ which allows us to write down the ground state
wavefunction.

###  1.4 2 + 1D Yukawa Hamiltonian

The 2 + 1D Yukawa Hamiltonian is given by

$H_{LC}=P^{\nu}P_{\nu}=P^{+}P^{-}-P^{2}_{\perp}$ (1.10)

where $P^{+}$ and $P_{\perp}$ are parameters that are chosen. $P^{+}=K$ and it
is permissible to take $P_{\perp}=0$ as there exists a reference frame such
that the total hadronic transverse momentum is zero, but the individual
partonic transverse momenta are non-zero but sum to zero. Thus the Hamiltonian
is $H_{LC}=KP^{-}$ where $P^{-}$ is more complicated.
Given explicitly in Pauli, Brodsky, Pinsky[3], the Hamiltonian is the sum of a
kinetic term and an interaction (potential) term $H=T+U$. The kinetic piece is
diagonal in number operators:

$T=\sum_{q}\frac{m^{2}_{q}+k_{\perp}^{2}}{x}\left(a^{\dagger}_{q}a_{q}+b^{\dagger}_{q}b_{q}+d^{\dagger}_{q}d_{q}\right)$
(1.11)

where $x=n^{+}/K$ and the sum goes over the set of all possible quantum
numbers:

$\sum_{q}=\sum_{n^{+}}\sum_{\boldsymbol{n}^{\perp}}\dots$

where the dots include any other quantum numbers not used in our problem (such
as helicity, color, flavor). The interaction term is a sum of four pieces:
$U=S+C+V+F$. See the Pauli, Brodsky, Pinsky [3] paper for the full interaction
matrix for an SU(N)-Meson. In the $\ket{q\bar{q}}$ sector we are interested
in, the only part of the interaction that comes into play is the seagull part
(S) given as:

$S_{q\bar{q}}=\sum_{q_{1}^{\prime},q_{2}^{\prime},q_{1},q_{2}}2\tilde{g}^{2}\Delta(\frac{1}{(x_{1}+x_{2})^{2}-(m_{B}/\Omega)^{2}}-\frac{1}{(x_{1}-x_{3})^{2}-(m_{B}/\Omega)^{2}})b_{1^{\prime}}^{\dagger}d_{2^{\prime}}^{\dagger}b_{1}d_{2}$
(1.12)

where

$\Delta=\delta(k^{+}_{1^{\prime}}+k^{+}_{2^{\prime}}|k^{+}_{1}+k^{+}_{2})\delta^{2}(k^{\perp}_{1^{\prime}}+k^{\perp}_{2^{\prime}}|k^{\perp}_{1}+k^{\perp}_{2});\hskip
28.45274pt\tilde{g}^{2}=g^{2}P^{+}/(2\Omega)$

$b_{1}d_{2}$ annihilates a quark and an antiquark with the quantum numbers
described by $q_{1},q_{2}$ while
$b_{1^{\prime}}^{\dagger}d_{2^{\prime}}^{\dagger}$ creates a quark and an
antiquark with the quantum numbers described by
$q_{1^{\prime}},q_{2^{\prime}}$.The additional $(m_{B}/\Omega)^{2}$ term is
added to the exchange boson propagator to remove the singularity. With the
explicit form of the Hamiltonian in the $\ket{q\bar{q}}$ sector, we can write
the Hamiltonian in the basis of Fock states[4]:

$\matrixelement{\mu_{m}}{H}{\mu_{n}}.$

##  2 The Generalized Parton Distribution Function (GPD)

###  2.1 Overview of the GPD

The GPD [6] is a description of the probability amplitude to find a parton
with a fraction of the total light-front momentum after an interaction, such
as that with a photon, as well as an increase in transverse momentum. The
handbag diagram for this process is given in figure 1.

The handbag diagram shows a hadron (shown as the ovular region) which has
initial momentum $\ket{P}$, which is struck by a virtual photon $\gamma^{*}$,
that has been emitted by an electron with momentum $\ket{k}$. From here, the
virtual photon strikes a parton inside the hadron which changes its momentum
and thus the total momentum of the hadron is changed to $\ket{P^{\prime}}$.
After the photon’s interaction with the parton, a real photon is emitted
$\gamma$ to satisfy momentum conservation. The GPD $F^{q}(x,\xi,t)$, describes
the off-diagonal matrix elements between $\ket{P}$ and $\ket{P^{\prime}}$. We
are now working in 2 + 1D (the formalism for the added dimension will be
discussed in the following section) so the GPD is a function of two new
variables besides the standard momentum fraction $x=\boldsymbol{n}/K$. $\xi$
is called the skewness, the transfer of longitudinal momentum, and
$t=(P-P^{\prime})^{2}$ is the invariant momentum transfer.

Figure 1: The Handbag diagram for Deeply Virtual Compton Scattering (DVCS).
Source: Nature[9]

###  2.2 Formal Definition of the GPD

The quark distributions are defined by M. Diehl as

$F^{q}=\frac{1}{2}\int\frac{dz^{-}}{2\pi}e^{ixP^{+}z^{-}}\matrixelement{P^{\prime}}{\bar{q}(-\frac{z}{2})\gamma^{+}q(\frac{z}{2}))}{P}|_{z^{+}=\boldsymbol{z}=0}$
(2.1)

where $q(\frac{z}{2})$ is a quark field operator and $\gamma^{+}$ is one of
the LF Dirac matrices defined by

$\gamma^{+}=\gamma^{0}+\gamma^{3}.$

In order to put equation 2.1 to use, we must write the quark field operators
in terms of fermionic and bosonic creation and annihilation operators as well
as define the Fock states in 2 + 1D formalism.

Note that in the limit that $t=0$, (i.e. the incoming and outgoing hadronic
states are the same: $\ket{P}=\ket{P^{\prime}}$), we obtain the formal
definition of the PDF and hence:

$F^{q}(x,0,0)=f_{q}(x).$

###  2.3 GPD in terms of Fock operators

$\begin{split}F^{q}(x,\xi)&=\frac{1}{2\bar{P}^{+}}\int\frac{d^{2}k_{T}}{2\sqrt{\absolutevalue{x^{2}-\xi^{2}}(2\pi)^{3}}}\\\
&\sum_{\lambda}[\bra{P^{\prime}}b_{\lambda}^{\dagger}((x-\xi)\bar{P}^{+},k_{T}-\Delta_{T})b_{\lambda}((x+\xi)\bar{P}^{+},k_{T})\ket{P}\theta(x\geq\xi)\\\
&+\bra{P^{\prime}}d_{\lambda}^{\dagger}((-x+\xi)\bar{P}^{+},-k_{T}+\Delta_{T})b_{-\lambda}((x+\xi)\bar{P}^{+},k_{T})\ket{P}\theta(-\xi<x<\xi)\\\
&-\bra{P^{\prime}}d_{\lambda}^{\dagger}((-x-\xi)\bar{P}^{+},k_{T}-\Delta_{T})d_{\lambda}((-x+\xi)\bar{P}^{+},k_{T})\ket{P}\theta(x\leq\xi)]\end{split}$
(2.2)

Golec-Biernat and Martin (as well as Ji)[7] [8] give the explicit form of the
GPD (off-diagonal distribution) in terms of creation/annihilation operators by
writing the quark field operators $q(\frac{-z}{2})$ in terms of these
operators (eq 2.2). This is called the off-diagonal distribution because it
connects different Fock states $\ket{P}$ and $\ket{P^{\prime}}$ where as the
PDF (forward distributions) are diagonal and connect the same states. $F^{q}$
simplifies when we look at the zero skewness case ($\xi=0)$ since we are
interested in hadrons with the same resolutions before and after an
interaction.

$\ket{P}$ is the hadronic bound state that is obtained by running VQE with the
2 + 1D Hamiltonian above. This state will be a superposition of Fock states
defined for a particular $\ket{q\bar{q}}$ sector depending on
$(P^{+},P_{\perp})$. $\ket{P^{\prime}}$ can be any chosen output state (not
all output states will give non-zero GPDs as not all states can be "reached"
by the interaction from a photon). The four-vector
$P^{\prime\mu}=(P^{\prime+},P^{\prime-},P^{\prime}_{\perp})$ allows us to
choose $P^{\prime+}$ and $P^{\prime}_{\perp}$ and subsequently create a new
set of Fock states $\\{\ket{\mu_{n}^{\prime}}\\}$ that satisfy the parameters
given by $P^{\prime\mu}$. Each of these primed Fock states can be used as
$\ket{P^{\prime}}$.

We can prepare the state $\ket{P}$ on a quantum computer and treat
$F^{q}(x,\xi)$ as an observable which can be measured on a quantum device. An
obeservable $\mathcal{Q}$ on a quantum computer is measured by measuring its
expectation value in some state $\ket{\psi}$:
$\expectationvalue{\mathcal{Q}}=\expectationvalue{\mathcal{Q}}{\psi}$. In
order to treat $F^{q}$ as an observable, we must transform the state
$\bra{P^{\prime}}\rightarrow\bra{P}$ so that we can calculate the expectation
value and thus measure the observable. There exists some operator, $O$ such
that $\ket{P^{\prime}}=O\ket{P}$ (or $\bra{P^{\prime}}=\bra{P}O^{\dagger}$).
We need $O$ to be analogous to the Lorentz boost in the transverse direction
(i.e. leaves $P^{+}$ unchanged while changing $P_{\perp}\rightarrow
P^{\prime}_{\perp}$.) In equal time coordinates,
$p^{\mu}=(p^{0},p^{1},p^{2},p^{3})$ and a Lorentz boost in the transverse
direction is given by:

$\begin{cases}P^{\prime i}_{\perp}=\gamma(P_{\perp}-\beta p^{0});i=1,2\\\
p^{\prime 0}=\gamma(p^{0}-\beta P_{\perp})\\\ p^{\prime 3}=p^{3}.\end{cases}$

In LF coordinates, $p^{\mu}=(P^{+},P^{-},\vec{P}_{\perp})$ $P^{\pm}=P^{0}\pm
P^{3}$, $P_{\perp}=(P^{1},P^{2})$.
$P^{0}=\frac{1}{2}(P^{+}+P^{-}),P^{3}=\frac{1}{2}(P^{+}-P^{-})$. Thus,

$\begin{cases}P^{\prime}_{\perp}=\gamma(P_{\perp}-\frac{1}{2}\beta\cdot(P^{+}+P^{-}))\\\
P^{\prime\pm}=e^{\mp\varphi}P^{\pm}\end{cases}$

with $\varphi=\frac{1}{2}\ln(\frac{1+\beta}{1-\beta})$[11]. This gives

$\Lambda^{\mu}_{\nu_{(LF)}}=\begin{pmatrix}e^{-\varphi}&0&0\\\
0&e^{\varphi}&0\\\ -\beta/2&-\beta/2&\gamma\end{pmatrix}_{LF}.$ (2.3)

Then [10] the Lorentz-transformed creation an annihilation operators are

$U(\Lambda)a^{\dagger}(p)U^{\dagger}(\Lambda)=a^{\dagger}(\Lambda p)$ (2.4)

and

$U(\Lambda)a(p)U^{\dagger}(\Lambda)=a(\Lambda p).$ (2.5)

Given $\ket{P}=\ket*{q\bar{q}:q_{1},q_{2}}$,
$\ket{P^{\prime}}=\ket*{q\bar{q}:q^{\prime}_{1},q^{\prime}_{2}}$, where
$q_{i}=\\{k_{i}^{+},\vec{k}_{i,\perp}\\}$, we need $O$ to first annihilate the
quantum numbers $q_{i}$ in $\ket{P}$ and then create the quantum numbers
$q^{\prime}_{j}$ depending on what we choose for $\ket{P^{\prime}}$ i.e.

