What question did this study set out to answer?

The aim is to develop a robust hybrid framework that combines CNN-LSTM and XGBoost for effective DDoS detection in industrial IoT.

May 22, 2026Open Access

A hybrid CNN-LSTM framework driven by XGBoost for real-time DDoS detection in industrial IoT

Key Points

The aim is to develop a robust hybrid framework that combines CNN-LSTM and XGBoost for effective DDoS detection in industrial IoT.
Developed a hybrid detection framework integrating CNN, LSTM, and XGBoost.
Utilized adaptive learning, adversarial learning, and attention mechanisms for enhanced detection.
Evaluated the framework on multiple datasets, including LR-HR DDoS 2024 and UNSW-NB15.
Achieved 99.25% accuracy, 99.15% precision, 99.64% recall, and 99.39% F1 score on LR-HR DDoS 2024 dataset.
Obtained 99.31% accuracy, 99.45% precision, 99.30% recall, and 99.38% F1 score on UNSW-NB15 dataset.
Reached 93.33% accuracy during cross-domain validation with the CICIoT2023 dataset.

Abstract

The Internet of Things (IoT) has significantly revolutionized industrial sectors but introduced vulnerabilities, exposing them to Distributed Denial of Service (DDoS) attacks. These attacks cause severe damage, including financial losses, productivity decline, reputational damage, and customer dissatisfaction. To address these challenges, this study proposes a novel hybrid detection framework that integrates XGBoost-based feature selection with CNN-LSTM architectures to build a robust, scalable, and real-time DDoS detection system. This framework leverages the ability to identify discriminative features from high-IoT traffic, reduce noise and computational overhead using gradient extreme boosting, and capture spatial and temporal dependencies using CNNs and LSTMs. The framework is also enhanced by adaptive learning to improve flexibility against sophisticated attacks, adversarial learning to bolster robustness against evasion, and attention mechanisms to improve interpretability. Combining these elements enhances accuracy, resilience, and robustness compared to existing frameworks. The experimental results demonstrate the high detection performance and efficiency across multiple datasets. Evaluated on the LR-HR DDoS 2024 dataset, the model achieved an accuracy of 99.25%, a precision of 99.15%, a recall of 99.64%, and an F1 score of 99.39%. On UNSWA-NB15, it achieved 99.31% accuracy, 99.45% precision, 99.30% a recall, and an F1-score of 99.38%, while in cross-domain validation using the CICIoT2023 dataset, it reached 93.33% accuracy. This study provides a scalable, effective, and reliable solution for intrusion detection in industrial IoT environments, with improved accuracy, adaptability to sophisticated threats, and resilience to adversarial attacks.

AIに質問

Bookmark

View Full Paper