{"id":"https://openalex.org/W7161801470","doi":"https://doi.org/10.1007/s43926-026-00366-y","title":"A hybrid CNN-LSTM framework driven by XGBoost for real-time DDoS detection in industrial IoT","display_name":"A hybrid CNN-LSTM framework driven by XGBoost for real-time DDoS detection in industrial IoT","publication_year":2026,"publication_date":"2026-05-20","ids":{"openalex":"https://openalex.org/W7161801470","doi":"https://doi.org/10.1007/s43926-026-00366-y"},"language":"en","primary_location":{"id":"doi:10.1007/s43926-026-00366-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s43926-026-00366-y","pdf_url":null,"source":{"id":"https://openalex.org/S4210230675","display_name":"Discover Internet of Things","issn_l":"2730-7239","issn":["2730-7239"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Internet of Things","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1007/s43926-026-00366-y","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5010355070","display_name":"Deo Irankunda","orcid":"https://orcid.org/0000-0001-8950-2493"},"institutions":[{"id":"https://openalex.org/I81605866","display_name":"Sidi Mohamed Ben Abdellah University","ror":"https://ror.org/04efg9a07","country_code":"MA","type":"education","lineage":["https://openalex.org/I81605866"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Deo Irankunda","raw_affiliation_strings":["Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco","institution_ids":["https://openalex.org/I81605866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059703645","display_name":"Khalid El Fazazy","orcid":"https://orcid.org/0000-0002-6333-2235"},"institutions":[{"id":"https://openalex.org/I81605866","display_name":"Sidi Mohamed Ben Abdellah University","ror":"https://ror.org/04efg9a07","country_code":"MA","type":"education","lineage":["https://openalex.org/I81605866"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Khalid El Fazazy","raw_affiliation_strings":["Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco","institution_ids":["https://openalex.org/I81605866"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136547298","display_name":"Tairi Hamid","orcid":null},"institutions":[{"id":"https://openalex.org/I81605866","display_name":"Sidi Mohamed Ben Abdellah University","ror":"https://ror.org/04efg9a07","country_code":"MA","type":"education","lineage":["https://openalex.org/I81605866"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Tairi Hamid","raw_affiliation_strings":["Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco","institution_ids":["https://openalex.org/I81605866"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136525417","display_name":"Jamal Riffi","orcid":null},"institutions":[{"id":"https://openalex.org/I81605866","display_name":"Sidi Mohamed Ben Abdellah University","ror":"https://ror.org/04efg9a07","country_code":"MA","type":"education","lineage":["https://openalex.org/I81605866"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Jamal Riffi","raw_affiliation_strings":["Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Laboratoire, Informatique, Innovation et Intelligence Artificielle (L3IA), Faculty of Sciences Dhar El Mahraz, Sidi Mohamed Ben Abdellah University, Fez, Morocco","institution_ids":["https://openalex.org/I81605866"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5010355070"],"corresponding_institution_ids":["https://openalex.org/I81605866"],"apc_list":{"value":1340,"currency":"USD","value_usd":1340},"apc_paid":{"value":1340,"currency":"USD","value_usd":1340},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.58208312,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"6","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7073000073432922,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7073000073432922,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.07919999957084656,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.0494999997317791,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adaptability","display_name":"Adaptability","score":0.7056999802589417},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6306999921798706},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.6172000169754028},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6148999929428101},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.5235999822616577},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.508899986743927},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.4147000014781952},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.3878999948501587},{"id":"https://openalex.org/keywords/flooding","display_name":"Flooding (psychology)","score":0.38119998574256897},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.36039999127388}],"concepts":[{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.7056999802589417},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.699999988079071},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6306999921798706},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.6172000169754028},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6148999929428101},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.5235999822616577},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.508899986743927},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5037999749183655},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4887000024318695},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.43639999628067017},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.4171000123023987},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.4147000014781952},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.3878999948501587},{"id":"https://openalex.org/C186594467","wikidata":"https://www.wikidata.org/wiki/Q1429176","display_name":"Flooding (psychology)","level":2,"score":0.38119998574256897},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.36039999127388},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3544999957084656},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.34459999203681946},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.3418000042438507},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.320499986410141},{"id":"https://openalex.org/C152745839","wikidata":"https://www.wikidata.org/wiki/Q5438153","display_name":"Fault detection and isolation","level":3,"score":0.31940001249313354},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.31700000166893005},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3098999857902527},{"id":"https://openalex.org/C24590314","wikidata":"https://www.wikidata.org/wiki/Q336038","display_name":"Wireless sensor