$O=\sum_{q_{i},q_{j}}c^{\dagger}(q_{j})c(q_{i})$ (2.6)

where the sum goes over all Fock states in $\ket{P}$( $c=b$ for fermions and
$c=d$ for antifermions).

Since we are disregarding helicity, we can drop the summation over $\lambda$
and rewrite $F^{q}$ in the discrete case (with $\xi=0)$: $\int
d^{2}k_{T}\rightarrow\sum_{k_{T}}$

$F^{q}(x,0)=\frac{1}{4(2\pi)^{3/2}x\bar{P^{+}}}\sum_{k_{T}}\expectationvalue{\mathcal{F}^{q}}{P}$
(2.7)

where

$\displaystyle\mathcal{F}^{q}=$
$\displaystyle\sum_{q_{i},q_{j}}c_{q_{i}}^{\dagger}c_{q_{j}}[b^{\dagger}(n,k_{T}-\Delta_{T})b(n,k_{T})\theta(n)$
$\displaystyle-d^{\dagger}(-n,k_{T}-\Delta_{T})d(-n,k_{T})\theta(-n)].$

(Here $n=x\bar{P^{+}}$). The first operator in $\mathcal{F}^{q}$ is
$O^{\dagger}$ such that when it acts on $\bra{P}$, it returns
$\bra{P^{\prime}}$. $\mathcal{F}^{q}$ is not Hermitian, so in order to measure
this observable on a quantum computer, we must decompose this operator into
its real and imaginary components:

$\Re{\mathcal{F}^{q}}=\frac{1}{2}(\mathcal{F}+\mathcal{F}^{\dagger})$
$\Im{\mathcal{F}^{q}}=\frac{1}{2i}(\mathcal{F}-\mathcal{F}^{\dagger}).$

Figure 2: GPD of $\ket{P}$

We can measure the real and imaginary components separately on a quantum
computer which will give us a value for the observable $\mathcal{F}^{q}$ and
thus $F^{q}$. In order to find $\ket{P}$, we search for the ground bound state
in the K-block of the $\ket{q\bar{q}}$ sector of the lightfront Hamiltonian.

###  2.4 GPDs

In what follows, the parameters chosen are $P^{+}=P^{+\prime}=3$,
$P_{\perp}=0$, $P_{\perp}^{\prime}=1$, $\Lambda_{\perp}=1$,
$\Lambda_{nc}=5832$ (the total momentum cutoff), $g=0.001$, and $m_{F}=36$,
$m_{B}=0.5$ which gives the bound state mass for the Pion as $m_{\pi}=139.7$
$MeV/c^{2}$. Essentially, we are interested in the GPD of a pion gaining
another unit of transverse momentum only after an interaction.

When running VQE with the Hamiltonian above, as well as a trial state from the
Fock space given the parameters for $\ket{P}$ above, the ground state is found
via Qiskit’s Statevector class to be:

$\displaystyle\ket{P}$ $\displaystyle=0.7078\ket{q\bar{q}:(1,0);(2,0)}$ (2.8)
$\displaystyle\hskip 28.45274pt-0.7063\ket{q\bar{q}:(2,0);(1,0)}.$

It was found that the initial parameters for the circuit must be negative so
that we achieve an anti-symmetric statefunction, necessary to describe
fermions.

From here, we can calculate the GPD on a quantum computer as an observable via
equation 2.7. We can alter the value of $n$ and then graph our GPD values for
various $x$ given in figure 2.

##  3 Summary

The GPD is a transition amplitude (not probability) of transitioning from the
state $\ket{P}$ to the state $\ket{P^{\prime}}$ defined above. In the zero-
skewness case $\xi=0$, the only states that the hadron can transition to are
states with the same light-front momentum but with different transverse
momentum. We look at $\ket{P^{\prime}}$ such that the fermion gains an
increased unit of transverse momentum.

By concentrating on the $q\bar{q}$ sector, we have simulated a $\pi^{0}$ type
hadron, whose wave function is predominantly valence quarks. The Yukawa bosons
are stand-ins for gluons, but have mass and spin 0. While we have not solved
the full QCD Hamiltonian, using light front quantization, we have shown how a
simpler quantum field theory gives rise to hadronic states composed of Fock
states. Those states are mapped onto qubit states - the state preparation
being a crucial part of the connection to quantum computers. From the VQE
optimization, states are constructed whose resulting pdf’s and GPD’s can be
extracted, ultimately by quantum computers. The resulting distributions show
very reasonable resemblances to known measured distribution functions.

In future work, by extending the Hamiltonian to include flavors and colors, as
well as a third space dimension, a more realistic representation of hadrons
via quantum computers will be sought. Additionally, we hope to study baryonic
and diquark-quark bound states.

##  4 Appendix

To define the operator that maps $\ket{P}to\ket{P^{\prime}}$, we consider an
example. We start with $\ket{P}$ defined in equation 2.5. We take
$\ket{P^{\prime}}$ to be the state such that the fermion in the first state of
the superposition gains an increased unit of transverse momentum, i.e.:

$\displaystyle\ket{P^{\prime}}$
$\displaystyle=0.7078\ket{q\bar{q}:(1,1);(2,0)}$ (4.1) $\displaystyle\hskip
28.45274pt-0.7063\ket{q\bar{q}:(2,1);(1,0)}.$

To construct $O$, we clearly must include a $b^{\dagger}b$ term that
annihilates the fermions with quantum numbers $(1,0)$ and creates a fermion
with quantum numbers $(1,1)$. Additionally, we will want a term that
annihilates the fermion with quantum numbers $(2,0)$ and creates a fermion
with an increased unit of transverse momentum: $(2,1)$. Thus, in this case,

$O=b^{\dagger}(1,1)b(1,0)+b^{\dagger}(2,1)b(2,0)$

##  5 Acknowledgements

We have benefited from communications with our quantum computer group
colleagues at Tufts and with S. Brodsky, G. deTeramond, J. Vary.

## References

  * [1] Hans-Christian Pauli and Stanley J. Brodsky. “Dis- cretized light-cone quantization: Solution to a field theory in one space and time dimension.” In: Phys- ical Review D 32.8 (1985), pp. 2001–2013. DOI: https://journals.aps.org/prd/abstract/10.1103/PhysRevD.32.2001.
  * [2] Michael Kreschuk et al. “Quantum Simulation of Quantum Field Theory in the Light-Front Formula- tion”. In: (2020). DOI: https://arxiv.org/pdf/2002.04016.pdf.
  * [3] Stanley J. Brodsky, Hans-Christian Pauli, and Stephen S. Pinsky. “Quantum Chromodynamics and Other Field Theories on the Light Cone”. In: (Apr. 28, 1997). DOI: https://arxiv.org/pdf/hep-ph/9705477.pdf.
  * [4] Roger Donald Kylin. “THE MESON MASS SPEC- TRUM FROM A SYSTEMATICALLY RENOR- MALIZED LIGHT-FRONT HAMILTONIAN”. In: (Mar. 13, 2001). DOI: https://arxiv.org/pdf/hep-ph/0103129.pdf.
  * [5] Frank Wölz. “Discretized Light-Cone Quantiza- tion”. In: (1995). DOI: https://dr.lib.iastate.edu/entities/publication/3dda1fb8-35ae-45c2-a401-f6d26f5333de
  * [6] M. Diehl. “Generalized Parton Distributions”. In: (Oct. 17, 2003). DOI:https://arxiv.org/pdf/hep-ph/0307382.pdf
  * [7] K.J. Golec-Biernat and A.D. Martin. “Off-diagonal parton distributions and their evolution”. In: (Aug. 12, 1998). DOI: https://arxiv.org/pdf/hep-ph/9807497.pdf
  * [8] Xiangdong Ji. “GENERALIZED PARTON DIS- TRIBUTIONS”. In: (2004). DOI: https://www.annualreviews.org/doi/pdf/10.1146/annurev.nucl.54.070103.181302.
  * [9] M. Benali et al. “Deeply virtual Compton scattering off the neutron”. In: (Jan. 27, 2020). DOI: https://www.nature.com/articles/s41567-019-0774-3.
  * [10] Sidney Coleman. “Notes from Sidney Coleman’s Physics 253a”. In: (Sept. 21, 2013). Ed. by Yuan- Sen Ting and Bryan Gin-ge Chen. DOI: https://arxiv.org/pdf/1110.5013.pdf.
  * [11] Jorge Henrique Sales et al. “Special relativity on the light-front”. In: (Jan. 28, 2021). DOI: https://www.scielo.br/j/rbef/a/wh9hgMSRTJzvws8ZxzL8NNp/?lang=en&format=pdf.


2023

[1]Md. Alamin Talukder

1]Department of Computer Science and Engineering, International University of
Business Agriculture and Technology, Dhaka, Bangladesh 2]Department of
Computer Science and Engineering, Jagannath University, Dhaka, Bangladesh
3]School of Information Technology, Deakin University, Waurn Ponds Campus,
Geelong, Australia

# MLSTL-WSN: Machine Learning-based Intrusion Detection using SMOTETomek in
WSNs

<EMAIL_ADDRESS>Selina Sharmin<EMAIL_ADDRESS>Md Ashraf Uddin
<EMAIL_ADDRESS>Md Manowarul Islam<EMAIL_ADDRESS>Sunil
Aryal<EMAIL_ADDRESS>[  [  [

###### Abstract

In the domain of cyber-physical systems, Wireless Sensor Networks (WSNs) play
a pivotal role as infrastructures, encompassing both stationary and mobile
sensors. These sensors self-organize and establish multi-hop connections for
communication, collectively sensing, gathering, processing, and transmitting
data about their surroundings. Despite their significance, WSNs face rapid and
detrimental attacks that can disrupt functionality. Existing intrusion
detection methods for WSNs encounter challenges such as low detection rates,
computational overhead, and false alarms. These issues stem from sensor node
resource constraints, data redundancy, and high correlation within the
network. To address these challenges, we propose an innovative intrusion
detection approach that integrates Machine Learning (ML) techniques with the
Synthetic Minority Oversampling Technique Tomek Link (SMOTE-TomekLink)
algorithm. This blend synthesizes minority instances and eliminates Tomek
links, resulting in a balanced dataset that significantly enhances detection
accuracy in WSNs. Additionally, we incorporate feature scaling through
standardization to render input features consistent and scalable, facilitating
more precise training and detection. To counteract imbalanced WSN datasets, we
employ the SMOTE-Tomek resampling technique, mitigating overfitting and
underfitting issues. Our comprehensive evaluation, using the Wireless Sensor
Network Dataset (WSN-DS) containing 374,661 records, identifies the optimal
model for intrusion detection in WSNs. The standout outcome of our research is
the remarkable performance of our model. In binary classification scenarios,
it achieves an accuracy rate of 99.78%, and in multiclass classification
scenarios, it attains an exceptional accuracy rate of 99.92%. These findings
underscore the efficiency and superiority of our proposal in the context of
WSN intrusion detection, showcasing its effectiveness in detecting and
mitigating intrusions in WSNs.

