{"id":"https://openalex.org/W7140212970","doi":"https://doi.org/10.1007/s42452-026-08563-8","title":"DDoS attack detection and classification for the MQTT-IoT protocol using LSTM models","display_name":"DDoS attack detection and classification for the MQTT-IoT protocol using LSTM models","publication_year":2026,"publication_date":"2026-03-24","ids":{"openalex":"https://openalex.org/W7140212970","doi":"https://doi.org/10.1007/s42452-026-08563-8"},"language":"en","primary_location":{"id":"doi:10.1007/s42452-026-08563-8","doi":"https://doi.org/10.1007/s42452-026-08563-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42452-026-08563-8","pdf_url":null,"source":{"id":"https://openalex.org/S5407042868","display_name":"Discover Applied Sciences","issn_l":"3004-9261","issn":["3004-9261"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj","jufo-1","norway-1","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Applied Sciences","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1007/s42452-026-08563-8","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5146673146","display_name":"Deribew Beko Negesse","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I865572129","display_name":"Adama Science and Technology University","ror":"https://ror.org/02ccba128","country_code":"ET","type":"education","lineage":["https://openalex.org/I865572129"]}],"countries":["ET"],"is_corresponding":false,"raw_author_name":"Deribew Beko Negesse","raw_affiliation_strings":["Department of Computer Science and Engineering, School of Electrical Engineering and Computing, Center for Electrical System and Electronics, Adama Science and Technology University, Adama, Ethiopia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, School of Electrical Engineering and Computing, Center for Electrical System and Electronics, Adama Science and Technology University, Adama, Ethiopia","institution_ids":["https://openalex.org/I865572129"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072410277","display_name":"Ketema Adere Gemeda","orcid":"https://orcid.org/0000-0001-6079-9369","observed_orcids":["https://orcid.org/0000-0001-6079-9369"]},"institutions":[{"id":"https://openalex.org/I865572129","display_name":"Adama Science and Technology University","ror":"https://ror.org/02ccba128","country_code":"ET","type":"education","lineage":["https://openalex.org/I865572129"]}],"countries":["ET"],"is_corresponding":true,"raw_author_name":"Ketema Adere Gemeda","raw_affiliation_strings":["Department of Computer Science and Engineering, School of Electrical Engineering and Computing, Center for Electrical System and Electronics, Adama Science and Technology University, Adama, Ethiopia"],"raw_orcid":"https://orcid.org/0000-0001-6079-9369","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, School of Electrical Engineering and Computing, Center for Electrical System and Electronics, Adama Science and Technology University, Adama, Ethiopia","institution_ids":["https://openalex.org/I865572129"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5037738148","display_name":"Gabriele Gianini","orcid":"https://orcid.org/0000-0001-5186-0199","observed_orcids":["https://orcid.org/0000-0001-5186-0199"]},"institutions":[{"id":"https://openalex.org/I66752286","display_name":"University of Milano-Bicocca","ror":"https://ror.org/01ynf4891","country_code":"IT","type":"education","lineage":["https://openalex.org/I66752286"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Gabriele Gianini","raw_affiliation_strings":["Department of Informatics, Systems and Communication (DISCo), University of Milano-Bicocca, Milano, 20126, MI, Italy"],"raw_orcid":"https://orcid.org/0000-0001-5186-0199","affiliations":[{"raw_affiliation_string":"Department of Informatics, Systems and Communication (DISCo), University of Milano-Bicocca, Milano, 20126, MI, Italy","institution_ids":["https://openalex.org/I66752286"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5072410277"],"corresponding_institution_ids":["https://openalex.org/I865572129"],"apc_list":null,"apc_paid":null,"fwci":6.8308,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.9544219,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":"8","issue":"5","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ddos-detection","display_name":"DDoS attack detection","score":0.9980000257492065},{"id":"https://openalex.org/keywords/mqtt-protocol","display_name":"MQTT protocol","score":0.8690000176429749},{"id":"https://openalex.org/keywords/iot-security","display_name":"Internet of Things security","score":0.9739999771118164},{"id":"https://openalex.org/keywords/mqtt-broker","display_name":"MQTT broker","score":0.7179999947547913},{"id":"https://openalex.org/keywords/attack-classification","display_name":"attack