A CNN–GRU Based Optimized and Explainable Framework for TCP-UDP DDoS Attack Detection and Deployment on Edge Devices
DOI:
https://doi.org/10.29284/37vg5z29Keywords:
IoT Security, IIoT, DDoS Detection, Deep Learning, CNN–GRU, Hyperparameter Optimization, Explainable AI.Abstract
Distributed Denial of Service (DDoS) attacks have been targeting IoT and IIoT systems more and more, which calls for the development of accurate, efficient, and interpretable detection methods. With particle swarm optimization (PSO) for hyperparameter selection and SHAP-based Explainable AI (XAI) for explainability, this paper proposes a hybrid CNN–GRU model employing CNNs for spatial feature extraction and GRUs for temporal pattern learning. Applied to the Edge-IIoT dataset, UDP model demonstrated ideal recall (100%) with less false positives, whereas the TCP model was enhanced from the baseline of 65.47% accuracy and 59.58% precision to 99.82% accuracy and 99.70% precision after PSO optimization. As per the SHAP study, predictions are affected by important factors such as TCP flags and DNS retransmissions. Finally, deployment on Raspberry Pi 5 ensured real-time feasibility by delivering performance equivalent to server execution. For DDoS detection in IoT/IIoT networks, the proposed framework guarantees a trustworthy, explainable, and edge-deployable solution.
References
[1] H. Boyes, B. Hallaq, J. Cunningham, and T. Watson, “The industrial internet of things (iiot): An analysis framework,” Computers in industry, vol. 101,
pp. 1–12, 2018.
[2] A. Amrullah, “Lightweight edge-based security system design for ddos attack mitigation in industrial iot infrastructure,” Intellithings Journal, vol. 1, no. 1, pp. 17–24, 2024.
[3] S. H. Mekala, Z. Baig, A. Anwar, and N. Syed, “Dos attacks, human factors, and evidence extraction for the industrial internet of things (iiot) paradigm,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW). IEEE, 2023, pp. 32–39.
[4] R. S. Ahmed and T. S. Atia, “Machine learning and deep learning for distributed denial of service attack detection in software-defined networking: A review,” in AIP Conference Proceedings, vol. 3211, no. 1. AIP Publishing LLC, 2025, p. 030030.
[5] “Machine learning and deep learning for distributed denial of service attack detection in software-defined networking: A review,” in AIP Conference Proceedings, vol. 3211, no. 1. AIP Publishing LLC, 2025, p. 030030.
[6] W. G. Gadallah, H. M. Ibrahim, and N. M. Omar, “A deep learning technique to detect distributed denial of service attacks in software-defined networks,”
Computers & Security, vol. 137, p. 103588, 2024.
[7] S. T. R. Bomidika, “Advancing ddos detection in 5gnetworks through machine learningand deep learning techniques,” 2024.
[8] S. Mehmood, R. Amin, J. Mustafa, M. Hussain, F. S. Alsubaei, and M. D. Zakaria, “Distributed denial of services (ddos) attack detection in sdn using optimizer-equipped cnn-mlp,” PloS one, vol. 20, no. 1, p. e0312425, 2025.
[9] Agrawal, V. (2017). Security with respect to MANET (mobile ad-hoc network) and IoT (internet of things). Oriental Journal of Computer Science and Technology, 10(1), 82-85.
[10] Pandit, T., Raval, M., & Upadhyay, D. (2025). Multi-Domain ABSA Conversation Dataset Generation via LLMs for Real-World Evaluation and Model Comparison. arXiv preprint arXiv:2505.24701.
[11] K. S. Goud and G. S. Rao, “Towards an efficient ddos attack detection in sdn: An approach with cnn-gru fusion,” in 2024 Fourth International Conference on Advances in Electrical, Computing, Communication and Sustainable Technologies (ICAECT). IEEE, 2024, pp. 1–10.
[12] S. Myneni, A. Chowdhary, D. Huang, and A. Alshamrani, “Smartdefense: A distributed deep defense against ddos attacks with edge computing,”
Computer Networks, vol. 209, p. 108874, 2022.
[13] M. Akhi, C. Eising, and L. L. Dhirani, “Tcn-based ddos detection and mitigation in 5g healthcare-iot: A frequency monitoring and dynamic threshold approach,” IEEE Access, 2025.
[14] Y. Wan, K. Xu, F. Wang, and G. Xue, “Characterizing and mining traffic patterns of iot devices in edge networks,” IEEE Transactions on Network Science and Engineering, vol. 8, no. 1, pp. 89–101, 2020.
[15] S. S. Mahadik, P. M. Pawar, and R. Muthalagu, “Edge-hetiot defense against ddos attack using learning techniques,” Computers & Security, vol. 132,
p. 103347, 2023.
[16] V. Hnamte, A. A. Najar, H. Nhung-Nguyen, J. Hussain, and M. N. Sugali, “Ddos attack detection and mitigation using deep neural network in sdn environment,” Computers & Security, vol. 138, p. 103661, 2024.
[17] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge-iiotset: A new comprehensive realistic cyber security dataset of iot and iiot applications for centralized and federated learning,” IEEe Access, vol. 10, pp. 40 281–40 306, 2022.
[18] S. Ismail, S. Dandan, and A. Qushou, “Intrusion detection in iot and iiot: Comparing lightweight machine learning techniques using ton iot, wustl-iiot- 2021, and edgeiiotset datasets,” IEEE Access, 2025.
[19] S. Ur Rehman, M. Khaliq, S. I. Imtiaz, A. Rasool, M. Shafiq, A. R. Javed, Z. Jalil, and A. K. Bashir, “Diddos: An approach for detection and identification of distributed denial of service (ddos) cyberattacks using gated recurrent units (gru),” Future Generation Computer Systems, vol. 118, pp. 453–466, 2021.
[20] D. M. Rajan and D. J. Aravindhar, “Detection and mitigation of ddos attack in sdn environment using hybrid cnn-lstm,” Migr. Lett, vol. 20, pp. 407–419, 2023.
[21] Koradia, D., & Agrawal, V. (2024). Study of self-sovereign identity management system incorporating blockchain. International Journal of Intelligent Systems and Applications in Engineering, 12, 83-91.
[22] S. Gopal, D. Nanthiya, K. P. Kumar, D. H. Rajan, S. Kaviyalzini, and T. Sruthika, “Particle swarm optimization (pso) based feature selection for ddos attack detection in iot,” in 2024 International Conference on Smart Electronics and Communication Systems (ISENSE). IEEE, 2024, pp. 1–6.
[23] R. R. Nuiaa, S. A. A. A. Alsaidi, B. K. Mohammed, A. H. Alsaeedi, Z. A. A. Alyasseri, S. Manickam, and M. A. Hussain, “Enhanced pso algorithm for detecting drdos attacks on ldap servers.” International Journal of Intelligent Engineering & Systems, vol. 16, no. 5, 2023.
[24] C. S. Kalutharage, X. Liu, C. Chrysoulas, N. Pitropakis, and P. Papadopoulos, “Explainable ai-based ddos attack identification method for iot networks,”
Computers, vol. 12, no. 2, p. 32, 2023.
[25] M. Saied and S. Guirguis, “Explainable artificial intelligence for botnet detection in internet of things,” Scientific Reports, vol. 15, no. 1, p. 7632, 2025.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
