MidSiot: A Multistage Intrusion Detection System for Internet of Things

Algorithm 2

The overall detection process.

	Input: Raw network packets
	Output: Attack type
(i)	Local home gateway:
(1)	Generate network flows:
(2)	Drop unnecessary features:
(3)	Normalize data:
(4)	Load device type classification model:
(5)	Classify device type: Device type
(6)	Send to ISP:
(ii) Internet Service Provider (ISP)
(1)	Initialize:
(2)	Load all abnormality detection models:
(3)	Load abnormality detection model:
(4)	Attack detection:
(5)	Ifis notthen
(a)	Load attack type detection model:
(b)	Attack classification:
(c)
(6)	Else
(7)	Return