A neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments by fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component.
Abstract
Operational technology (OT) environments, including programmable logic controllers (PLCs), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems, are increasingly targeted by distributed denial-of-service (DDoS) attacks. This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments. The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component. The symbolic component alone provides a compact, interpretable rule set, while the fusion combines the strengths of both paradigms. The hybrid model is evaluated on three real-world benchmark DDoS datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. A unified comprehensive preprocessing pipeline including label mapping, numerical feature selection, robust scaling, and class balancing is applied. The fusion weight alpha and decision threshold are jointly optimised on validation data to maximise F1-score. The hybrid model attains 99.04% accuracy (MCC 0.97) on CIC-DDoS2019 and 98.61% accuracy (MCC 0.76) on CICIoT23, in both cases reducing the FNR below that of the pure-neural and pure-symbolic baselines; on the linearly separable Edge-IIoTset the shallow decision tree alone already reaches 100%, so this benchmark validates the preprocessing pipeline rather than the fusion. The principal gain of the fusion is a lower FNR at a controlled false-positive cost, which matters in operational technology, where a missed attack is more damaging than a false alarm. Model-only inference latency is sub-millisecond (0.58-0.79 milliseconds per sample) on a standard central processing unit; including on-device flow-feature extraction, the end-to-end path remains within a single-digit-millisecond budget, which is compatible with OT control-loop timing.
Operational Technology (OT) networks present significant challenges for anomaly detection due to low data volume, heterogeneous traffic patterns, and nonstationary behaviour. Conventional deep learning approaches often struggle to generalise under such conditions, particularly when labelled data are scarce. This study proposes a lightweight hybrid framework integrating a Denoising Autoencoder (DAE) for unsupervised structural anomaly scoring with a Long Short-Term Memory (LSTM) network for temporal modelling. The DAE is trained exclusively on benign traffic, learning structural characteristics of normal behaviour without requiring attack labels. The LSTM operates on latent representations extracted from the DAE bottleneck rather than raw protocol features, enabling consistent application across OT scenarios without feature-level modification. The pipeline is organised around Sensibility, Imagination, Understanding, and Reason—inspired by Kant’s epistemological framework—as an organisational design principle. The framework is evaluated on industrial network traffic from Roketsan A.Ş. and the public CIC-IoMT2024 Message Queuing Telemetry Transport (MQTT) benchmark, with additional cross-dataset validation on the Edge-IIoTset benchmark. Fixed-seed robustness experiments report performance across MQTT, Transmission Control Protocol (TCP), and public MQTT scenarios using Macro- $F_{1}$ , Matthews Correlation Coefficient (MCC), and false-positive/false-negative rates. Comparisons against eight baselines—supervised (Random Forest, XGBoost, CNN-LSTM, Transformer-IDS), unsupervised (Isolation Forest, One-Class SVM, KitNET), and semi-supervised (LSTM-AE)—demonstrate competitive performance rather than uniform dominance over all supervised baselines. LSTM-AE degradation on TCP and public MQTT traffic highlights the limitation of reconstruction-based temporal baselines and motivates schema-based temporal modelling. With 29,133 parameters and CPU-only inference at 0.0379 ms per sample, the model is suitable for resource-constrained OT monitoring.
Mustafa Emre Cansev, H. Canbolat· IEEE Access· 0 citations
Software Defined Networking (SDN) provides programmability and centralized control, but at the same time, increases the attack surface and prevents classical Intrusion Detection Systems (IDSs) from dealing with new attack vectors. To solve these challenges, we propose NeuroTwin QIDS, a novel quantum-enabled neuro-IDS for SDN. It uses a novel Neuro-Symbolic Feature Pruning (NSFP) approach involving Graph Attention Networks (GAT) and policy-aware symbolic pruning to guarantee the statistical relevancy and defensibility of features used to represent anomalies. Statistical features representing anomalies are mapped to Quantum Reservoir (QRE) space in order to enrich representation for better temporal classification. Classification itself is implemented in two steps: firstly, the Quantum Reservoir-Transformer Hybrid (QRT-Net) performs online real-time binary anomaly detection; secondly, the Capsule Network-BiLSTM (Cap-BiLSTM) classifies anomalies based on their behavior. After that, neuro-symbolic fusion is performed to validate predictions made by the neural network against SDN policies, and a digital twin model is synchronized for simulation of protective actions to be taken before applying the self-healing mechanism for network protection. The experiments were carried out with CSE-CIC-IDS2018 and InSDN datasets to evaluate the end-to-end performance of NeuroTwin QIDS. NeuroTwin QIDS provided outstanding detection results, surpassing state-of-the-art IDS systems. On the CSE-CIC-IDS2018 dataset, it showed 99.12% accuracy, 98.95% precision, 98.87% recall rate, and a 98.91% F1-score. Similarly, on InSDN dataset, the performance of the proposed method was 98.67% accuracy, 98.42% precision, 98.15% recall, and a 98.28% F1-score.