classification","score":0.7250000238418579},{"id":"https://openalex.org/keywords/lstm","display_name":"LSTM","score":0.6169999837875366},{"id":"https://openalex.org/keywords/recurrent-neural-networks","display_name":"recurrent neural networks","score":0.8939999938011169},{"id":"https://openalex.org/keywords/multilayer-perceptron","display_name":"multilayer perceptron","score":0.7990000247955322},{"id":"https://openalex.org/keywords/publish-subscribe","display_name":"publish/subscribe","score":0.8069999814033508},{"id":"https://openalex.org/keywords/network-traffic-anomaly-detection","display_name":"network traffic anomaly detection","score":0.800000011920929}],"concepts":[{"id":"https://openalex.org/C132868160","wikidata":"https://www.wikidata.org/wiki/Q10322548","display_name":"MQTT","level":3,"score":0.862500011920929},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8472999930381775},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8238999843597412},{"id":"https://openalex.org/C26324664","wikidata":"https://www.wikidata.org/wiki/Q1065525","display_name":"Message queue","level":2,"score":0.6937000155448914},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5837000012397766},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.553600013256073},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.48179998993873596},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.45239999890327454},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.4187999963760376},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.41830000281333923},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4050000011920929},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.38499999046325684},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.3635999858379364},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.35740000009536743},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.35580000281333923},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3531000018119812},{"id":"https://openalex.org/C160403385","wikidata":"https://www.wikidata.org/wiki/Q220543","display_name":"Queue","level":2,"score":0.34630000591278076},{"id":"https://openalex.org/C179717631","wikidata":"https://www.wikidata.org/wiki/Q2991667","display_name":"Multilayer perceptron","level":3,"score":0.322299987077713},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.3140999972820282},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.31380000710487366},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3122999966144562},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3084000051021576},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.29089999198913574},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.28369998931884766},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.257999986410141},{"id":"https://openalex.org/C133488467","wikidata":"https://www.wikidata.org/wiki/Q6673524","display_name":"Long short term memory","level":4,"score":0.2558000087738037}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1007/s42452-026-08563-8","doi":"https://doi.org/10.1007/s42452-026-08563-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42452-026-08563-8","pdf_url":null,"source":{"id":"https://openalex.org/S5407042868","display_name":"Discover Applied Sciences","issn_l":"3004-9261","issn":["3004-9261"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj","jufo-1","norway-1","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Applied Sciences","raw_type":"journal-article"},{"id":"pmh:oai:boa.unimib.it:10281/600441","doi":null,"is_oa":true,"landing_page_url":"https://link.springer.com/article/10.1007/s42452-026-08563-8","pdf_url":null,"source":{"id":"https://openalex.org/S4306401259","display_name":"BOA (University of Milano-Bicocca)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I66752286","host_organization_name":"University of Milano-Bicocca","host_organization_lineage":["https://openalex.org/I66752286"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:42d0c98f1445466c91ce62919fa6b33b","doi":null,"is_oa":true,"landing_page_url":"https://doaj.org/article/42d0c98f1445466c91ce62919fa6b33b","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Discover Applied Sciences, Vol 8, Iss 5 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1007/s42452-026-08563-8","doi":"https://doi.org/10.1007/s42452-026-08563-8","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s42452-026-08563-8","pdf_url":null,"source":{"id":"https://openalex.org/S5407042868","display_name":"Discover Applied Sciences","issn_l":"3004-9261","issn":["3004-9261"],"is_oa":true,"is_in_doaj":true,"is_core":false,"listed_in":["doaj","jufo-1","norway-1","russia-white-list-2"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Applied