###### keywords:

Wireless sensor network; Intrusion detection; Machine learning; SMOTE; Sensor
nodes

##  1 Introduction

Wireless Sensor Networks (WSNs) have emerged as a transformative technology
that enables the collection, processing, and transmission of data from
distributed sensor nodes. These nodes are equipped with various sensors and
communication capabilities, allowing them to monitor and sense the environment
gebremariam2023design. WSNs find applications in diverse domains such as
environmental monitoring, healthcare, smart cities, and industrial automation.
They offer the advantage of remote and real-time data acquisition from
inaccessible or hazardous locations, enabling efficient data-driven decision-
making processes chataut2023unleashing; talukder2024machine. WSN security is
of paramount importance due to the sensitive nature of the data transmitted
and the potential vulnerabilities in the network yakubu2023resource. WSNs face
various security threats, including unauthorized access, data tampering, and
denial of service attacks nimbalkar2023security. The distributed and wireless
nature of WSNs makes them more susceptible to these threats. Ensuring the
confidentiality, integrity, and availability of data within WSNs is crucial to
maintaining the trust and reliability of these networks alghamdi2023cascaded.

Intrusion detection is a critical component of WSN security, aimed at
detecting and mitigating malicious activities within the network
heidari2022internet. Traditional rule-based intrusion detection systems often
rely on predefined signatures or thresholds, which are not effective in
detecting sophisticated attacks that evolve sezgin2023aid4i. Machine Learning
(ML) techniques have emerged as a promising approach for WSN intrusion
detection gebremariam2023design. ML algorithms can learn from historical data
and identify anomalies or patterns indicative of potential intrusions,
enabling proactive and adaptive security measures talukder2023dependable;
talukder2024machine. Machine Learning techniques in WSN enable the development
of intelligent intrusion detection systems ghazal2022data. These systems can
analyze vast collected data, identify abnormal patterns, and distinguish
between normal and malicious behavior talukder2022machine. ML algorithms, such
as decision trees, random forests, neural networks, and gradient boosting
methods, can extract valuable insights from complex WSN datasets, improving
the accuracy and effectiveness of intrusion detection mechanisms
talukder2023dependable; gebremariam2023design.

Existing works in WSN intrusion detection face several challenges. Limited
scalability is a significant concern, as WSNs often involve a large number of
sensor nodes, leading to increased computational complexity sharmin2023energy.
High false positive rates and inadequate adaptability to evolving attack
techniques are also challenges that need to be addressed tan2019wireless;
ifzarne2021anomaly; alruhaily2021multi. Additionally, the imbalanced nature of
WSN datasets, with a majority of normal instances and a small number of
intrusion instances, poses challenges for achieving accurate detection results
singh2020fuzzy; chandre2022intrusion; putrada2022xgboost. Our proposed model,
which combines Machine Learning (ML) techniques with the Synthetic Minority
Oversampling Technique Tomek (SMOTE-Tomek), offers a significant advancement
in intrusion detection for WSNs (WSNs) tan2019wireless; zhang2020effective;
mohammadi2023novel. This model holds great importance in addressing the
limitations of existing approaches and providing an optimal solution for
intrusion detection in WSNs.

The primary motivation behind our work stems from the inherent imbalance in
WSN intrusion detection datasets, with a majority of normal instances and a
small number of intrusion instances putrada2022xgboost. This imbalance can
compromise the accuracy of detection results. Our model aims to overcome this
challenge by employing the SMOTE-Tomek technique, synthesizing minority
instances and removing Tomek links to achieve a balanced dataset
chandra2023median. This ensures more accurate and reliable intrusion detection
by enhancing the representation of both normal and intrusion instances.
Additionally, our model harnesses the power of various ML algorithms,
including Decision Trees (DT), Random Forests (RF), Multilayer Perception
(MLP), K-Nearest Neighbor (KNN), and gradient boosting algorithms such as
Extreme boosting (XGB) and Light gradient boosting (LGB). These algorithms
enable the development of a robust intrusion detection system capable of
learning complex patterns and anomalies from WSN data. The adaptability of ML
techniques allows our model to continuously learn and update its knowledge to
effectively detect evolving attack techniques.

The significance of our model lies in its proactive and adaptive security
measures for WSNs. By accurately identifying and mitigating intrusions in
real-time, our model safeguards the integrity and privacy of transmitted data.
This capability is crucial in domains like healthcare, industrial control
systems, and environmental monitoring, where data security and integrity are
paramount.

This paper makes the following key contributions:

  * •

Innovative Intrusion Detection Approach: Introducing a novel intrusion
detection approach that integrates ML techniques with the SMOTE-Tomek
algorithm. By synthesizing minority instances and removing Tomek links, our
model achieves a balanced dataset, resulting in improved accuracy and
reliability in WSNs.

  * •

Feature Scaling for Enhanced Effectiveness: Employing feature scaling through
standardization to transform input features into a consistent and scalable
range. This facilitates more accurate training and detection of intrusions.
Additionally, applying the SMOTE-Tomek resampling technique addresses the
imbalanced nature of WSN datasets, mitigating overfitting and underfitting
issues.

  * •

Comprehensive Model Evaluation: Conducting a thorough evaluation of our ML-
based intrusion detection model using various performance metrics, including
accuracy, precision, recall, and F1 score. Through extensive analysis, we
identify the best-performing model for detecting intrusions in WSNs.

  * •

Performance Comparison: Comparing the performance of our model with existing
approaches to demonstrate its effectiveness and superiority in detecting and
mitigating intrusions in WSNs.

Overall, our contributions enhance the field of intrusion detection in WSNs by
introducing a novel machine learning-based approach that addresses the
challenges of imbalanced datasets. The proposed work combined with effective
feature scaling and resampling techniques, provides an accurate and reliable
solution for detecting intrusions in real-time. The extensive evaluation and
performance analysis validate the effectiveness of our model, positioning it
as a valuable tool for enhancing the security of WSNs.

The remaining sections of this paper are structured as follows: In Section 2,
we delve into a comprehensive review of the existing literature, with a
specific focus on intrusion detection on WSNs. Section 3 provides a detailed
account of our research methodology, including an extensive description of the
dataset employed. The experimental setup and the ensuing performance
evaluation are elaborated upon in Section 4. Subsequently, Section 4.6 is
dedicated to an exhaustive analysis and discussion of our proposed research.
Finally, Section 5 encapsulates the concluding remarks and underscores
potential avenues for future research.

##  2 Related Works

Intrusion detection in wireless sensor networks (WSNs) has received
significant attention in recent years due to the increasing number of attacks
on WSNs. Various machine learning (ML)-based intrusion detection models had
been proposed in the literature to address the limitations of traditional
intrusion detection methods in WSNs.

tan2019wireless introduced an approach that employs the Synthetic Minority
Oversampling Technique (SMOTE) to address dataset imbalance, followed by
training a classifier for intrusion detection using the Random Forest
algorithm. Simulations were performed on a standard intrusion dataset,
demonstrating that the Random Forest algorithm achieved an accuracy of 92.39%,
surpassing other algorithms in comparison. Furthermore, by applying SMOTE to
oversample the minority samples, the accuracy of the Random Forest classifier
improved to 92.57%. This indicates that the proposed method effectively
addresses class imbalance issues and enhances intrusion detection performance.

rezvi2021data presented a data mining approach to detect various types of DoS
attacks, where they applied several classification algorithms, including KNN,
Naïve Bayes, Logistic Regression, Support Vector Machine (SVM), and Artificial
Neural Network (ANN), to the dataset and assessed their performance in
identifying these attacks. The analysis revealed that ANN achieved the highest
accuracy at 98.56%, followed closely by KNN at 98.4%. These results suggest
that ANN and KNN are strong candidates for intrusion detection, making them
suitable recommendations for network specialists and analysts due to their
effectiveness in detecting and predicting such attacks compared to the other
algorithms tested.

meng2022novel presented a LightGBM-based intrusion detection method for
resource-constrained WSNs. It employed the SMOTE-Tomek technique for dataset
balancing and feature selection using an iterative LightGBM tree model, SHAP
analysis, and Recursive Feature Elimination. Model parameters were optimized
with the Optuna algorithm. Compared to standard methods, this approach
achieved exceptional performance, with detection rates exceeding 99% for all
attack types and a 46% reduction in modeling time due to feature dimension
reduction.

singh2020fuzzy developed a fuzzy rule-based system for intrusion prevention in
WSNs, involving three phases: feature extraction, membership value
computation, and fuzzy rule application. Nodes were categorized as ”red”
(malicious, blocked), ”orange” (potentially malicious, marked suspicious), and
”green” (non-malicious, allowed). The system considered parameters like packet
transmission, energy usage, signal strength, received packets, and Packet
Delivery Ratio (PDR). Evaluation yielded a 98.29% accuracy, surpassing other
fuzzy rule-based systems. The key advantage was its ability to block malicious
nodes and prevent intrusions.

alruhaily2021multi proposed a multi-tier intrusion detection framework for
WSNs, implementing a defense-in-depth security approach with two detection
layers. In the initial layer, situated at the distributed network edge
sensors, real-time decision-making for inspected packets was accomplished
using a Naive Bayes classifier. The second layer, positioned in the cloud,
employed a Random Forest multi-class classifier for thorough packet analysis.
The outcomes demonstrated that their multi-layer detection model achieved
impressive performance scores, including a 100% precision rate for Normal
attacks, 90.4% for Flooding attacks, 99.5% for Scheduling attacks, 97% for
Grayhole attacks, and 99.9% for Blackhole attacks.

