M. B. Anley, A. Genovese, V. Piuri, Deep Learning for DDoS attack detection in IoT: A survey, Security and Cryptography. SECRYPT 2023/SECRYPT 2024, Communications in Computer and Information Science, vol. 2588, pp. 99-121, Springer, Cham, 2026, ISSN 978-3-032-09598-5.
Industrial informatics
Machine Learning for DDoS Detection
The Machine Learning for DDoS Detection project investigates intelligent intrusion detection systems for identifying Distributed Denial of Service attacks in increasingly heterogeneous and connected environments. The rapid diffusion of Internet of Things devices, industrial networks, edge systems, and critical digital infrastructures has enlarged the attack surface while introducing devices with different computational capabilities, communication technologies, and traffic characteristics. DDoS attacks exploit these distributed environments to overwhelm services with malicious requests, impairing network availability and potentially affecting essential operations.
The project builds on a broad analysis of machine-learning and deep-learning methods for cybersecurity. This research examines intrusion-detection approaches based on deep belief networks, autoencoders, convolutional neural networks, recurrent and long short-term memory models, and generative methods, together with the benchmark datasets used to train and compare them. The analysis highlights the advantages of deep learning in automatically extracting discriminative representations from network traffic, but also identifies persistent limitations related to data quality, obsolete benchmarks, class imbalance, inconsistent evaluation procedures, and limited comparability among published results.
A first technical direction concerns adaptive deep-learning architectures for anomaly-based intrusion detection. Rather than using a fixed neural model for every dataset and classification task, the proposed methodology automatically tunes the number of neurons and other hyperparameters according to the complexity of the available traffic data. Deep neural networks, convolutional neural networks, and recurrent models are evaluated in both binary configurations, distinguishing legitimate from malicious traffic, and multi-class configurations, identifying individual attack categories.
Experiments on the CSE-CIC-IDS2018 and CIC-DDoS2019 datasets show that the architectures increase their capacity when operating on more complex data. In binary detection, all evaluated models exceed 99% across the main performance measures, with the adaptive deep neural network reaching approximately 99.80% accuracy on CSE-CIC-IDS2018 and 99.95% on CIC-DDoS2019. Multi-class recognition remains more challenging because some attack classes are poorly represented or semantically similar, confirming the importance of dataset composition and class balance.
A second research direction addresses the detection of evolving attacks through adaptive transfer learning. Deep models trained on one traffic dataset may perform poorly when the network environment, feature space, or attack distribution changes. The proposed framework transfers knowledge between datasets while jointly adapting the architecture and optimising its hyperparameters. It considers custom convolutional models with different depths together with established backbones such as VGG16, VGG19, and ResNet50.
The transfer-learning framework is evaluated across CIC-DDoS2019, CSE-CIC-IDS2018, KDDCup’99, and UNSW-NB15. Reported results include 100% binary accuracy with VGG19 on CSE-CIC-IDS2018, 99.99% on CIC-DDoS2019, and strong multi-class performance, including 99.92% with Conv18 on CSE-CIC-IDS2018 and 93.62% on CIC-DDoS2019. On UNSW-NB15, the proposed Conv18 configuration reaches 99.84% for attack-type detection. These results show that adaptive transfer learning can reuse knowledge from different sources while preserving high recognition accuracy under changing conditions.
The project extends this research to resource-constrained edge and Industrial IoT platforms through TransferEdge. The method evaluates four adaptation strategies: complete fine-tuning, final-layer retraining, differential fine-tuning with layer-dependent learning rates, and selective tuning of attack-sensitive layers. The objective is to balance detection accuracy with training time and computational cost when adapting a source model trained on UNSW-NB15 to the BoT-IoT domain.
Across CNN, VGG, ResNet, EfficientNet, and Xception architectures, TransferEdge achieves accuracies close to or above 99.8% in several settings. EfficientNet reaches 99.97% when only the final layer is retrained, while VGG16 reaches approximately 99.92% with selective fine-tuning. Differential fine-tuning provides a particularly stable compromise between cross-domain accuracy and computational efficiency, and staged transfers between the two datasets show that models can adapt repeatedly without a substantial loss of performance.