Sciences","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":57,"referenced_works":["https://openalex.org/W1973906278","https://openalex.org/W2099940443","https://openalex.org/W2157496457","https://openalex.org/W2738792436","https://openalex.org/W2758219826","https://openalex.org/W2766374547","https://openalex.org/W2927160209","https://openalex.org/W3010067093","https://openalex.org/W3013338032","https://openalex.org/W3021804235","https://openalex.org/W3033728179","https://openalex.org/W3034273612","https://openalex.org/W3037176165","https://openalex.org/W3042465381","https://openalex.org/W3045734364","https://openalex.org/W3098620325","https://openalex.org/W3109893482","https://openalex.org/W3126698296","https://openalex.org/W3159536527","https://openalex.org/W3178297575","https://openalex.org/W3206491990","https://openalex.org/W3210577968","https://openalex.org/W4200254367","https://openalex.org/W4205608240","https://openalex.org/W4296136937","https://openalex.org/W4309544441","https://openalex.org/W4312349588","https://openalex.org/W4312910656","https://openalex.org/W4323569290","https://openalex.org/W4366189228","https://openalex.org/W4367060479","https://openalex.org/W4379229568","https://openalex.org/W4381572419","https://openalex.org/W4381735918","https://openalex.org/W4382468588","https://openalex.org/W4385549122","https://openalex.org/W4387490462","https://openalex.org/W4391229663","https://openalex.org/W4391400718","https://openalex.org/W4391661573","https://openalex.org/W4392304828","https://openalex.org/W4392405755","https://openalex.org/W4392747470","https://openalex.org/W4393071709","https://openalex.org/W4401592374","https://openalex.org/W4402542170","https://openalex.org/W4403215169","https://openalex.org/W4403784332","https://openalex.org/W4404034773","https://openalex.org/W4405631861","https://openalex.org/W4405890916","https://openalex.org/W4407882299","https://openalex.org/W4408280903","https://openalex.org/W4413019923","https://openalex.org/W7116694060","https://openalex.org/W7125809861","https://openalex.org/W7130929467"],"related_works":["https://openalex.org/W4385549122","https://openalex.org/W7134832976","https://openalex.org/W7161284164","https://openalex.org/W4387162963","https://openalex.org/W4410741201","https://openalex.org/W3034273612","https://openalex.org/W4388336556","https://openalex.org/W7140097082","https://openalex.org/W4403732549","https://openalex.org/W4414820458"],"abstract_inverted_index":{"The":[0,104],"Message":[1],"Queue":[2],"Telemetry":[3],"Transport":[4],"(MQTT)":[5],"protocol":[6],"serves":[7],"as":[8],"a":[9,61,91,139],"vital":[10],"publish-subscribe":[11],"messaging":[12],"standard,":[13],"enabling":[14],"seamless":[15],"communication":[16],"across":[17],"critical":[18],"Internet":[19],"of":[20,28,40,149],"Things":[21],"(IoT)":[22],"infrastructures.":[23],"However,":[24],"the":[25,116,120,125,135,144],"widespread":[26],"adoption":[27],"MQTT":[29,47,95],"has":[30,138],"heightened":[31],"vulnerability":[32],"to":[33,37,53,65,152],"cybersecurity":[34],"threats,":[35],"notably":[36],"Distributed":[38],"Denial":[39],"Service":[41],"(DDoS)":[42],"attacks.":[43],"These":[44],"attacks":[45,68,100,129],"overwhelm":[46],"brokers":[48],"with":[49,124],"malicious":[50],"traffic,":[51],"leading":[52],"service":[54],"disruptions.":[55],"In":[56],"this":[57],"study,":[58],"we":[59],"developed":[60],"deep":[62],"learning":[63],"model":[64,153],"detect":[66],"DDoS":[67,99],"within":[69],"MQTT-IoT":[70],"networks,":[71],"comparing":[72],"several":[73],"candidate":[74],"architectures:":[75],"Recurrent":[76],"Neural":[77],"Network":[78],"(RNN),":[79],"Long":[80],"Short-Term":[81],"Memory":[82],"(LSTM),":[83],"and":[84,101,142],"Multi-Layer":[85],"Perceptron":[86],"(MLP).":[87],"Model":[88],"evaluation":[89],"utilized":[90],"publicly":[92],"available,":[93],"real-world":[94],"dataset":[96],"containing":[97],"both":[98],"normal":[102],"traffic.":[103],"experiment":[105],"result":[106],"illustrated":[107],"that":[108,127],"our":[109],"proposed":[110],"LSTM":[111,145],"attained":[112],"99.53%":[113],"F1-score,":[114],"outperforming":[115],"best":[117],"models":[118],"from":[119],"literature.":[121],"This":[122],"aligns":[123],"observation":[126],"MQTT-based":[128],"are":[130],"primarily":[131],"sequential":[132],"anomalies,":[133],"where":[134,143],"spatial":[136],"structure":[137],"lower":[140],"importance,":[141],"can":[146],"take":[147],"advantage":[148],"its":[150],"ability":[151],"temporal":[154],"attack":[155],"signatures.":[156]},"counts_by_year":[{"year":2026,"cited_by_count":3}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-03-25T00:00:00"}