To offer intrusion prevention methods employing deep packet inspection based
on deep learning techniques. chandre2022intrusion introduced a deep learning
model that utilized a convolutional neural network. This model encompassed two
essential phases: detecting intrusions and preventing them. It acquired
meaningful feature representations from a sizable labeled dataset and
performed accurate classifications. They harnessed the power of the
convolutional neural network to prevent intrusions in WSNs. They employed the
WSN-DS to assess the system’s effectiveness. The test outcomes indicated that
the proposed system achieved a remarkable accuracy rate of 97%, surpassing
existing solutions. Their work could serve as a reference point for future
research in deep learning and intrusion prevention.

dener2022stlgbm developed STLGBM-DDS, an ensemble intrusion detection system
on the Apache Spark platform in Google Colab. It combined LightGBM with data
balancing (using SMOTE and Tomek-Links, STL) and feature selection
(Information Gain Ratio). The study evaluated the impact of these stages on
system performance using various parameters. The proposed method achieved an
outstanding overall accuracy of 99.95%. Specifically, it achieved impressive
accuracy rates: 99.99% for Normal, 99.96% for Grayhole, 99.98% for Blackhole,
99.92% for TDMA, and 99.87% for Flooding classes. These results demonstrated
the system’s exceptional success in detecting Denial of Service (DoS) attacks
in WSNs compared to existing methods.

ifzarne2021anomaly developed an intrusion detection model tailored to WSNs
characteristics, using information gain ratio (IGR) and the online Passive
Aggressive (PA) classifier. Experiments on a WSN-DS dataset resulted in the
proposed model achieving a 96% detection rate for normal behavior or attacks.
Detection accuracies were 86% for scheduling, 68% for grayhole, 63% for
flooding, and 46% for blackhole attacks, with 99% accuracy for normal traffic.
These findings suggest that offline learning-based models can effectively
detect anomalies in WSNs, potentially replacing online learning in some cases.

An optimized collaborative intrusion detection system (OCIDS) was developed by
elsaid2020optimized for WSNs using an enhanced artificial bee colony
optimization (BCO) algorithm. It improved the accuracy of intrusion detection
and resource efficiency. The OCIDS also enhanced the weighted support vector
machine (SVM) algorithm to reduce false alarms. Collaboration among sensor
nodes, cluster heads, and the Base Station (BS) improved intrusion detection.
In tests, the OCIDS outperformed other systems with a 97.9% detection rate and
a 1.8% false alarm rate, demonstrating a clear advantage.

putrada2022xgboost explored the application of XGBoost in Intrusion Detection
Systems (IDS) for imbalanced data in WSNs cyber-attacks. To assess its
performance, they compared XGBoost to decision trees and naive Bayes,
employing various evaluation metrics. The results showed XGBoost’s
superiority, with the highest AUC values across scheduling, normal, grayhole,
flooding, and blackhole classes, achieving 98.7%, 99.63%, 99.94%, 99.97%, and
99.99%, respectively. This research contributes to the advancement of IDS for
imbalanced WSN data, offering valuable insights for further investigations in
this domain.

jiang2020slgbm proposed Sequence-LightGBM (SLGBM) as an intrusion detection
method for WSNs. Initially, the Sequence Backward Selection (SBS) algorithm
was applied to reduce data dimensionality in the feature space of the original
traffic data, thus reducing computational overhead. Subsequently, the LightGBM
algorithm was utilized to detect various network attacks. Experimental results
based on the WSN-DS dataset showed that the F-measure of our proposed SLGBM
was significantly superior to current typical detection methods, achieving
scores of 99.8% for Normal, 99.4% for Blackhole, 99.1% for Grayhole, 96.5% for
Flooding, and 96.1% for Scheduling attack detections, respectively.

khan2022enhancing presented a real-time Intrusion Detection System (IDS) based
on a deep autoencoder for distinguishing malicious actions within IIoT-driven
IICS networks. The model was formulated using a Long Short-Term Memory (LSTM)
autoencoder design specifically tailored to identify invasive events in IICS
networks. The experimental results, conducted on two benchmark datasets,
namely the gas pipeline and UNSW-NB15 datasets, demonstrated the superior
performance of the proposed IDS when compared to other compelling models. The
proposed model achieved an accuracy rate of 97.95% for the gas pipeline data
and 97.62% for the UNSW-NB15 dataset, showcasing its effectiveness in
intrusion detection within industrial control systems.

khan2022federated proposed the federated-SRUs IDS, a novel model for IoT-based
ICS security. It employs an improved SRUs architecture to address
computational issues and uses federated learning for collaborative, privacy-
preserving model building. Experimental validation on gas pipeline-based ICS
data demonstrates real-time intrusion detection with superior performance
compared to existing approaches. The federated-SRUs IDS emerges as an
efficient method for IoT-based ICS network security.

khan2021new proposed an autoencoder-based framework using convolutional and
recurrent networks for cyber threat detection in IIoT networks. The two-step
sliding window enhances feature learning, transforming malicious points into
fixed-length series. Fully connected networks leverage extracted features for
attack event classification and explanation. Empirical results highlight the
framework’s efficacy, outperforming contemporary methods and showcasing
suitability for real-world IIoT networks.

khan2024fed proposed Fed-Inforce-Fusion, a privacy-preserving FL-based IDS for
cyber-attack detection in IoMT networks. The model employs reinforcement
learning to capture latent relationships in medical data. In a distributed FL
system, Secure Healthcare Systems nodes collaboratively train the IDS model,
ensuring privacy. A fusion/aggregation strategy dynamically involves clients,
enhancing model performance and reducing communication overhead. Theoretical
and experimental analyses confirm Fed-Inforce-Fusion’s superiority in
detecting complex attack vectors, establishing its efficacy for real-world
IoMT networks.

ravindra2023etelmad proposed an Enhanced Transient Extreme Learning Machine
Anomaly Detection method to address sensor data anomalies. The process
involved data compression, prediction using an optimized Extreme Learning
Machine (ELM) with Enhanced Transient Search Arithmetic Optimization (ETSAO),
and anomalous detection through dynamic thresholding. Data preprocessing
eliminated duplicates, and Piecewise Aggregate Approximation efficiently
compressed the data. This approach achieved a low-dimensional feature set,
reducing computation/training time in WSN environments. The architecture
attained an impressive 96.90% accuracy on the WSN-DS dataset, surpassing other
approaches. Simulation on the PYTHON platform confirmed the efficacy of the
proposed anomaly detection method.

alruwaili2023red introduced the RKOA-AEID (Red Kite Optimization Algorithm
with Average Ensemble Model for Intrusion Detection) for securing IoT-based
WSNs. The methodology includes pre-processing with min-max normalization,
RKOA-based feature selection, and an average ensemble learning model for
intrusion detection. Additionally, the Lévy-fight chaotic whale optimization
Algorithm (LCWOA) optimizes hyperparameters for the ensemble models. The RKOA-
AEID algorithm was evaluated on the benchmark WSN-DS dataset, achieving an
improved accuracy of 98.94% compared to other approaches.

moundounga2024stochastic proposed an innovative Stochastic ML-Based Attack
Detection System for WSNs, combining Hidden Markov Models (HMMs) and Gaussian
Mixture Models (GMMs). The system utilized Principal Component Analysis for
dimensionality reduction in WSN datasets, preserving vital routing features
while reducing variables. Iterative machine learning Expectation-Maximization
was employed to train HMMs and GMMs, enabling accurate detection and
classification of malicious activities and routing errors. Experimental
results showed that a configuration of 3 HMMs and 4 GMMs achieved an
outstanding accuracy of 94.55%, highlighting the system’s superior
performance. This approach presented a promising solution to enhance WSN
security.

Here, the related works highlight the importance of intrusion detection in
WSNs and the ongoing efforts to develop effective machine learning-based
intrusion detection models. Our proposed hybrid machine learning model offers
a promising solution for intrusion detection in WSNs, providing improved
accuracy and performance compared to previous methods.

##  3 Methodology

We integrated ML techniques with the SMOTE-Tomek algorithm to achieve a
balanced dataset, resulting in improved intrusion detection for WSNs.The
experiments conducted to validate the proposed intrusion detection approach in
WSNs involved rigorous testing and evaluation steps. Below are detailed
descriptions of the experimental procedures and implementation specifics:

  * •

Data Collection Raw data from WSNs was collected to form the foundation for
the experimental dataset. The data encompassed diverse scenarios and network
conditions to ensure the model’s robustness and applicability across real-
world scenarios.

  * •

Preprocessing Techniques A crucial aspect of the methodology involved the
preprocessing of the collected data. Standardization was applied to normalize
input features, ensuring a consistent scale for all variables. Additionally,
label encoding was employed to convert categorical target features into a
numerical format, facilitating compatibility with machine learning algorithms.

  * •

Data Balancing To address the challenge of imbalanced datasets and potential
overfitting, the Synthetic Minority Over-sampling Technique (SMOTE) combined
with the Tomek links removal method (SMOTETomek) was utilized. This technique
ensured a balanced representation of both normal and intrusion instances in
the dataset, contributing to improved model generalization.

  * •

Data Splitting The experimental dataset underwent k-fold cross-validation,
specifically with 10 folds, to split it into training and testing sets. This
iterative splitting process helps in assessing the model’s performance across
various subsets of the data, promoting robustness and generalization.

  * •

Model Building Several machine learning algorithms were implemented for
intrusion detection model development. The ensemble method Random Forest (RF),
decision tree (DT), multilayer perceptron (MLP), k-nearest neighbors (KNN),
XGBoost (XGB), and LightGBM (LGB) were chosen for their diverse strengths in
capturing different patterns within the data.

  * •

Model Evaluation The performance of each developed model was meticulously
evaluated using the test dataset. Various evaluation metrics, including
accuracy, precision, recall, and F1-score, were employed to provide a
comprehensive understanding of the models’ effectiveness and reliability in
detecting and classifying intrusions.

  * •

Model Selection The final step involved selecting the best-performing model
based on the comprehensive evaluation results. The model exhibiting superior
performance across multiple metrics was deemed optimal for intrusion detection
in WSNs. This selection process ensures the chosen model’s suitability for
deployment in real-world scenarios.

The proposed intrusion detection approach, as illustrated in Figure 1,
integrates these experimental steps to create a robust and effective solution
for enhancing the security of Wireless Sensor Networks. The detailed
implementation and evaluation procedures guarantee the reliability and
practicality of the developed intrusion detection models.

