{"id":"https://openalex.org/W7204455834","doi":"https://doi.org/10.21203/rs.3.rs-10749726/v1","title":"Hybrid LSTM\u2013LightGBM Model for Multiclass DDoS Attack Detection in 5G and IoT Networks","display_name":"Hybrid LSTM\u2013LightGBM Model for Multiclass DDoS Attack Detection in 5G and IoT Networks","publication_year":2026,"publication_date":"2026-08-27","ids":{"openalex":"https://openalex.org/W7204455834","doi":"https://doi.org/10.21203/rs.3.rs-10749726/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-10749726/v1","doi":"https://doi.org/10.21203/rs.3.rs-10749726/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10749726/v1","pdf_url":"https://www.researchsquare.com/article/rs-10749726/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-10749726/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116057606","display_name":"Asma Djama","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210128965","display_name":"University Yahia Fares of Medea","ror":"https://ror.org/02e2yc259","country_code":"DZ","type":"education","lineage":["https://openalex.org/I4210128965"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Asma Djama","raw_affiliation_strings":["University of M\u00e9d\u00e9a"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of M\u00e9d\u00e9a","institution_ids":["https://openalex.org/I4210128965"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5006531884","display_name":"Mohamed Maazouz","orcid":"https://orcid.org/0000-0002-2168-7660","observed_orcids":["https://orcid.org/0000-0002-2168-7660"]},"institutions":[{"id":"https://openalex.org/I4210128965","display_name":"University Yahia Fares of Medea","ror":"https://ror.org/02e2yc259","country_code":"DZ","type":"education","lineage":["https://openalex.org/I4210128965"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Mohamed Maazouz","raw_affiliation_strings":["University of M\u00e9d\u00e9a"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of M\u00e9d\u00e9a","institution_ids":["https://openalex.org/I4210128965"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087761119","display_name":"Hamza Kheddar","orcid":"https://orcid.org/0000-0002-9532-2453","observed_orcids":["https://orcid.org/0000-0002-9532-2453"]},"institutions":[{"id":"https://openalex.org/I4210128965","display_name":"University Yahia Fares of Medea","ror":"https://ror.org/02e2yc259","country_code":"DZ","type":"education","lineage":["https://openalex.org/I4210128965"]}],"countries":["DZ"],"is_corresponding":false,"raw_author_name":"Hamza Kheddar","raw_affiliation_strings":["University of M\u00e9d\u00e9a"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of M\u00e9d\u00e9a","institution_ids":["https://openalex.org/I4210128965"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089059522","display_name":"Muhammet Ali Akcayol","orcid":"https://orcid.org/0000-0002-6615-1237","observed_orcids":["https://orcid.org/0000-0002-6615-1237"]},"institutions":[{"id":"https://openalex.org/I95634034","display_name":"Gazi University","ror":"https://ror.org/054xkpr46","country_code":"TR","type":"education","lineage":["https://openalex.org/I95634034"]}],"countries":["TR"],"is_corresponding":false,"raw_author_name":"Muhammet Ali Akcayol","raw_affiliation_strings":["Faculty of Engineering , Department of Computer Engineering , Gazi AI Center , Gazi University , Ankara 06560 , T\u00fcrkiye"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Engineering , Department of Computer Engineering , Gazi AI Center , Gazi University , Ankara 06560 , T\u00fcrkiye","institution_ids":["https://openalex.org/I95634034"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ddos-detection","display_name":"DDoS attack detection","score":0.9959999918937683},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.6430000066757202},{"id":"https://openalex.org/keywords/iot-security","display_name":"Internet of Things security","score":0.7509999871253967},{"id":"https://openalex.org/keywords/5g","display_name":"5G","score":0.9750000238418579},{"id":"https://openalex.org/keywords/multiclass-classification","display_name":"multi-class classification","score":0.7229999899864197},{"id":"https://openalex.org/keywords/shap","display_name":"SHAP","score":0.828000009059906},{"id":"https://openalex.org/keywords/temporal-traffic-patterns","display_name":"temporal traffic patterns","score":0.6970000267028809},{"id":"https://openalex.org/keywords/cicids2017","display_name":"CICIDS2017","score":0.8619999885559082},{"id":"https://openalex.org/keywords/ciciot2023-dataset","display_name":"CICIoT2023","score":0.9490000009536743},{"id":"https://openalex.org/keywords/real-time-intrusion-detection","display_name":"real-time intrusion detection","score":0.7490000128746033}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8105000257492065},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7487000226974487},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.6639999747276306},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6434999704360962},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5250999927520752},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5077000260353088},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.49619999527931213},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.48069998621940613},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.4650999903678894},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.4465000033378601},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4311000108718872},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.42969998717308044},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.38920000195503235},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.37940001487731934},{"id":"https://openalex.org/C70153297","wikidata":"https://www.wikidata.org/wiki/Q5591907","display_name":"Gradient