D. Lynda, G. Logeswari, K. Tamilarasi et al.· Scientific Reports· 0 citations
Controller Area Network (CAN) is the dominant in-vehicle bus, yet its broadcast design and absent authentication leave it exposed to injection and spoofing attacks. Existing deep-learning intrusion detection systems achieve strong accuracy but depend on ML inference frameworks incompatible with the resource budgets of production Electronic Control Units (ECUs). We present a systems-oriented pipeline that trains four neural architectures—Transformer, CNN, LSTM, and ANN—on a five-class labeled CAN dataset and distills each into a framework-free C++ decision tree via the Trustee protocol. We observe and address a systematic false-alarm collapse on Normal-class traffic: standard Trustee produces around 30% FPR-N because Normal frames constitute only 5.4% of training data. A class-balanced Trustee variant, which oversamples Normal by factor α=5, reduces FPR-N to 13.8±1.4% (three Trustee runs) while preserving 91.1±0.6% accuracy and 0.918±0.006 macro-F1 at 2.1% CPU on a Raspberry Pi 4, versus 22.6% for TF-Lite int8 and 59.4% for TensorFlow on the same board. We additionally report α and depth ablations, three-seed teacher statistics, and per-class recall for all models.Code: https://github.com/Amirmasoud-Pourmiri/Lightweight-Neural-Network-Distillation-for-Real-Time-CAN-Bus-Intrusion-Detection-in-Vehicles
Amirmasoud Pourmiri, Ali Eslami, Sergio A. Salinas Monroy· International Conference on...· 0 citations
Abstract Although SDN provides a programmable, centrally managed framework for modern networks, that same centralization leaves it exposed to attacks such as Distributed Denial of Service (DDoS). This paper proposes an intrusion detection framework that couples Z-Isomorphic Sigmoid Graph Neural Networks (ZIS-GNN) with Bonobo-Optimization-based (EKPC-BOA) feature selection. The sigmoid-based activation strengthens the graph representation relative to conventional GNNs, capturing complex traffic patterns more faithfully, while the hybrid selector – combining the Bonobo Optimization Algorithm with an entropy score and Pearson correlation – distils the most informative features from the traffic data and thereby improves both efficiency and accuracy. Experiments demonstrate that the proposed ZIS-GNN+EKPC-BOA model attains an accuracy of 97.36%, a precision of 97.37%, and an F1-score of 97.58%, outperforming baseline models such as DNN (89.60%), LSTM (91.68%), BiLSTM (93.77%), and GNN (95.86%), as well as the standard graph baselines GCN (96.18%) and the attention-based GAT (96.58%). The results show the effectiveness of combining graph-based learning with hybrid feature selection for intrusion detection in SDN.
Zahir Mulani, Suhasini Vijaykumar, Priya Chandran· Journal of Information Assur...· 0 citations
Networked manufacturing couples sensors, programmable logic controllers, and industrial gateways to production that cannot simply be paused. An intrusion detector in this setting must control false alarms and edge-resource use as well as detect attacks. Industrial Internet of Things (IIoT) edge nodes add three practical constraints: training traffic cannot be centralized, local statistical distributions differ, and the deployed models may be structurally heterogeneous. We address this setting with Reference-Assisted Learner-Aligned Distributed Stacking (RA-LADS). It evaluates node models on mutually exclusive reference pools, groups LightGBM and XGBoost responses by learner family, and represents each family by its mean, standard deviation, and five quantiles in a fixed, permutation-invariant 7M-dimensional vector. Across 20 matched partitioning and training seeds, the full 14-dimensional summary attained a mean F1 of 0.984514. Its gain over a global 7-dimensional summary without family semantics was 0.000756 (95% CI: 0.000559–0.000962; Holm-adjusted p = 1.08 × 10−5). By comparison, the difference from node-wise raw prediction concatenation was −0.000009, with an interval spanning zero. Random balanced grouping was not significantly different from true learner-family grouping after multiplicity correction; family identity is therefore a useful grouping prior, but not the only one. Mean F1 scores for a compact reference-pool LightGBM, a 41-parameter Tiny Deep Sets model, and a heterogeneous one-model-per-node summary were 0.983887, 0.983659, and 0.983865. The full method delivered small yet reproducible paired gains over all three controls. At fixed false-alarm-rate (FAR) budgets, no stable advantage over a single LightGBM appeared between 0.1% and 2% FAR; at 5% FAR, F1 increased by 0.000417 (Holm-adjusted p = 0.017). Five-seed retraining on two external NetFlow datasets did not show a general advantage. The claim is therefore limited to settings in which node responses carry exploitable distributional structure. Within that boundary, RA-LADS offers a lightweight interface for heterogeneous tree collaboration when labeled reference data and explicit alert operating points are available, although system cost still grows linearly.
Jing Li, Shu-Hao Shen, Kang-Rui Xu et al.· ICST Transactions on Scalabl...· 0 citations
Large-scale DDoS attacks remain a serious threat to today's networked systems, which aim to make services unavailable by sending a massive amount of traffic. The traditional detection methods are mostly about attack categorization and are not that context-aware or actionable in providing support to security analysts. We propose SentinelsGuard AI, a self-learning DDoS classification and mitigation system that is built from a combination of machine learning, retrieval-augmented knowledge, and LLM-based reasoning in one platform. The proposed system is realized as a Flask-based web application, which processes the network flow statistics data, extracted from incoming traffic, and transforms the data to generate representative features of the network flows, before detecting the attacks using the XGBoost classifier. After classification, the framework accesses domain-specific attack intelligence from a structured Retrieval-Augmented Generation (RAG) knowledge base with profiles of multiple categories of DDoS attacks. This contextual information is used with LLM-enabled reasoning to derive comprehensible security explanations, determine the severity of the attack, and suggest the firewall mitigation rules that can be applied. The framework stores analysis data in a SQLite database for operational monitoring, and displays security events in an interactive dashboard that includes traffic visualization, attack logs, and threat summaries. The architecture proposed brings statistical learning together with contextual knowledge of cybersecurity and attempts to bridge the gap between automatic attack detection and explainable incident response. It integrates all the key features of a classification-based network security decision support platform into a single stream, enabling a classification-based approach to network security to become more interpretable and usable in reality: persistent logging, visualization, knowledge retrieval, reasoning, and system recommendation of mitigations.
K. V. Sai Phani, P. Karthik, Farooq Sunar Mahammad et al.· 2026 International Conferenc...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