A third major direction concerns privacy-preserving distributed training through federated learning. Centralised intrusion-detection systems require organisations or IoT devices to transfer network traffic to a common server, creating privacy, security, bandwidth, and governance concerns. Federated learning allows clients to train locally and share only model updates, but conventional random client selection can converge slowly when clients differ in available data, energy, computational resources, latency, and connectivity.
The project introduces FELACS, a federated-learning framework with adaptive client selection. At every communication round, the method uses multiobjective optimisation to select clients according to the diversity and statistical relevance of their local data, computational efficiency, power consumption, communication latency, and available resources. This allows the global model to prioritise informative updates without directly collecting the underlying private traffic data.
FELACS is evaluated on CIC-IDS2018, CIC-DDoS2019, BoT-IoT, and CIC-IoT2023. Local evaluations produce average accuracies of 99.28% on CIC-IDS2018, 95.85% on CIC-DDoS2019, 99.20% on BoT-IoT, and 96.95% on CIC-IoT2023. In federated experiments, FELACS matches or exceeds competing strategies such as FedAvg, FedProx, FedMCCS, and random selection, achieving approximately 98% average accuracy on CIC-IoT2023 and a steady-state accuracy of about 99.5%.
The adaptive selection mechanism also reduces communication overhead. FELACS reaches target accuracy in fewer rounds than the evaluated baselines under both independent and non-independent data distributions. For example, depending on the dataset and model, it reaches 95% accuracy in approximately 28–46 communication rounds, whereas random selection may require 50–75 rounds. This improves the feasibility of federated DDoS detection in real-time and resource-constrained IoT deployments.
Overall, the project provides an integrated research path from the systematic analysis of intrusion-detection datasets and architectures to adaptive neural models, cross-domain transfer learning, edge deployment, and federated training. Its main contribution is a family of accurate, adaptable, and privacy-aware methods capable of responding to evolving DDoS threats across heterogeneous network environments while reducing the need for centralised data collection and repeated model development.
The project builds on a broad analysis of machine-learning and deep-learning methods for cybersecurity. This research examines intrusion-detection approaches based on deep belief networks, autoencoders, convolutional neural networks, recurrent and long short-term memory models, and generative methods, together with the benchmark datasets used to train and compare them. The analysis highlights the advantages of deep learning in automatically extracting discriminative representations from network traffic, but also identifies persistent limitations related to data quality, obsolete benchmarks, class imbalance, inconsistent evaluation procedures, and limited comparability among published results.
A first technical direction concerns adaptive deep-learning architectures for anomaly-based intrusion detection. Rather than using a fixed neural model for every dataset and classification task, the proposed methodology automatically tunes the number of neurons and other hyperparameters according to the complexity of the available traffic data. Deep neural networks, convolutional neural networks, and recurrent models are evaluated in both binary configurations, distinguishing legitimate from malicious traffic, and multi-class configurations, identifying individual attack categories.
Experiments on the CSE-CIC-IDS2018 and CIC-DDoS2019 datasets show that the architectures increase their capacity when operating on more complex data. In binary detection, all evaluated models exceed 99% across the main performance measures, with the adaptive deep neural network reaching approximately 99.80% accuracy on CSE-CIC-IDS2018 and 99.95% on CIC-DDoS2019. Multi-class recognition remains more challenging because some attack classes are poorly represented or semantically similar, confirming the importance of dataset composition and class balance.
A second research direction addresses the detection of evolving attacks through adaptive transfer learning. Deep models trained on one traffic dataset may perform poorly when the network environment, feature space, or attack distribution changes. The proposed framework transfers knowledge between datasets while jointly adapting the architecture and optimising its hyperparameters. It considers custom convolutional models with different depths together with established backbones such as VGG16, VGG19, and ResNet50.
The transfer-learning framework is evaluated across CIC-DDoS2019, CSE-CIC-IDS2018, KDDCup’99, and UNSW-NB15. Reported results include 100% binary accuracy with VGG19 on CSE-CIC-IDS2018, 99.99% on CIC-DDoS2019, and strong multi-class performance, including 99.92% with Conv18 on CSE-CIC-IDS2018 and 93.62% on CIC-DDoS2019. On UNSW-NB15, the proposed Conv18 configuration reaches 99.84% for attack-type detection. These results show that adaptive transfer learning can reuse knowledge from different sources while preserving high recognition accuracy under changing conditions.