Figure 1: The proposed intrusion detection approach in wireless sensor network

The overall algorithmic steps of our proposal for intrusion detection in WSNs
is shown in Algorithm 1 as follows:

Algorithm 1 Intrusion Detection In WSNs Using ML

1:procedure IntrusionDetectionWSN($file\\_path,target\\_column$)

2: Input: WSN-DS as a CSV file path (file_path)

3: Output: Trained ML models, Evaluate Performance of each model

4:

5: procedure ReadCSV($file\\_path$)

6: Initialize DataFrame: $df$

7: $df\leftarrow$ Read CSV file located at $file\\_path$

8: end procedure

9:

10: procedure PreprocessData($df,target\\_column$)

11: Initialize Features: $X$

12: Initialize Target Variable: $y$

13:

14: $X,y\leftarrow$ Extract features and target variable from $df$

15:

16: ApplyStandardization($X$)

17: $X\leftarrow$ Standardize numerical features in $X$

18:

19: EncodeLabels($y$)

20: $y\leftarrow$ Encode categorical labels in $y$ using LabelEncoder

21: end procedure

22:

23: procedure DataBalancing($X,y$)

24: BalanceData($X,y$)

25: $X,y\leftarrow$ Apply SMOTETomek to balance the dataset

26: end procedure

27:

28: procedure SplitData($X,y$)

29: Initialize K-Fold Cross-Validator: $kf$

30: $kf\leftarrow$ Initialize KFold(n_splits=10, shuffle=True)

31:

32: for $train\\_index,test\\_index$ in $kf.split(X,y)$ do

33: $X\\_train,X\\_test\leftarrow$ Split $X$ into training and testing sets

34: $y\\_train,y\\_test\leftarrow$ Split $y$ into training and testing sets

35:

36: BuildModels($X\\_train,y\\_train$)

37: Initialize Each ML Model: $DT$, $RF$, $MLP$, $KNN$, $LGB$, $XGB$

38: Train Each ML Model

39:

40: EvaluatePerformance($X\\_test,y\\_test$)

41: Evaluate Various Performances For Each ML Model

42: end for

43: end procedure

44:end procedure

###  3.1 Dataset Description

The Wireless Sensor Network DoS Detection Dataset (WSN-DS) almomani2016wsn is
a comprehensive collection crafted for the specific purpose of identifying
Denial-of-Service (DoS) attacks in WSNs (WSNs). This dataset, consisting of
374,661 records, was curated using the LEACH protocol, a widely adopted
routing protocol in WSNs, and includes instances of four types of DoS attacks
(Blackhole, Grayhole, Flooding, and Scheduling) as well as normal network
behavior scenarios. Data for WSN-DS was acquired using the Network Simulator 2
(NS-2) tv2006network, processed to produce 23 features, enriching the dataset
with valuable insights a well-established network simulation tool, and the
dataset’s performance evaluation and analysis are facilitated through
integration with the Waikato Environment for Knowledge Analysis (WEKA)
Toolbox, a versatile open-source data mining software suite developed at the
University of Waikato in New Zealand. This resource empowers researchers to
explore and combat DoS threats effectively within WSNs, enhancing network
security in these environments hall2009weka; bouckaert2010weka.

###  3.2 Data Preprocessing

Data preprocessing plays a crucial role in the success of any intrusion
detection system in Wireless Sensor Networks (WSN). It involves several steps
to ensure that the data is in a suitable format for machine learning models.
In this section, we describe the key data preprocessing steps we have applied
to our dataset.

####  3.2.1 Standardization

Standardization is the process of transforming data such that it has a mean of
0 and a standard deviation of 1. This step is essential when dealing with
features that have different scales or units. In WSN intrusion detection,
sensor data may have varying measurement units and scales. Standardization
helps in bringing all features to a common scale, which is important for
machine learning algorithms that rely on distance metrics or gradient-based
optimization.

The formula for standardization is as follows:

$X_{\text{standardized}}=\frac{X-\mu}{\sigma}$

Where:

  * •

$X_{\text{standardized}}$ is the standardized value of feature $X$.

  * •

$X$ is the original feature value.

  * •

$\mu$ is the mean of the feature $X$.

  * •

$\sigma$ is the standard deviation of the feature $X$.

By standardizing the data, we ensure that each feature contributes equally to
the learning process, preventing some features from dominating others.

####  3.2.2 Label Encoding

Intrusion detection datasets often contain categorical variables, such as
attack types or sensor identifiers, that need to be converted into numerical
values for machine learning models. Label encoding is a technique used to
transform categorical data into numerical labels.

  * •

Binary Classification

For binary classification, where we have two classes, ”Normal” and ”Attack,”
we perform label encoding as shown in Table 1.

Table 1: Label Encoding for Binary Classification Class | Label Encoding
---|---
Normal | 0
Attack | 1
  * •

Multiclass Classification

In the case of multiclass classification, where we have multiple classes, such
as ”Normal,” ”Grayhole,” ”Blackhole,” ”TDMA,” and ”Flooding,” we perform label
encoding as shown in Table 2.

Table 2: Label Encoding for Multiclass Classification Class | Label Encoding
---|---
Normal | 0
Grayhole | 1
Blackhole | 2
TDMA | 3
Flooding | 4

After label encoding, the categorical features are represented as numerical
values, making them suitable for use in machine learning algorithms.

Label encoding provides a straightforward way to convert categorical classes
into a format that can be used as input for machine learning models.

In summary, data preprocessing is a critical step in preparing data for
intrusion detection in WSNs. Standardization ensures that all features have a
consistent scale, while label encoding converts categorical data into a
numerical format, enabling the application of various machine learning
algorithms to build an effective intrusion detection model.

###  3.3 Data Balancing using SMOTE-TomekLink

Data balancing refers to the process of adjusting the class distribution
within a dataset to ensure that each class or category has a similar number of
samples or observations. This is particularly important when dealing with
classification tasks where the classes are imbalanced, meaning that one or
more classes have significantly more or fewer instances than others. In the
context of data balancing for Wireless Sensor Networks (WSN), the WSN-DS
dataset exhibits a significant class imbalance issue, impacting classification
performance, especially in the minority classes, which negatively affects
detection rates. Traditional imbalance mitigation methods, such as
undersampling, significantly reduce the usable normal network traffic data,
while oversampling techniques alone lead to excessive data size inflation and
noise. To address this imbalance, we employed the SMOTE-TomekLink (Synthetic
Minority Over-sampling Technique combined with Tomek links) method to balance
our dataset. This approach combines SMOTE and Tomek-Links oversampling and
undersampling methods.

SMOTE is an oversampling technique that generates synthetic data for the
minority class by interpolating between existing samples and their neighbors,
effectively increasing the number of minority class samples. This approach
helps mitigate overfitting issues associated with random oversampling methods
and has been widely adopted to address class imbalance problems. On the other
hand, Tomek-Links is an undersampling technique designed to remove instances
on the ”Tomek link,” which are pairs of data points from different classes
that are close to each other in the dataset. Removing these pairs helps
separate minority and majority classes, reducing noise in the majority class.
By combining the SMOTE and Tomek-Links (STL), the study aims to effectively
tackle the imbalanced class problem in WSN data, providing a balanced dataset
for more accurate intrusion detection. This strategy enhances class
separation, stabilizes data distribution, and ultimately improves the
performance of intrusion detection systems in the context of WSNs. In the
following, we present the data balancing results using SMOTE-Tomek-Link
compared to the unbalanced dataset.

  * •

Binary Classification

In the binary classification dataset, we had the following distribution of
classes without and with SMOTE-TomekLink is shown in Table 3:

Class | WoSTL | WiSTL
---|---|---
Normal | 340,066 | 340,056
Attack | 34,595 | 339,610
Table 3: Binary Classification Class Distribution without and with SMOTE-
TomekLink

The STL technique has effectively balanced the dataset, resulting in a nearly
equal number of samples for both the ”Normal” and ”Attack” classes. This
balanced dataset (WiSTL) is better suited for training machine learning
models, as it reduces the risk of bias towards the majority class.

  * •

Multiclass Data Balancing

In addition to binary classification, we also applied SMOTE-TomekLink to a
multiclass dataset. The class distribution before and after balancing is shown
in Table 4:

Class | WoSTL | WiSTL
---|---|---
Normal | 340066 | 340056
Grayhole | 14596 | 340038
Blackhole | 10049 | 340026
TDMA | 6638 | 339846
Flooding | 3312 | 339820
Table 4: Multiclass Distribution without and with SMOTE-TomekLink

The STL successfully balanced the multiclass dataset by generating synthetic
samples for the minority classes, resulting in a more equitable distribution
across all classes. This balanced dataset (WiSTL) enhances the performance of
machine learning models, particularly when dealing with multiclass
classification tasks.

In conclusion, data balancing using STL is a valuable technique to address
class imbalance issues in intrusion detection datasets, ensuring that machine
learning models are trained on a more representative and balanced dataset,
which can lead to improved classification performance.

###  3.4 ML Algorithms

In this research, we employed six distinct machine learning classifiers,
namely Decision Trees (DT), Random Forest (RF), Multilayer Perceptron (MLP),
k-Nearest Neighbors (KNN), XGBoost (XGB), and LightGBM (LGB), to construct a
model for the detection of intrusions in Wireless Sensor Networks (WSNs). We
evaluated the performance of each classifier using various performance
metrics. In the following subsection, we will delve into the diverse machine
learning techniques employed for our prediction model.

  * •

Decision Trees (DT): Decision trees are versatile tools widely applied in
various domains, including machine learning, image processing, and pattern
recognition talukder2022machine. A decision tree comprises essential
components: the root node, branches, and leaf nodes. The root node represents
the entire dataset, which is partitioned into homogenous subsets. Branches
represent combinations of attributes, while leaf nodes mark the end of the
decision-making process dey2016machine; ahmed2021machine.

  * •

Random Forest (RF): Random Forest, a meta-approximation technique, enhances
accuracy through averaging. It prevents overfitting by fitting multiple
decision tree classifiers to various subsets of the dataset
alkhatib2020predictive. Each subset is chosen independently from the feature
space, resulting in a set of uncorrelated Decision Trees derived from
different training data points breiman2001random. Each tree predicts a class,
and the majority vote among the trees determines the model’s prediction
ahmad2021intrusion.

  * •

Multilayer Perceptron (MLP): The Multilayer Perceptron (MLP) is a classic
artificial neural network architecture characterized by layers of neurons and
their interconnections castro2017multilayer. It computes the weighted sum of
its inputs to produce an output passed to the subsequent neuron. Hidden layers
separate the input and output layers, and neurons are organized into layers,
with information typically flowing from lower to higher layers without
interconnection between neurons within a layer ramchoun2016multilayer.

  * •

K-Nearest Neighbour (KNN): K-Nearest Neighbour is a simple yet effective
supervised machine learning algorithm for classification and regression tasks.
It operates on the principle of proximity, classifying data points based on
the majority class among their nearest neighbors. KNN’s flexibility allows it
to adapt to various data distributions, making it a valuable choice for both
simple and complex datasets kramer2013k.

  * •

Extreme Gradient Boosting (XGB): Extreme Gradient Boosting, often referred to
as XGBoost, is a powerful ensemble learning algorithm known for its
exceptional predictive performance. XGB combines the strengths of decision
trees and gradient boosting, employing an efficient optimization strategy. It
excels in handling large datasets, reducing overfitting, and achieving state-
of-the-art results in various machine learning competitions
talukder2023dependable.

  * •

Light Gradient Boosting (LGB): Light Gradient Boosting, or LGB, is a high-
performance gradient-boosting framework designed for speed and efficiency. LGB
employs a histogram-based algorithm, allowing it to process data rapidly while
maintaining competitive predictive accuracy. Its lightweight nature makes it a
preferred choice for real-time and resource-constrained applications,
including web services and mobile applications kaur2023p2adf.

##  4 Results and Discussion

###  4.1 Experiment Setup

The experiments are carried out on a machine running Microsoft Windows 11 Pro,
with a The experiments were conducted on a computational environment running
Microsoft Windows 11 Pro. This system was equipped with an Intel(R) Core(TM)
i7-8665U CPU operating at 1.90GHz, featuring 2 cores and 4 logical processors,
complemented by a 500GB SSD and 16GB of RAM. The experimentation was performed
within the Anaconda Navigator environment using a Jupyter notebook. The
implementation of the proposed model was realized using the Python programming
language, making use of a selection of commonly utilized libraries, including
Pandas, NumPy, Matplotlib, Seaborn, TensorFlow, Keras, Scikit-learn, and
others.

