Machine Learning-Based Detection of DDoS Attacks on Advanced Metering Infrastructure Networks in Smart Grid

AI-Driven Security: Detecting Cyber Attacks in IoT Networks

Traditional rule-based intrusion detection systems generally fail in identifying unknown or evolving threats; thus, automated and adaptive kinds of methods are crucial. Deep learning models provide promising solutions, but many recent studies depend on hybrid architecture, which increase the computational cost and reduce deploying ability on real-time or resource-limited systems. In this paper, we present and test a standalone LSTM model for multiclass cyberattack detection based on a CIC_IoT_Dataset2023, a recent labeled dataset that mirrors the actual network environment containing 33 attack categories. The dataset was extremely imbalanced as benign traffic accounted for most of the classes. To detect such attacks, we used the Synthetic Minority Oversampling Technique (SMOTE) to increase the frequency of less common types of address. The pre-processed dataset was then employed to train four models (RNN, CNN, DNN and the proposed LSTM) for performance analysis with sequential data. The proposed LSTM model achieved an accuracy between 2% and 7%. LSTM had good detection for frequent attacks and slow-changing patterns, which shows its capacity in learning long-lasting dependencies. The results demonstrate that a simple, lightweight standalone LSTM model can be used for effective and realistic intrusion detection without the need for complex hybrid architecture.

A Hybrid Deep Learning and Machine Learning Model for Intelligent Cyber Threat Detection in Smart Networks

The rapid expansion of smart networks, encompassing the Internet of Things (IoT), software-defined networking (SDN), and 5G-enabled edge infrastructure, has dramatically increased the attack surface available to malicious actors, while simultaneously producing high-velocity, heterogeneous traffic that traditional signature-based intrusion detection systems struggle to analyze in real time. This paper proposes a Hybrid Deep Learning and Machine Learning (DL-ML) framework for intelligent cyber threat detection that fuses a Convolutional Neural Network combined with a Bidirectional Long Short-Term Memory (CNN-BiLSTM) branch, which captures spatial and temporal traffic patterns, with a gradient-boosted ensemble branch (XGBoost/Random Forest), which captures statistical flow-level signatures. The outputs of both branches are combined through a weighted feature-fusion and ensemble layer that produces a unified threat classification and severity score. The framework was evaluated on a large-scale smart-network intrusion dataset comprising over 1.8 million labeled flow records spanning six traffic classes: normal, DDoS, botnet, port scanning, malware communication, and spoofing. Experimental results show that the proposed hybrid model achieves 98.8% accuracy, 96.4% precision, 95.6% recall, and a 96.0% F1-score, exceeding the strongest individual baseline (LSTM) by 3.7 percentage points in F1-score and achieving an AUC of 0.992.

Intelligent DDOS Attack Detection and Mitigation Using Machine Learning Techniques

Distributed Denial-of-Service (DDoS) attacks remain among the most disruptive threats to modern network infrastructure, with adversaries continually adapting their strategies to overwhelm cloud platforms, Internet-of-Things (IoT) deployments, and Software-Defined Network (SDN) environments. Traditional signature-based intrusion detection systems exhibit inherent inflexibility against novel attack vectors, motivating a shift toward intelligent, data-driven defense mechanisms. This paper presents an intelligent DDoS detection and mitigation framework that combines classical Machine Learning (ML) classifiers with Deep Learning (DL) architectures to achieve high-fidelity, low-latency attack identification across heterogeneous network topologies. Evaluated on the CICDDoS2019, NSL-KDD, and UNSW-NB15 benchmark datasets, the proposed hybrid framework incorporating XGBoost and a Bidirectional LSTM model achieves a classification accuracy of 99.31%, a precision of 99.18%, a recall of 99.27%, and an F1-score of 99.22%, outperforming standalone classifiers while sustaining sub-millisecond detection latency under realistic traffic loads. SDN-assisted rule insertion further reduces the mean mitigation response time to 8.4 ms. The results affirm the viability of deploying intelligent, explainable ML-based defense pipelines in production-grade network environments.

DTLgan-IDS: deep transfer learning with CGAN for optimized intrusion detection system on IoT networks

A Hybrid CNN-GRU Approach for Detecting DDoS Attacks in Software Defined Networks

Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.

A Comparative Evaluation of Deep Learning Architectures for Binary Network Intrusion Detection Using the NSL-KDD Dataset

The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning, categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision, 68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally efficient models for anomaly-based intrusion detection.