Long-Range Wide Area Network Intrusion Detection at the Edge

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

1.    The authors need to explain in more detail why the algorithm used was chosen in comparison with others available in the literature and highlight the advantages of the proposed algorithm over known alternatives.

2.    The authors should detail the algorithm's computational requirements when used under dynamic conditions, which would allow them to evaluate its applicability in practical scenarios.

3.    In section 3.2, the authors are suggested to perform a more detailed quantitative analysis of the data, which would provide a more robust context for their conclusions.

4.    The authors need to include more statistical data describing the algorithm's behavior, focusing on its effectiveness for intrusion detection, which would help demonstrate the proposal's validity more forcefully.

5.    It is recommended that the authors select the information presented more rigorously and organize it in a way that improves the structure of the paper. This will facilitate the understanding of the results.

6.    Although the authors have presented a considerable amount of written information, additional quantitative statistical data are necessary to strengthen the arguments and provide a more robust validation of the work.

7.    Finally, it is suggested that the authors clarify more explicitly the main contributions of their work and the motivation behind their proposal.

Author Response

Dear Reviewer,

We sincerely thank you for your thorough and constructive review of our manuscript. We have tried to address each of your suggestions through revisions to the manuscript. Below, we detail our point-by-point responses to your comments and the corresponding changes made to the manuscript:

1.   The authors need to explain in more detail why the algorithm used was chosen in comparison with others available in the literature and highlight the advantages of the proposed algorithm over known alternatives.

Response 1: Section 3.3.4 discusses the choice of this algorithm in the context of network analysis. We have added more details to compare the algorithm with other parametric and non-parametric alternatives, including a new reference to the topic.  

2.   The authors should detail the algorithm's computational requirements when used under dynamic conditions, which would allow them to evaluate its applicability in practical scenarios.

Response 2: We have addressed this concern by adding a new subsection (4.6 Computational Requirements Analysis) that details our algorithm's computational characteristics. The subsection provides a comprehensive analysis of memory requirements, algorithmic complexity, message processing rates, and model update considerations. We also expanded the conclusion in order to address these shortcomings.

3.   In section 3.2, the authors are suggested to perform a more detailed quantitative analysis of the data, which would provide a more robust context for their conclusions.

Response 3: Two new charts were added in section 3.2 to depict the details in two example devices of the network. Further analysis was done regarding Spreading Factor, Bandwidth and Payload Length of the data samples.

4.   The authors need to include more statistical data describing the algorithm's behavior, focusing on its effectiveness for intrusion detection, which would help demonstrate the proposal's validity more forcefully.

Response 4: We have enhanced the conclusion section to better highlight these statistical results and their implications for the system's effectiveness in intrusion detection. Additionally, we have included in the future work directions the expansion of performance metrics and statistical analysis, particularly for evaluating the system's behaviour across different deployment scenarios and attack patterns. The revised conclusion now more effectively connects these quantitative findings to the system's practical capabilities in both static and mobile deployments, while outlining paths for more comprehensive statistical validation.

5.   It is recommended that the authors select the information presented more rigorously and organize it in a way that improves the structure of the paper. This will facilitate the understanding of the results.

Response 5: Section 1, Introduction, was refactored to emphasise the main contribution and the motivation for the work.

6.   Although the authors have presented a considerable amount of written information, additional quantitative statistical data are necessary to strengthen the arguments and provide a more robust validation of the work.

Response 6: Section 3.2 now details more information about the data considered in the study.

7.   Finally, it is suggested that the authors clarify more explicitly the main contributions of their work and the motivation behind their proposal.

Response 7: Section 1, Introduction, was refactored to emphasise the main contribution and the motivation for the work.

Reviewer 2 Report

Comments and Suggestions for Authors

1. Introduction analysis.

The Introduction provided a braod overview of the topic. It clearly highlighted the growth of IoT and LoRaWAN role as a communication tool.

2. Research design(appropriateness)

The rationale used in selecting the KNN algorithm should be expanded. When doing this, a motivation as to why this algorithm was selected over the other available algorithms should be also presented.

3. Methodology description.

 

a) Much as this section describes the dataset and the machine learning processes used quite well, more details on the processing steps for the data, for example extraction and parameter tuning for the KNN algorithm are needed.

b) Why was CrateDB for data storage and management selected over other time-series DBs? justify this choice.

3. Presentation of results

The results were clearly presented.

The comparative analysis between centralized and edge computing environments was well structured and clearly pointed out the trade-offs of using edge computing for intrusion detection.

Much as no significant changes are required in this section, the article could further benefit from having more visual aids(figures & charts) which will shade more light on understanding the perfomance differences between the two environments

4. Conclusions

The conclusions were generally supported by the results. However include a much more detailed presentation on the system's limitations and potential areas of future research, for example improving precision and addressing scalability challenges etc.

Author Response

Dear Reviewer,

We sincerely thank you for your thorough and constructive review of our manuscript. We have tried to address each of your suggestions through revisions to the manuscript. Below, we detail our point-by-point responses to your comments and the corresponding changes made to the manuscript:

1. Introduction analysis.

The Introduction provided a broad overview of the topic. It clearly highlighted the growth of IoT and LoRaWAN role as a communication tool.

2. Research design(appropriateness)
   The rationale used in selecting the KNN algorithm should be expanded. When doing this, a motivation as to why this algorithm was selected over the other available algorithms should be also presented.

Response 2: Section 3.3.4 discusses the choice of this algorithm in the context of network analysis. We have added more details to compare the algorithm with other parametric and non-parametric alternatives, including a new reference to the topic.  

3. Methodology description.
4. a) Much as this section describes the dataset and the machine learning processes used quite well, more details on the processing steps for the data, for example extraction and parameter tuning for the KNN algorithm are needed

Response 3a: Section 3.2.2 now refers to a new article about the chosen correlation study that was done to find the best parameters in the analysis.

1. b) Why was CrateDB for data storage and management selected over other time-series DBs? justify this choice.

Response 3b: Section 3.3.2 was expanded in order to better support our choice of CrateDB.

3. Presentation of results

The results were clearly presented.

The comparative analysis between centralized and edge computing environments was well structured and clearly pointed out the trade-offs of using edge computing for intrusion detection.

Much as no significant changes are required in this section, the article could further benefit from having more visual aids(figures & charts) which will shade more light on understanding the performance differences between the two environments

Response 3: Section 3.2 now has more details about the data considered in the study.

4. Conclusions

The conclusions were generally supported by the results. However include a much more detailed presentation on the system's limitations and potential areas of future research, for example improving precision and addressing scalability challenges etc.

Response 4: We have enhanced Section 5 to provide a more comprehensive discussion of future research opportunities while maintaining focus on our system's demonstrated effectiveness, balancing our significant findings with clear directions for continued advancement in this important area.

Round 2

Reviewer 1 Report

Comments and Suggestions for Authors

the section is complete, and my decision will change to accept.