###  4.2 Performance Evaluation Metrics

The evaluation of our proposed model involved the utilization of multiple
performance metrics to assess its effectiveness. These metrics are defined as
follows:

  * •

Confusion Matrix: Table 5 shows the confusion matrix where TP represents True
Positive, TN represents True Negative, FP stands for False Positive, and FN
denotes False Negative.

| Actual Positive | Actual Negative
---|---|---
Predicted Positive | TP | FP
Predicted Negative | FN | TN
Table 5: Confusion Matrix

  * •

Accuracy:

$Accuracy=\frac{TP+TN}{TP+FP+FN+TN}$ (1)

  * •

Precision:

$Precision=\frac{TP}{TP+FP}$ (2)

  * •

Recall:

$Recall=\frac{TP}{TP+FN}$ (3)

  * •

F1-Score:

$F1\text{-}score=2\cdot\frac{\text{Precision}\cdot\text{Recall}}{\text{Precision}+\text{Recall}}$
(4)

  * •

MAE (Mean Absolute Error):

$MAE=\frac{\sum_{i=1}^{n}\mbox{{}\rm\sf\leavevmode\hbox{}\hbox{}predicted(i) -
actual(i)\/}}{n}\end{equation}\par\par\itemize@item@MSE(MeanSquaredError):\begin{equation}MSE=\frac{\sum_{i=1}^{n}(predicted(i)-actual(i))^{2}}{n}\end{equation}\par\par\itemize@item@RMSE(RootMeanSquaredError):\begin{equation}RMSE=\sqrt{\frac{\sum_{i=1}^{n}(predicted(i)-actual(i))^{2}}{n}}\end{equation}Here,nrepresentsthetotalnumberofvalues.\par\par\itemize@item@\textbf{ROC}Curvesaretwo-
dimensionalplotscommonlyemployedforevaluatingclassifiereffectiveness.AnAUC(AreaUndertheCurve)valueapproaching1indicatesstrongclassseparability,whileanAUCvalueapproaching0indicatessuboptimalperformance.\par\par$
(7)

###  4.3 Results Analysis

In our experiments, we have conducted both binary and multilabel intrusion
detection in WSNs where we achieved significant performance in detecting
intrusion in WSNs efficiently. Besides, we conducted two separate experiments
With SMOTETomek-Link (WiSTL) and Without SMOTETomek-Link (WoSTL) to provide
efficiency of data balancing and improve the performance of our proposed
approach for WSNs.

###  4.4 Binary Results Analysis

In the binary results analysis, we evaluated the performance of different ML
algorithms for intrusion detection in WSNs. Two experiments were conducted:
one with SMOTETomek-Link (WiSTL) and another without SMOTETomek-Link (WoSTL).

Technique | ML | Accuracy | Precision | Recall | F1-score | MAE | MSE | RMSE
---|---|---|---|---|---|---|---|---
WoSTL | DT | 99.52 | 98.63 | 98.57 | 98.6 | 0.48 | 0.48 | 6.91
RF | 99.69 | 99.26 | 98.9 | 99.08 | 0.31 | 0.31 | 5.59
MLP | 99.63 | 99.13 | 98.72 | 98.92 | 0.37 | 0.37 | 6.05
KNN | 99.63 | 99.17 | 98.68 | 98.92 | 0.37 | 0.37 | 6.05
LGB | 99.61 | 98.82 | 98.9 | 98.86 | 0.39 | 0.39 | 6.24
XGB | 99.72 | 99.44 | 98.93 | 99.18 | 0.28 | 0.28 | 5.27
WiSTL | DT | 99.65 | 99.65 | 99.65 | 99.65 | 0.35 | 0.35 | 5.92
RF | 99.78 | 99.78 | 99.78 | 99.78 | 0.22 | 0.22 | 4.72
MLP | 99.37 | 99.38 | 99.37 | 99.37 | 0.63 | 0.63 | 7.92
KNN | 99.5 | 99.5 | 99.5 | 99.5 | 0.5 | 0.5 | 7.1
LGB | 99.62 | 99.62 | 99.62 | 99.62 | 0.38 | 0.38 | 6.13
XGB | 99.76 | 99.76 | 99.76 | 99.76 | 0.24 | 0.24 | 4.93
Table 6: Binary performance analysis of with and without data balancing using
SMOTETomek

From Table 6, we can observe the performance scores of each algorithm in both
experiments. It is important to note that a higher accuracy, precision,
recall, and F1 score indicate better performance, while lower values for MAE,
MSE, and RMSE indicate more accurate predictions. Comparing the results
between WiSTL and WoSTL experiments, we can see that the majority of the
algorithms achieve higher performance scores in the WiSTL experiment, which
indicates that the data balancing technique (SMOTETomek-Link) improves the
overall performance of the intrusion detection models in WSNs.

In evaluating the binary performance of accuracy, precision, recall, and
f1-score performances of various ML models for intrusion detection in WSNs,
the presented table 6 reveals robust performance across all techniques. In the
scenario of WoSTL, DT, RF, MLP, KNN, LGB, and XGB achieved accuracies of
99.52%, 99.69%, 99.63%, 99.63%, 99.61%, and 99.72%, respectively. The
corresponding precision values of 98.63%, 99.26%, 99.13%, 99.17%, 98.82%, and
99.44%, respectively. The corresponding recall values for these models are
98.57%, 98.9%, 98.72%, 98.68%, 98.9%, and 98.93%, respectively. The
corresponding F1-score values of 98.6%, 99.08%, 98.92%, 98.92%, 98.86%, and
99.18%, respectively. When applying data balancing with SMOTETomek (WiSTL),
accuracy, precision, recall, and f1-score values generally improved. In the
scenario of WiSTL, DT, RF, MLP, KNN, LGB, and XGB achieved accuracies of
99.65%, 99.78%, 99.37%, 99.5%, 99.62%, and 99.76%, respectively. The
corresponding precision values of 99.65%, 99.78%, 99.38%, 99.5%, 99.62%, and
99.76%, respectively. The corresponding recall values for these models are
99.65%, 99.78%, 99.37%, 99.5%, 99.62%, and 99.76%, respectively. The
corresponding F1-score values of 99.65%, 99.78%, 99.37%, 99.5%, 99.62%, and
99.76%, respectively. Among these, Random Forest consistently demonstrated the
highest performance scores in all scenarios, making it the model providing
superior performance for intrusion detection in WSNs in the given context.

In assessing the MAE, MSE, and RMSE performances of various ML models for
intrusion detection in WSNs reveals notable outcomes across all techniques. In
the scenario of WoSTL, DT, RF, MLP, KNN, LGB, and XGB achieved low MAE values
of 0.48, 0.31, 0.37, 0.37, 0.39, and 0.28, respectively. The corresponding MSE
values were 0.48, 0.31, 0.37, 0.37, 0.39, and 0.28, while RMSE values were
6.91, 5.59, 6.05, 6.05, 6.24, and 5.27. When applying data balancing with
SMOTETomek (WiSTL), MAE, MSE, and RMSE values generally improved. The DT, RF,
MLP, KNN, LGB, and XGB achieved low MAE values of 0.35, 0.22, 0.63, 0.5, 0.38,
and 0.24, respectively. The corresponding MSE values were 0.35, 0.22, 0.63,
0.5, 0.38, and 0.24, while RMSE values were 5.92, 4.72, 7.92, 7.1, 6.13, and
4.93. Among these, RF consistently demonstrated the lowest MAE, MSE, and RMSE
values in both scenarios, making it the model providing superior performance
for intrusion detection in WSNs in the given context.

Figure 2 compares the accuracy in graphical form of various ML models on WoSTL
and WiSTL models. For the WoSTL experiment, DT algorithm achieved an accuracy
rate of 99.52%, indicating its ability to accurately classify instances as
either normal or intrusions. The RF algorithm outperformed DT with an accuracy
rate of 99.69%. This higher accuracy can be attributed to the ensemble nature
of RF, which combines multiple decision trees to make more robust predictions.
The MLP algorithm achieved an accuracy rate of 99.63%, demonstrating its
capability to learn complex patterns and classify instances effectively.
Similarly, the KNN algorithm achieved an accuracy rate of 99.63%, indicating
its success in identifying similar instances and making accurate predictions.
The LGB algorithm achieved an accuracy rate of 99.61%, showcasing its
efficiency in handling large-scale datasets and producing accurate results.
Lastly, the XGB algorithm achieved the highest accuracy rate of 99.72%,
showcasing its ability to leverage gradient boosting and make accurate
predictions.

In the WiSTL experiment, where the SMOTETomek-Link technique was employed for
data balancing, the accuracy rates of the machine learning algorithms were
further improved. The DT algorithm achieved an accuracy rate of 99.65%,
demonstrating its robustness in handling imbalanced datasets and effectively
detecting intrusions. The RF algorithm, once again, showed superior
performance with an accuracy rate of 99.78%. This high accuracy highlights the
effectiveness of RF in capturing the complex relationships and detecting
intrusions accurately. The MLP algorithm achieved an accuracy rate of 99.37%,
indicating its ability to learn intricate patterns and classify instances with
high accuracy. The KNN algorithm achieved an accuracy rate of 99.5%,
showcasing its success in identifying similar instances and making accurate
predictions. The LGB algorithm achieved an accuracy rate of 99.62%,
emphasizing its efficiency in handling imbalanced datasets and producing
accurate intrusion detection results. Finally, the XGB algorithm achieved an
accuracy rate of 99.76%, demonstrating its ability to leverage gradient
boosting and accurately classify instances in WSNs.

Overall, the inclusion of the SMOTETomek-Link technique (WiSTL experiment)
resulted in improved accuracy rates for all the machine learning algorithms
compared to the WoSTL experiment. This underscores the importance of data
balancing techniques in enhancing the performance of intrusion detection
models in WSNs. Additionally, the consistently high accuracy rates across
multiple algorithms validate the effectiveness of machine learning approaches
in accurately detecting intrusions and ensuring the security of WSNs.

Figure 2: Binary accuracy analysis of ML model for WSNs

(a) Performance (b) Error

Figure 3: Binary performance analysis for WSNs

From Figure 3, it is evident that RF outperforms other algorithms in terms of
performance metrics in the WiSTL experiment for intrusion detection in WSNs.
RF consistently achieves the highest accuracy rate of 99.78%, indicating its
ability to correctly classify instances as either normal or intrusions.
Furthermore, RF exhibits lower error rates, with a mean absolute error (MAE)
of 0.22%, mean squared error (MSE) of 0.22%, and root mean squared error
(RMSE) of 4.72%. These low error rates suggest that RF minimizes the
discrepancies between predicted and actual intrusion labels, further affirming
its effectiveness in accurately detecting intrusions in WSNs. Overall, the
superior performance of RF highlights its suitability as a reliable and robust
algorithm for intrusion detection tasks in WSNs.