The project extends this research to resource-constrained edge and Industrial IoT platforms through TransferEdge. The method evaluates four adaptation strategies: complete fine-tuning, final-layer retraining, differential fine-tuning with layer-dependent learning rates, and selective tuning of attack-sensitive layers. The objective is to balance detection accuracy with training time and computational cost when adapting a source model trained on UNSW-NB15 to the BoT-IoT domain.
Across CNN, VGG, ResNet, EfficientNet, and Xception architectures, TransferEdge achieves accuracies close to or above 99.8% in several settings. EfficientNet reaches 99.97% when only the final layer is retrained, while VGG16 reaches approximately 99.92% with selective fine-tuning. Differential fine-tuning provides a particularly stable compromise between cross-domain accuracy and computational efficiency, and staged transfers between the two datasets show that models can adapt repeatedly without a substantial loss of performance.
A third major direction concerns privacy-preserving distributed training through federated learning. Centralised intrusion-detection systems require organisations or IoT devices to transfer network traffic to a common server, creating privacy, security, bandwidth, and governance concerns. Federated learning allows clients to train locally and share only model updates, but conventional random client selection can converge slowly when clients differ in available data, energy, computational resources, latency, and connectivity.
The project introduces FELACS, a federated-learning framework with adaptive client selection. At every communication round, the method uses multiobjective optimisation to select clients according to the diversity and statistical relevance of their local data, computational efficiency, power consumption, communication latency, and available resources. This allows the global model to prioritise informative updates without directly collecting the underlying private traffic data.
FELACS is evaluated on CIC-IDS2018, CIC-DDoS2019, BoT-IoT, and CIC-IoT2023. Local evaluations produce average accuracies of 99.28% on CIC-IDS2018, 95.85% on CIC-DDoS2019, 99.20% on BoT-IoT, and 96.95% on CIC-IoT2023. In federated experiments, FELACS matches or exceeds competing strategies such as FedAvg, FedProx, FedMCCS, and random selection, achieving approximately 98% average accuracy on CIC-IoT2023 and a steady-state accuracy of about 99.5%.
The adaptive selection mechanism also reduces communication overhead. FELACS reaches target accuracy in fewer rounds than the evaluated baselines under both independent and non-independent data distributions. For example, depending on the dataset and model, it reaches 95% accuracy in approximately 28–46 communication rounds, whereas random selection may require 50–75 rounds. This improves the feasibility of federated DDoS detection in real-time and resource-constrained IoT deployments.
Overall, the project provides an integrated research path from the systematic analysis of intrusion-detection datasets and architectures to adaptive neural models, cross-domain transfer learning, edge deployment, and federated training. Its main contribution is a family of accurate, adaptable, and privacy-aware methods capable of responding to evolving DDoS threats across heterogeneous network environments while reducing the need for centralised data collection and repeated model development.
Relevant publications
M. B. Anley, P. Coscia, A. Genovese, V. Piuri, FELACS: Federated learning with adaptive client selection for IoT DDoS attack detection, Computers & Security, vol. 158, no. 104642, pp. 1-13, November 2025, ISSN 0167-4048.
M. B. Anley, A. Genovese, V. Piuri, TransferEdge: Transfer learning approach to detect evolving DDoS threats in Edge-IIoT, Proc. of the 9th Int. Forum on Research and Technologies for Society and Industry (RTSI 2025), pp. 11-16, Gammarth, Tunisia, August 2025, ISSN 979-8-3315-9788-7.
M. B. Anley, A. Genovese, D. Agostinello, V. Piuri, Robust DDoS attack detection with adaptive transfer learning, Computers & Security, vol. 144, no. 103962, pp. 1-10, September 2024, ISSN 0167-4048.
D. Agostinello, A. Genovese, V. Piuri, Anomaly-based intrusion detection system for DDoS attack with Deep Learning techniques, Proc. of the 20th Int. Conf. on Security and Cryptography (SECRYPT 2023), pp. 267-275, Rome, Italy, July 2023, ISSN 978-989-758-666-8.
D. Gümüşbaş, T. Yıldırım, A. Genovese, F. Scotti, A comprehensive survey of databases and Deep Learning methods for cybersecurity and intrusion detection systems, IEEE Systems Journal, vol. 15, no. 2, pp. 1717-1731, June 2021, ISSN 1937-9234.