{"id":"https://openalex.org/W7225147152","doi":"https://doi.org/10.1186/s13677-025-00786-1","title":"Enhancing DDoS attack detection and mitigation in SDNS using tharn-aided feature-driven detection and Q-Mitigate reinforcement learning","display_name":"Enhancing DDoS attack detection and mitigation in SDNS using tharn-aided feature-driven detection and Q-Mitigate reinforcement learning","publication_year":2026,"publication_date":"2026-11-03","ids":{"openalex":"https://openalex.org/W7225147152","doi":"https://doi.org/10.1186/s13677-025-00786-1"},"language":"en","primary_location":{"id":"doi:10.1186/s13677-025-00786-1","doi":"https://doi.org/10.1186/s13677-025-00786-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-025-00786-1","pdf_url":"https://link.springer.com/content/pdf/10.1186/s13677-025-00786-1.pdf","source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://link.springer.com/content/pdf/10.1186/s13677-025-00786-1.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5160492562","display_name":"Mohammad Shahid","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4405255737","display_name":"Indian Institute of Information Technology, Sonepat","ror":"https://ror.org/03c52pz66","country_code":"IN","type":"education","lineage":["https://openalex.org/I4405255737"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Mohammad Shahid","raw_affiliation_strings":["Research Scholar, Department of Computer Science and Engineering, Indian Institute of Information Technology Sonepat, Haryana, 131029, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Scholar, Department of Computer Science and Engineering, Indian Institute of Information Technology Sonepat, Haryana, 131029, India","institution_ids":["https://openalex.org/I4405255737"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089379470","display_name":"Mukesh Mann","orcid":"https://orcid.org/0000-0003-4757-9710","observed_orcids":["https://orcid.org/0000-0003-4757-9710"]},"institutions":[{"id":"https://openalex.org/I4405255737","display_name":"Indian Institute of Information Technology, Sonepat","ror":"https://ror.org/03c52pz66","country_code":"IN","type":"education","lineage":["https://openalex.org/I4405255737"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Mukesh Mann","raw_affiliation_strings":["Department of Computer Science and Engineering, Indian Institute of Information Technology Sonepat, Haryana, India"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Indian Institute of Information Technology Sonepat, Haryana, India","institution_ids":["https://openalex.org/I4405255737"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5089379470","https://openalex.org/A5160492562"],"corresponding_institution_ids":["https://openalex.org/I4405255737"],"apc_list":{"value":1790,"currency":"USD","value_usd":1790},"apc_paid":{"value":1790,"currency":"USD","value_usd":1790},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.00039999998989515007,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ddos-detection","display_name":"DDoS attack detection","score":0.996999979019165},{"id":"https://openalex.org/keywords/sdn-security","display_name":"SDN security","score":0.6420000195503235},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.6690000295639038},{"id":"https://openalex.org/keywords/control-plane-attacks","display_name":"control plane attacks","score":0.5580000281333923},{"id":"https://openalex.org/keywords/smote","display_name":"SMOTE","score":0.6000000238418579},{"id":"https://openalex.org/keywords/class-imbalance","display_name":"class imbalance","score":0.8190000057220459},{"id":"https://openalex.org/keywords/feature-selection","display_name":"feature selection","score":0.8420000076293945},{"id":"https://openalex.org/keywords/lstm","display_name":"LSTM","score":0.6389999985694885},{"id":"https://openalex.org/keywords/gru","display_name":"GRU","score":0.9409999847412109},{"id":"https://openalex.org/keywords/temporal-convolutional-network","display_name":"temporal convolutional network","score":0.8659999966621399},{"id":"https://openalex.org/keywords/attention-mechanism","display_name":"attention mechanism","score":0.9340000152587891}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7483000159263611},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.7213000059127808},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6726999878883362},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.4690999984741211},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.4375},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.4235999882221222},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4081000089645386},{"id":"https://openalex.org/C186594467","wikidata":"https://www.wikidata.org/wiki/Q1429176","display_name":"Flooding (psychology)","level":2,"score":0.3831999897956848},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3610000014305115},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.35499998927116394},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.35249999165534973},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3393999934196472},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3269999921321869},{"id":"https://openalex.org/C10597312","wikidata":"https://www.wikidata.org/wiki/Q5473302","display_name":"Forwarding plane","level":3,"score":0.3199000060558319},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3163999915122986},{"id":"https://openalex.org/C2778924833","wikidata":"https://www.wikidata.org/wiki/Q7064603","display_name":"Novelty