Figure 4 reveals additional insights into the performance of RF compared to
other ML models in the WiSTL experiment for intrusion detection in WSNs. RF
demonstrates higher true positive and true negative rates compared to other
algorithms, indicating its superior ability to correctly identify both normal
instances and intrusions. Specifically, RF achieves a true positive rate of
33,873 and a true negative rate of 33,898, suggesting its effectiveness in
accurately detecting intrusions. In contrast, RF exhibits lower false positive
and false negative rates, with only 77 false positive and 74 false negative
instances. These results highlight the robustness of RF in minimizing
misclassifications and enhancing the accuracy of intrusion detection in WSNs.

(a) DT (b) RF (c) MLP (d) KNN (e) LGB (f) XGB

Figure 4: Confusion matrix for binary label

Additionally, the ROC curve in Figure 5 demonstrates the AUC score, which
serves as a measure of the overall performance of the ML algorithms. RF
achieves an impressive AUC score of 99.99%, further solidifying its
superiority in detecting intrusions. The high AUC score indicates that RF
exhibits a high true positive rate while maintaining a low false positive
rate, making it an ideal choice for intrusion detection in WSNs.

Figure 5: ROC Curve for binary classification

Random Forest (RF) outperformed other algorithms in terms of accuracy for
intrusion detection in WSNs (WSNs). This algorithm offers several advantages
that contribute to its superior performance. RF is an ensemble learning method
that combines multiple decision trees, reducing overfitting and providing more
robust results. It also provides feature importance analysis, enabling the
identification of influential features in intrusion detection. RF is robust to
noise and outliers. Its reduced variance and parallelization capabilities make
it suitable for real-time intrusion detection. Overall, RF’s ensemble nature,
feature importance analysis, robustness to noise and outliers, reduced
variance, and parallelization make it a preferred choice for accurate
intrusion detection in WSNs. Therefore, considering the results of the
experiments, we can conclude that the RF algorithm is the best-performing
algorithm for intrusion detection in WSNs when utilizing the SMOTETomek-Link
technique for data balancing in binary class.

###  4.5 Multilabel Results Analysis

In the multilabel results analysis, we evaluated the performance of different
machine learning algorithms for intrusion detection in WSNs. Two experiments
were conducted: one with SMOTETomek-Link (WiSTL) and another without
SMOTETomek-Link (WoSTL).

From Table 7, we can observe the performance scores of each algorithm in both
experiments. It is important to note that a higher accuracy, precision,
recall, and F1 score indicate better performance, while lower values for MAE,
MSE, and RMSE indicate more accurate predictions. Comparing the results
between WiSTL and WoSTL experiments, we can see that the majority of the
algorithms achieve higher performance scores in the WiSTL experiment, which
indicates that the data balancing technique (SMOTETomek-Link) improves the
overall performance of the intrusion detection models in WSNs.

Technique | ML | Accuracy | Precision | Recall | F1-score | MAE | MSE | RMSE
---|---|---|---|---|---|---|---|---
WoSTL | DT | 99.49 | 96.87 | 96.62 | 96.74 | 0.65 | 0.94 | 9.71
RF | 99.67 | 98.21 | 97.66 | 97.89 | 0.42 | 0.61 | 7.84
MLP | 99.55 | 97.58 | 96.55 | 97.02 | 0.68 | 1.14 | 10.66
KNN | 99.53 | 97.34 | 96.61 | 96.93 | 0.68 | 1.1 | 10.5
LGB | 98.93 | 91.52 | 92.93 | 92.16 | 1.81 | 3.5 | 18.71
XGB | 99.70 | 98.62 | 97.4 | 97.97 | 0.4 | 0.59 | 7.68
WiSTL | DT | 99.81 | 99.81 | 99.81 | 99.81 | 0.26 | 0.41 | 6.38
RF | 99.92 | 99.92 | 99.92 | 99.92 | 0.11 | 0.17 | 4.15
MLP | 98.80 | 98.81 | 98.79 | 98.8 | 1.64 | 2.52 | 15.88
KNN | 99.53 | 99.53 | 99.53 | 99.53 | 0.54 | 0.67 | 8.21
LGB | 99.63 | 99.63 | 99.63 | 99.63 | 0.54 | 0.95 | 9.77
XGB | 99.84 | 99.84 | 99.84 | 99.84 | 0.23 | 0.38 | 6.17
Table 7: Multilabel performance analysis of with and without data balancing
using SMOTETomek

In evaluating the multilabel performance of various ML models for intrusion
detection in WSNs, the presented table (7) reveals robust performance across
all techniques. In the WoSTL scenario, DT, RF, MLP, KNN, LGB, and XGB achieved
accuracies of 99.49%, 99.67%, 99.55%, 99.53%, 98.93%, and 99.70%,
respectively. The corresponding precision values were 96.87%, 98.21%, 97.58%,
97.34%, 91.52%, and 98.62%, while recall values were 96.62%, 97.66%, 96.55%,
96.61%, 92.93%, and 97.40%. F1-score values for these models were 96.74%,
97.89%, 97.02%, 96.93%, 92.16%, and 97.97%. When applying data balancing with
SMOTETomek (WiSTL), accuracy, precision, recall, and F1-score values generally
improved. In the WiSTL scenario, DT, RF, MLP, KNN, LGB, and XGB achieved
accuracies of 99.81%, 99.92%, 98.80%, 99.53%, 99.63%, and 99.84%,
respectively. The corresponding precision values were 99.81%, 99.92%, 98.81%,
99.53%, 99.63%, and 99.84%, while recall values were 99.81%, 99.92%, 98.79%,
99.53%, 99.63%, and 99.84%. F1-score values for these models were 99.81%,
99.92%, 98.80%, 99.53%, 99.63%, and 99.84%. Among these, RF consistently
demonstrated the highest performance scores in both scenarios, making it the
model providing superior performance for multilabel intrusion detection in
WSNs in the given context.

The evaluation of ML models for intrusion detection in WSNs includes a
comprehensive analysis of error metrics, encompassing MAE, MSE, and RMSE.
These metrics provide crucial insights into the accuracy and precision of the
models. Without Data Balancing (WoSTL): In the absence of data balancing, the
intrusion detection models exhibited noteworthy performance in minimizing
prediction errors. The DT, RF, MLP, KNN, LGB, and XGB demonstrated low MAE
values of 0.48, 0.31, 0.37, 0.37, 0.39, and 0.28, respectively.
Correspondingly, the models exhibited low MSE values of 0.48, 0.31, 0.37,
0.37, 0.39, and 0.28, and achieved low RMSE values of 6.91, 5.59, 6.05, 6.05,
6.24, and 5.27. With Data Balancing (WiSTL): Upon applying data balancing
using SMOTETomek, the intrusion detection models showcased further
improvements in error metrics. The DT, RF, MLP, KNN, LGB, and XGB models
achieved reduced MAE values of 0.35, 0.22, 0.63, 0.50, 0.38, and 0.24,
respectively. The corresponding MSE values decreased to 0.35, 0.22, 0.63,
0.50, 0.38, and 0.24, while RMSE values demonstrated improvement, reaching
5.92, 4.72, 7.92, 7.10, 6.13, and 4.93. The reported error metrics underscore
the effectiveness of Random Forest in minimizing prediction errors, making it
the model of choice for intrusion detection in WSNs. The results suggest that
data balancing strategies contribute to enhanced precision and reliability in
the detection of intrusions.

Figure 6: Multilabel accuracy analysis of ML model for WSNs

(a) Performance (b) Error

Figure 7: Multilabel performance analysis for WSNs

Figure 6 compares the accuracy in the graphical form of various ML models on
WoSTL and WiSTL models. For the WoSTL experiment, the DT algorithm achieved an
accuracy rate of 99.49%, indicating its ability to accurately classify
instances as either normal or intrusions. The RF algorithm outperformed DT
with an accuracy rate of 99.67%. This higher accuracy can be attributed to the
ensemble nature of RF, which combines multiple decision trees to make more
robust predictions. The MLP algorithm achieved an accuracy rate of 99.55%,
demonstrating its capability to learn complex patterns and classify instances
effectively. Similarly, the KNN algorithm achieved an accuracy rate of 99.53%,
indicating its success in identifying similar instances and making accurate
predictions. The LGB algorithm achieved an accuracy rate of 98.93%, showcasing
its efficiency in handling large-scale datasets and producing accurate
results. Lastly, the XGB algorithm achieved the highest accuracy rate of
99.70%, showcasing its ability to leverage gradient boosting and make accurate
predictions.

In the WiSTL experiment, where the SMOTETomek-Link technique was employed for
data balancing, the accuracy rates of the machine learning algorithms were
further improved. The DT algorithm achieved an accuracy rate of 99.81%,
demonstrating its robustness in handling imbalanced datasets and effectively
detecting intrusions. The RF algorithm, once again, showed superior
performance with an accuracy rate of 99.92%. This high accuracy highlights the
effectiveness of RF in capturing the complex relationships and detecting
intrusions accurately. The MLP algorithm achieved an accuracy rate of 98.80%,
indicating its ability to learn intricate patterns and classify instances with
high accuracy. The KNN algorithm achieved an accuracy rate of 99.53%,
showcasing its success in identifying similar instances and making accurate
predictions. The LGB algorithm achieved an accuracy rate of 99.63%,
emphasizing its efficiency in handling imbalanced datasets and producing
accurate intrusion detection results. Finally, the XGB algorithm achieved an
accuracy rate of 99.84%, demonstrating its ability to leverage gradient
boosting and accurately classify instances in WSNs.

Overall, the inclusion of the SMOTETomek-Link technique (WiSTL experiment)
resulted in improved accuracy rates for all the machine learning algorithms
compared to the WoSTL experiment. This underscores the importance of data
balancing techniques in enhancing the performance of intrusion detection
models in WSNs. Additionally, the consistently high accuracy rates across
multiple algorithms validate the effectiveness of machine learning approaches
in accurately detecting intrusions and ensuring the security of WSNs.

Figure 8 reveals additional insights into the performance of RF compared to
other ML models in the WiSTL experiment for intrusion detection in WSNs. RF
demonstrates higher true positive and true negative rates than other
algorithms, indicating its superior ability to correctly identify both normal
instances and intrusions. Specifically, RF achieves a true positive rate of
33,840 and a true negative rate of 136122, suggesting its effectiveness in
accurately detecting intrusions. In contrast, RF exhibits lower false positive
and false negative rates, with only 9 false positive instances and 7 false
negative instances. These results highlight the robustness of RF in minimizing
misclassifications and enhancing the accuracy of intrusion detection in WSNs.

TP TN FP FN Blackhole 33840 136122 9 7 Flooding 34117 135828 33 0 Grayhole
33969 135965 34 10 Normal 34069 135783 37 89 TDMA 33842 136073 28 35

(a) DT (b) RF (c) MLP (d) KNN (e) LGB (f) XGB

Figure 8: Confusion matrix for multilabel

Additionally, the ROC curve in Figure 9 demonstrates the AUC score, which
serves as a measure of the overall performance of the ML algorithms. RF
achieves an impressive AUC score of 100%, further solidifying its superiority
in detecting intrusions. The high AUC score indicates that RF exhibits a high
true positive rate while maintaining a low false positive rate, making it an
ideal choice for intrusion detection in WSNs.

