2026· E3S Web of Conferences· Vol 735, pp. 01007· 0 citations· 20 references
TL;DR
A comprehensive evaluation of deep learning architectures for DDoS attack detection in AMI environments, focusing on Convolutional Neural Network, CNN-Long Short-Term Memory (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU) hybrid approaches.
Abstract
Advanced Metering Infrastructure (AMI) networks in smart grids face evolving cybersecurity threats, with Distributed Denial of Service (DDoS) attacks posing critical risks to network availability and operational integrity. This paper presents a comprehensive evaluation of deep learning architectures for DDoS attack detection in AMI environments, focusing on Convolutional Neural Network (CNN), CNN-Long Short-Term Memory (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU) hybrid approaches. Using a dataset of 72,007 AMI samples enhanced with realistic DDoS attack simulations covering six attack categories, we implemented extensive feature engineering generating 3,398 features optimized to 75 discriminative indicators. The methodology incorporates synthetic attack generation maintaining 30% attack ratio with stratified data partitioning for robust evaluation. The results gotten from experiments demonstrate that the CNN architecture achieves excellent performance with 86.52% accuracy, 91.08% precision, and 85.73% F1-score, requiring only 23.7 minutes training time and 291,841 parameters. The CNN-LSTM hybrid shows competitive performance with 85.82% accuracy and enhanced temporal modeling capabilities. Both architectures significantly outperform the more complex CNN-GRU variant, establishing CNN-based approaches as optimal for AMI security applications. This research contributes evidence-based architectural guidance for AMI threat detection systems, demonstrating practical deployment solutions that balance detection accuracy with computational efficiency for real-world utility environments.
LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies, which shows its capacity in learning long-lasting dependencies.
Jawad Hussain Awan, Misbah Safdar, Muhammad Ayaz Shirazi et al.· Italian National Conference...· 0 citations
A Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory branch with a gradient-boosted ensemble branch that produces a unified threat classification and severity score is proposed.
Rajesh Yadav, Dinesh Kumar, Sanjeev Kumar et al.· International journal of com...· 1 citation
An intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies is presented.
S. Singh, Alok Kumar· International Journal of Com...· 0 citations
Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Victor Anaga, B. Stephen, E. Adediji et al.· E3S Web of Conferences· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
