Machine Learning for DDoS Detection

The project investigates deep-learning approaches for intrusion detection in Internet of Things and Industrial Internet of Things environments. The growing number of connected devices, their heterogeneous hardware and communication technologies, and their often limited built-in security make IoT infrastructures especially vulnerable to attacks such as Denial of Service and Distributed Denial of Service. The project develops anomaly-based intrusion detection systems capable of learning discriminative representations directly from network traffic and identifying both known and evolving attack patterns.

A central research direction concerns the adaptation of deep models to heterogeneous datasets, different feature spaces, and binary or multi-class detection scenarios. The proposed methods combine data preprocessing, dimensionality reduction, hyperparameter optimisation, adaptive neural architectures, and transfer learning. Different fine-tuning strategies are studied to determine which layers should be updated or frozen when transferring knowledge from a large source dataset to a smaller target domain, with the aim of maintaining high detection accuracy while reducing the amount of labelled data and computational resources required.

The project also explores federated learning as a distributed and privacy-aware alternative to centralised training. Models are trained locally by multiple clients, while only model updates are shared and aggregated by a central server. Research activities address heterogeneous client resources, non-uniform data distributions, partial client participation, communication costs, client-selection strategies, and the detection of malicious or poisoned updates. The long-term goal is to create scalable, adaptive, and trustworthy intrusion detection solutions that can operate in dynamic edge and IoT environments without requiring organisations to disclose sensitive network data.