Figure 9: ROC Curve for multilabel classification

Our model has demonstrated superior performance in terms of various
performance metrics through extensive evaluation and comparison with
traditional approaches. Its effectiveness in detecting intrusions, reducing
false favorable rates, and handling imbalanced datasets positions it as the
best solution for intrusion detection in WSNs. By deploying our model,
organizations and researchers can benefit from an advanced and reliable
intrusion detection system, bolstering the overall security posture of WSNs
and enabling seamless deployment in various real-world scenarios.

###  4.6 Discussion

Table 8 presents a comprehensive comparison of various wireless sensor
intrusion detection models applied to the WSN-DS. These models employ
different techniques and algorithms to achieve intrusion detection, and their
performance is evaluated based on accuracy rates. This discussion will focus
on the performance of our proposal in both binary and multiclass scenarios
while highlighting the techniques used in our pinnacles.

Serial No. | Authors | Data Balancing Technique | Algorithm | Dataset | Class | Accuracy Rate
---|---|---|---|---|---|---
1 | (tan2019wireless) | SMOTE | RF | WSN-DS | Binary | 92.57%
2 | (elsaid2020optimized) | BCO | SVM | WSN-DS | Binary | 97.90%
3 | ravindra2023etelmad | - | ELM+ ETSAO | WSN-DS | Binary | 96.90%
4 | Our proposal | SMOTE-TomekLink | RF | WSN-DS | Binary | 99.78%
4 | (rezvi2021data) | - | ML | WSN-DS | Multiclass | 98.56% (ANN)
5 | (meng2022novel) | SMOTE-Tomek | LightGBM | WSN-DS | Multiclass | 99%
6 | (singh2020fuzzy) | - | Fuzzy Rule | WSN-DS | Multiclass | 98.29%
7 | (alruhaily2021multi) | - | RF | WSN-DS | Multiclass | 97%
8 | (chandre2022intrusion) | - | CNN | WSN-DS | Multiclass | 97%
9 | (dener2022stlgbm) | SMOTE-TomekLink | LightGBM | WSN-DS | Multiclass | 99.95%
10 | (ifzarne2021anomaly) | IG | PA | WSN-DS | Multiclass | 96%
11 | (putrada2022xgboost) | - | XGBoost | WSN-DS | Multiclass | 99.70%
12 | (jiang2020slgbm) | SBS | LightGBM | WSN-DS | Multiclass | 99.76%
13 | (abdullah2018intrusion) | - | ML | WSN-DS | Multiclass | 96.7% (SVM)
14 | alruwaili2023red | - | RKOA+LCWOA | WSN-DS | Multiclass | 98.94%
15 | moundounga2024stochastic | - | HMMs+GMMs | WSN-DS | Multiclass | 94.55%
16 | Our proposal | SMOTE-TomekLink | RF | WSN-DS | Multiclass | 99.92%

Table 8: Comparison Analysis of Wireless Sensor Intrusion Detection Models in
WSN-DS

In the landscape of wireless sensor intrusion detection, several notable works
employ diverse techniques and algorithms. For instance, (tan2019wireless)
utilize SMOTE and RF for binary intrusion detection, achieving an accuracy
rate of 92.57%. (elsaid2020optimized) employ BCO optimization for SVM in
binary detection, achieving an accuracy of 97.90%. Numerous multiclass models
employ various algorithms, such as ML, LightGBM, Fuzzy Rule, CNN, and XGBoost,
among others, with accuracy rates ranging from 96% to 99.95%. Our proposal
consistently outperforms existing works in both binary and multiclass
intrusion detection scenarios. In binary detection, our accuracy rate of
99.78% surpasses (tan2019wireless) (92.57%) and (elsaid2020optimized)
(97.90%). In multiclass detection, our accuracy rate of 99.92% outshines other
models, even those with high accuracy rates like (meng2022novel) (99%) and
(dener2022stlgbm) (99.95%).

In the binary classification setting, ”Our proposal” stands out with an
impressive accuracy rate of 99.78%. This result suggests that the combination
of SMOTE-TomekLink as the data balancing technique and the Random Forest (RF)
algorithm as the classification algorithm has proven to be highly effective in
distinguishing between normal and intruder activities in WSNs. Achieving such
a high accuracy rate is crucial for wireless sensor network security, as it
minimizes the likelihood of false alarms while accurately identifying real
threats.

Turning our attention to the multiclass classification scenario, ”Our
proposal” again demonstrates exceptional performance with an accuracy rate of
99.92%. In this context, where multiple intrusion classes need to be
classified accurately, the combination of SMOTE-TomekLink and RF proves its
robustness. This high accuracy rate implies that the proposed model can
effectively distinguish between various types of intrusions in the WSN-DS
dataset, making it a reliable choice for real-world wireless sensor network
security applications.

Several factors contribute to the superior performance of our proposal. The
utilization of SMOTE-TomekLink as the data balancing technique in both binary
and multiclass scenarios underlines its importance in improving the
performance of intrusion detection models. SMOTE-TomekLink addresses the class
imbalance issue, ensuring that the model is not biased towards the majority
class and can effectively learn from both minority and majority classes.
Additionally, the use of the Random Forest algorithm, known for its ensemble
learning capability and ability to handle complex datasets, contributes
significantly to the success of ”Our proposal.” Finally, the effectiveness of
our proposal is underpinned by the quality and representativeness of the WSN-
DS dataset used for training and evaluation.

###  4.7 Cost Analysis

In the realm of algorithms, time complexity is a crucial component of cost
analysis. It specifically focuses on understanding how the execution time of
an algorithm grows concerning the size of its input. The time complexity of an
algorithm is often expressed using Big O notation, providing an upper bound on
the rate of growth of the running time. The assessment of time complexity for
ML models in WSN-IDS is essential for their effective functioning. In this
regard, we analyze the time complexity for prominent ML algorithms including
DT, RF, MLP, KNN, LGB, and XGB models as follows:

    * –

DT : The time complexity is typically  $\ignorespaces O(n\cdot m\cdot\log(m))$
, with  $\ignorespaces n$ representing data points and  $\ignorespaces m$ as
features. It constructs a tree by recursively partitioning data.

    * –

RF : Comprising multiple DTs, its time complexity is  $\ignorespaces O(t\cdot
n\cdot m\cdot\log(m))$ , where  $\ignorespaces t$ is the number of trees.

    * –

MLP : With multiple layers and neurons, its time complexity is  $\ignorespaces
O(w\cdot e\cdot n)$ , where  $\ignorespaces w$ is the number of weights,
$\ignorespaces e$ the number of epochs, and  $\ignorespaces n$ the number of
data points.

    * –

KNN : This non-parametric method has a time complexity of  $\ignorespaces
O(n\cdot m)$ for training, where  $\ignorespaces n$ is the number of data
points and  $\ignorespaces m$ is the number of features. The prediction phase
can be more computationally intensive.

    * –

LGB : Known for efficiency and low memory usage, LGB’s time complexity is
$\ignorespaces O(t\cdot n\cdot m)$ , where  $\ignorespaces t$ is the number of
trees.

    * –

XGB : This model’s time complexity varies but is generally  $\ignorespaces
O(t\cdot d)$ , where  $\ignorespaces t$ is the number of trees and
$\ignorespaces d$ the depth of the trees.

The cost efficiency of the ML models utilized in our study is detailed in
Table 9, displaying their respective time complexities. Notably, RF model
stands out for its lower time complexity  $\ignorespaces O(t\cdot n\cdot
m\cdot\log(m))$ compared to other ML models in WSNs. This efficiency in
computation time positions RF as a cost-effective choice, demonstrating
superior performance among the considered models.

SI. No. | ML Model | Time Complexity
---|---|---
1 | DT |  $\ignorespaces O(n\cdot m\cdot\log(m))$
2 | RF |  $\ignorespaces O(t\cdot n\cdot m\cdot\log(m))$
3 | MLP |  $\ignorespaces O(w\cdot e\cdot n)$
4 | KNN |  $\ignorespaces O(n\cdot m)$
5 | LGB |  $\ignorespaces O(t\cdot n\cdot m)$
6 | XGB |  $\ignorespaces O(t\cdot d)$
Table 9: Time Complexity of ML Models in IDS

##  5 Conclusion

In conclusion, this paper presents a novel intrusion detection approach
tailored to address the distinct challenges posed by Wireless Sensor Networks
(WSNs). Our proposed intrusion detection model, combining machine learning
techniques with the SMOTE-TomekLink resampling method, synthesizes minority
instances and removes Tomek links, effectively balancing imbalanced WSN
datasets. Feature scaling through standardization is employed to normalize
input features, enhancing the model’s accuracy and robustness. The primary
finding of our research is the remarkable performance achieved by our model,
with an accuracy rate of 99.78% in binary classification and 99.92% in
multiclass classification scenarios. These results highlight the effectiveness
and superiority of our proposal in WSN intrusion detection. While our proposed
model exhibits impressive performance, it is essential to acknowledge its
limitations. One significant limitation is the computational cost associated
with resampling and feature scaling processes, as we did not utilize feature
selection to reduce computational complexity. Additionally, the model’s
performance may be influenced by the choice of hyperparameters and the quality
of the training data. Future research in WSN intrusion detection can explore
hybrid feature selection to reduce computational complexity, employ deep
learning models, especially fine-tuned models in IDS, and consider a
hierarchical approach in WSNs to improve performance.


that the previous quantity is

$\leq p^{-1}c_{x}^{-2}\int_{x^{-1/\gamma}-\epsilon
x^{-\rho/\gamma}}^{x^{-1/\gamma}+\epsilon
x^{-\rho/\gamma}}s^{-1/2}ds=2p^{-1}c^{-2}x^{2\tau/\gamma}\left\\{\left(x^{-1/\gamma}+\epsilon
x^{-\rho/\gamma}\right)^{1/2}-\left(x^{-1/\gamma}-\epsilon
x^{-\rho/\gamma}\right)^{1/2}\right\\}.$

It is ready to check, in view for the mean value theorem, that the expression
between two brackets equals $o\left(x^{-\rho/\left(2\gamma\right)}\right).$
This implies that

$p^{-1}c_{x}^{-2}\int_{x^{-1/\gamma}-\epsilon}^{x^{-1/\gamma}+\epsilon}s^{-1/2}ds=o\left(x^{\left(2\tau-\rho/2\right)/\gamma}\right)=o\left(1\right),$

because $4\tau<\rho<1/2,$ therefore
$\mathbb{P}\left(\left|R_{n14}\left(x\right)\right|>c_{x},\text{
}\mathcal{D}_{n}\left(\epsilon;\rho\right)\right)=o\left(1\right).$ Since
$\mathbb{P}\left(\mathcal{D}_{n}\left(\epsilon;\rho\right)\right)=o\left(1\right),$
hence $R_{n15}\left(x\right)=o_{\mathbb{P}}\left(x^{-\tau/\gamma}\right),$
uniformly over $x\geq 1.$ By using similar arguments, we also show that
$R_{n16}\left(x\right)=o_{\mathbb{P}}\left(x^{-\tau/\gamma}\right),$ that we
omit further details. ∎