boosting","level":3,"score":0.319599986076355},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.3098999857902527},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3041999936103821},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2791999876499176},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.25769999623298645},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2517000138759613}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.21203/rs.3.rs-10749726/v1","doi":"https://doi.org/10.21203/rs.3.rs-10749726/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10749726/v1","pdf_url":"https://www.researchsquare.com/article/rs-10749726/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-10749726/v1","doi":"https://doi.org/10.21203/rs.3.rs-10749726/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-10749726/v1","pdf_url":"https://www.researchsquare.com/article/rs-10749726/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"acceptedVersion","is_accepted":true,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204455834.pdf","grobid_xml":"https://content.openalex.org/works/W7204455834.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7147101637","https://openalex.org/W4401904316","https://openalex.org/W7143290690","https://openalex.org/W4410733917","https://openalex.org/W7124937395","https://openalex.org/W7161965719","https://openalex.org/W4415032912","https://openalex.org/W4407151302","https://openalex.org/W4406894445","https://openalex.org/W7223451467"],"abstract_inverted_index":{"Abstract":[0],"The":[1,66,109,229],"Internet":[2],"of":[3,27,183,187,190,204,210,222,252,284],"Things":[4],"(IoT)devices":[5],"are":[6,23,30,42,55,69,141],"spreading":[7],"fast.":[8],"This":[9,47,80],"is":[10,48,61,112],"happening":[11],"at":[12],"the":[13,52,96,131,145,151,155,169,173,196,215,225,250,268,274,282],"time":[14,242],"as":[15],"new":[16],"high-speed":[17],"communication":[18],"networks":[19,94],"and":[20,118,126,167,185,192,208,267,270,287],"5G":[21,288],"infrastructures":[22],"being":[24],"built.":[25],"Because":[26],"this":[28,78],"there":[29],"a":[31,49,70,83,277],"lot":[32],"more":[33,45],"Distributed":[34],"Denial-of-Service":[35],"(DDoS)":[36],"attacks":[37,41,68],"happening.":[38],"These":[39],"DDos":[40],"also":[43,231],"getting":[44],"complicated.":[46],"problem":[50],"for":[51,72,103,240,255,280],"systems":[53,74],"that":[54,88,172,249],"supposed":[56],"to":[57,63,75,114,143],"detect":[58],"when":[59],"someone":[60],"trying":[62],"break":[64],"in.":[65],"DDoS":[67,106],"challenge,":[71],"these":[73],"deal":[76],"with":[77,95],"problem.":[79],"research":[81],"suggests":[82],"hybrid":[84],"intrusion":[85,244],"detection":[86,156,262],"approach":[87,279],"combines":[89],"Long":[90],"Short-Term":[91],"Memory":[92],"(LSTM)":[93],"Light":[97],"Gradient":[98],"Boosting":[99],"Machine":[100],"(LightGBM)":[101],"classifier":[102],"efficient":[104],"multi-class":[105,178],"attack":[107],"detection.":[108,245],"LSTM":[110],"module":[111],"employed":[113],"capture":[115],"temporal":[116,256],"dependencies":[117],"sequential":[119],"traffic":[120],"patterns,":[121],"while":[122],"LightGBM":[123],"performs":[124],"fast":[125],"accurate":[127],"classification":[128,179],"based":[129],"on":[130,195,212,224,272],"extracted":[132],"feature":[133,257],"representations.":[134],"In":[135],"addition,":[136],"SHapley":[137],"Additive":[138],"exPlanations":[139],"(SHAP)":[140],"incorporated":[142],"enhance":[144],"suggested":[146],"framework's":[147],"interpretability":[148],"by":[149],"determining":[150],"key":[152],"elements":[153],"influencing":[154],"process.":[157],"we":[158],"use":[159],"in":[160,177],"oure":[161],"model":[162,217],"tres":[163],"dataset":[164],"CICIDS2017,":[165],"CIC-DIAD2024":[166,197],"CICIoT2023.":[168,213],"results":[170,247],"show":[171],"framework":[174,230,276],"achieves":[175],"magnifique":[176],"performance,":[180],"achieving":[181],"accuracy":[182,221],"97.80\\%,":[184],"precision":[186,201],"97.60\\%,":[188],"recall":[189,206],"97.70\\%":[191],"F1-score":[193,209],"of97.60\\%":[194],"dataset,":[198],"achieve":[199],"an":[200,219],"97.60\\%":[202,211],",accuracy":[203],"96.80\\%,":[205],"97.70\\%,":[207],"Furthermore,":[214],"proposed":[216,275],"reaches":[218],"overall":[220],"99.89\\%":[223],"CICIDS2017":[226],"benchmark":[227],"dataset.":[228],"maintains":[232],"very":[233],"low":[234],"inference":[235],"latency,":[236],"making":[237,273],"it":[238],"useful":[239,278],"real":[241],"IoT":[243,286],"Experimental":[246],"confirme":[248],"combination":[251],"gradient":[253],"boosting":[254],"learning":[258],"greatly":[259],"improves":[260],"good":[261],"accuracy,":[263],"robustness,":[264],"computational":[265],"activity":[266],"interpretability,":[269],"so":[271],"improving":[281],"security":[283],"future":[285],"networks.":[289]},"counts_by_year":[],"updated_date":"2026-10-31T12:09:11.096373","created_date":"2026-08-28T00:00:00"}