Hybrid Deep Neural Network-Based Detection of DDoS Attacks in Software-Defined IIoT Networks

In the current landscape of the Industrial Internet of Things (IIoT), Distributed Denial of Service (DDoS) attacks represent a significant security threat. Traditional defense mechanisms often require extensive computational and storage resources, resulting in substantial increases in operational costs. In response to this challenge, this study proposes a novel DDoS attack detection method for IIoT environments, named IIoT Attack Detection based on CNN-mLSTM-KAN (IAD-CLK). The method first employs an Adaptive Feature Selection Boosting (AFSB) technique during the data preprocessing phase to identify the most relevant features, thereby reducing the computational load on the model. Subsequently, the CNN-mLSTM-KAN model is introduced, which combines depthwise separable convolutions, an LSTM architecture enhanced by matrix operations (mLSTM), and the Kolmogorov–Arnold Network (KAN). This integration significantly improves the efficiency and accuracy of DDoS attack detection. Experimental results on the CICDDoS2019 dataset demonstrate that the model achieves an accuracy of 99.78%, while maintaining a low time cost of 0.122 ms. These findings not only highlight the model’s advantages in terms of accuracy and computational complexity but also demonstrate its ability to meet the stringent low-latency requirements of IIoT systems.