detection","level":3,"score":0.30730000138282776},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2994000017642975},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2928999960422516},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28839999437332153},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2849999964237213},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.28380000591278076},{"id":"https://openalex.org/C197323446","wikidata":"https://www.wikidata.org/wiki/Q331222","display_name":"Oversampling","level":3,"score":0.2782000005245209},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.26019999384880066},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.25690001249313354},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.2556000053882599},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.25519999861717224},{"id":"https://openalex.org/C77270119","wikidata":"https://www.wikidata.org/wiki/Q1655198","display_name":"Software-defined networking","level":2,"score":0.25360000133514404},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2535000145435333},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.2531999945640564}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s13677-025-00786-1","doi":"https://doi.org/10.1186/s13677-025-00786-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-025-00786-1","pdf_url":"https://link.springer.com/content/pdf/10.1186/s13677-025-00786-1.pdf","source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:76b0cff814ec4b98931a6bb5e9ba4c99","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/76b0cff814ec4b98931a6bb5e9ba4c99","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cloud Computing: Advances, Systems and Applications, Vol 15, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s13677-025-00786-1","doi":"https://doi.org/10.1186/s13677-025-00786-1","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-025-00786-1","pdf_url":"https://link.springer.com/content/pdf/10.1186/s13677-025-00786-1.pdf","source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","dongbi-d","jufo-1","ki-jl-1","norway-1","oarl","poland-100","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225147152.pdf","grobid_xml":"https://content.openalex.org/works/W7225147152.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W2759357597","https://openalex.org/W2789828921","https://openalex.org/W2998727463","https://openalex.org/W3097281673","https://openalex.org/W3112746081","https://openalex.org/W3125202931","https://openalex.org/W4200206556","https://openalex.org/W4210631259","https://openalex.org/W4211244664","https://openalex.org/W4226315262","https://openalex.org/W4282042832","https://openalex.org/W4311392129","https://openalex.org/W4312684043","https://openalex.org/W4318052012","https://openalex.org/W4322744673","https://openalex.org/W4367310368","https://openalex.org/W4386065491","https://openalex.org/W4386091133","https://openalex.org/W4387880013","https://openalex.org/W4388274259","https://openalex.org/W4393346275","https://openalex.org/W4395467455","https://openalex.org/W4400981505","https://openalex.org/W4406927588","https://openalex.org/W4408155247","https://openalex.org/W4408571517","https://openalex.org/W4413416187"],"related_works":["https://openalex.org/W7128481023","https://openalex.org/W4407691942","https://openalex.org/W7163875517","https://openalex.org/W7166461610","https://openalex.org/W4406261845","https://openalex.org/W7171287876","https://openalex.org/W4407677482","https://openalex.org/W4413881127","https://openalex.org/W3037176165","https://openalex.org/W4407302029"],"abstract_inverted_index":{"Software-Defined":[0],"Networking":[1],"(SDN)":[2],"offers":[3],"flexibility":[4],"and":[5,34,73,89,108,126,137,152],"programmability":[6],"but":[7],"also":[8,144],"exposes":[9],"the":[10,115,135,140],"control":[11],"plane":[12],"to":[13,105],"Distributed":[14],"Denial-of-Service":[15],"(DDoS)":[16],"attacks":[17],"that":[18,56,81,119],"can":[19],"degrade":[20],"network":[21],"performance.":[22],"Existing":[23],"intrusion":[24],"detection":[25,107,151],"frameworks":[26],"often":[27],"suffer":[28],"from":[29],"class":[30],"imbalance,":[31],"feature":[32,71],"redundancy,":[33],"limited":[35],"temporal":[36],"modeling,":[37],"which":[38],"reduce":[39],"their":[40],"effectiveness":[41,136],"in":[42,154],"detecting":[43],"diverse":[44],"attack":[45],"patterns.":[46],"To":[47],"address":[48],"these":[49],"challenges,":[50],"we":[51],"propose":[52],"a":[53,74,97],"novel":[54],"pipeline":[55],"integrates":[57],"Synthetic":[58],"Minority":[59],"Oversampling":[60],"Technique":[61],"(SMOTE)":[62],"for":[63,69,92,147],"balancing,":[64],"Hybrid":[65,76],"Crayfish\u2013Gazelle":[66],"Optimization":[67],"(HCGO)":[68],"optimal":[70],"selection,":[72],"Temporal":[75,85],"Attention":[77],"Recurrent":[78],"Network":[79],"(THARN)":[80],"combines":[82],"LSTM,":[83],"GRU,":[84],"Convolutional":[86],"Networks":[87],"(TCN),":[88],"attention":[90],"mechanism":[91],"robust":[93],"classification.":[94],"In":[95],"addition,":[96],"reinforcement":[98],"learning\u2013based":[99],"policy":[100],"module,":[101],"Q-Mitigate":[102],"is":[103],"specified":[104],"bridge":[106],"adaptive":[109],"SDN":[110,155],"mitigation.":[111],"Experimental":[112],"evaluation":[113],"on":[114],"CIC-DDoS2017":[116],"dataset":[117],"demonstrates":[118],"THARN":[120],"achieves":[121],"99.38%":[122],"accuracy,":[123],"99.58%":[124],"precision,":[125],"99.45%":[127],"F1-score,":[128],"outperforming":[129],"existing":[130],"approaches.":[131],"These":[132],"results":[133],"confirm":[134],"novelty":[138],"of":[139,150],"proposed":[141],"system,":[142],"while":[143],"providing":[145],"foundation":[146],"future":[148],"integration":[149],"mitigation":[153],"environments.":[156]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-04T00:00:00"}