network","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.30149999260902405},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3003000020980835},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.2985999882221222},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.2976999878883362},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.29649999737739563},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29600000381469727},{"id":"https://openalex.org/C202839342","wikidata":"https://www.wikidata.org/wiki/Q60740481","display_name":"Industrial Internet","level":3,"score":0.29269999265670776},{"id":"https://openalex.org/C2776151529","wikidata":"https://www.wikidata.org/wiki/Q3045304","display_name":"Object detection","level":3,"score":0.2870999872684479},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.28459998965263367},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.28360000252723694},{"id":"https://openalex.org/C186108316","wikidata":"https://www.wikidata.org/wiki/Q352530","display_name":"Adaptive neuro fuzzy inference system","level":4,"score":0.2770000100135803},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2768999934196472},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.2646999955177307},{"id":"https://openalex.org/C47432892","wikidata":"https://www.wikidata.org/wiki/Q831390","display_name":"Wavelet","level":2,"score":0.2628999948501587},{"id":"https://openalex.org/C28006648","wikidata":"https://www.wikidata.org/wiki/Q6934509","display_name":"Multi-task learning","level":3,"score":0.2624000012874603}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1007/s43926-026-00366-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s43926-026-00366-y","pdf_url":null,"source":{"id":"https://openalex.org/S4210230675","display_name":"Discover Internet of Things","issn_l":"2730-7239","issn":["2730-7239"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Internet of Things","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:edfd7d2e46904c2bab120bafcf99aa31","is_oa":false,"landing_page_url":"https://doaj.org/article/edfd7d2e46904c2bab120bafcf99aa31","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Discover Internet of Things, Vol 6, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1007/s43926-026-00366-y","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s43926-026-00366-y","pdf_url":null,"source":{"id":"https://openalex.org/S4210230675","display_name":"Discover Internet of Things","issn_l":"2730-7239","issn":["2730-7239"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Discover Internet of Things","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10","score":0.6337639093399048}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W2592836536","https://openalex.org/W2594122124","https://openalex.org/W2982625639","https://openalex.org/W2983008824","https://openalex.org/W3005624724","https://openalex.org/W3022086662","https://openalex.org/W3032258369","https://openalex.org/W3102953301","https://openalex.org/W3108643162","https://openalex.org/W3135463650","https://openalex.org/W3140854437","https://openalex.org/W4210670677","https://openalex.org/W4210912339","https://openalex.org/W4310676124","https://openalex.org/W4310699669","https://openalex.org/W4312333477","https://openalex.org/W4318570420","https://openalex.org/W4319791240","https://openalex.org/W4320917128","https://openalex.org/W4379417418","https://openalex.org/W4385218718","https://openalex.org/W4385611204","https://openalex.org/W4386408881","https://openalex.org/W4389764463","https://openalex.org/W4390062720","https://openalex.org/W4393115034","https://openalex.org/W4393164799","https://openalex.org/W4405292220","https://openalex.org/W4407362533","https://openalex.org/W4407838649","https://openalex.org/W4408793763","https://openalex.org/W4412787150"],"related_works":[],"abstract_inverted_index":{"The":[0,98,137],"Internet":[1],"of":[2,18,162,166,170,176,192],"Things":[3],"(IoT)":[4],"has":[5],"significantly":[6],"revolutionized":[7],"industrial":[8,219],"sectors":[9],"but":[10],"introduced":[11],"vulnerabilities,":[12],"exposing":[13],"them":[14],"to":[15,57,72,106,114,122,134,226,231],"Distributed":[16],"Denial":[17],"Service":[19],"(DDoS)":[20],"attacks.":[21,233],"These":[22],"attacks":[23],"cause":[24],"severe":[25],"damage,":[26,33],"including":[27],"financial":[28],"losses,":[29],"productivity":[30],"decline,":[31],"reputational":[32],"and":[34,62,81,88,91,96,119,131,145,172,189,212,229],"customer":[35],"dissatisfaction.":[36],"To":[37],"address":[38],"these":[39,126],"challenges,":[40],"this":[41],"study":[42,207],"proposes":[43],"a":[44,59,164,168,187,209],"novel":[45],"hybrid":[46],"detection":[47,65,143,217],"framework":[48,68,99],"that":[49],"integrates":[50],"XGBoost-based":[51],"feature":[52],"selection":[53],"with":[54,222],"CNN-LSTM":[55],"architectures":[56],"build":[58],"robust,":[60],"scalable,":[61,210],"real-time":[63],"DDoS":[64,154],"system.":[66],"This":[67,206],"leverages":[69],"the":[70,141,152,157,199],"ability":[71],"identify":[73],"discriminative":[74],"features":[75],"from":[76],"high-IoT":[77],"traffic,":[78],"reduce":[79],"noise":[80],"computational":[82],"overhead":[83],"using":[84,94,198],"gradient":[85],"extreme":[86],"boosting,":[87],"capture":[89],"spatial":[90],"temporal":[92],"dependencies":[93],"CNNs":[95],"LSTMs.":[97],"is":[100],"also":[101],"enhanced":[102],"by":[103],"adaptive":[104],"learning":[105,113],"improve":[107,123],"flexibility":[108],"against":[109,117],"sophisticated":[110,227],"attacks,":[111],"adversarial":[112,232],"bolster":[115],"robustness":[116,132],"evasion,":[118],"attention":[120],"mechanisms":[121],"interpretability.":[124],"Combining":[125],"elements":[127],"enhances":[128],"accuracy,":[129,183,224],"resilience,":[130],"compared":[133],"existing":[135],"frameworks.":[136],"experimental":[138],"results":[139],"demonstrate":[140],"high":[142],"performance":[144],"efficiency":[146],"across":[147],"multiple":[148],"datasets.":[149],"Evaluated":[150],"on":[151],"LR-HR":[153],"2024":[155],"dataset,":[156,201],"model":[158],"achieved":[159,181],"an":[160,173,190],"accuracy":[161],"99.25%,":[163],"precision":[165],"99.15%,":[167],"recall":[169],"99.64%,":[171],"F1":[174],"score":[175],"99.39%.":[177],"On":[178],"UNSWA-NB15,":[179],"it":[180,202],"99.31%":[182],"99.45%":[184],"precision,":[185],"99.30%":[186],"recall,":[188],"F1-score":[191],"99.38%,":[193],"while":[194],"in":[195,218],"cross-domain":[196],"validation":[197],"CICIoT2023":[200],"reached":[203],"93.33%":[204],"accuracy.":[205],"provides":[208],"effective,":[211],"reliable":[213],"solution":[214],"for":[215],"intrusion":[216],"IoT":[220],"environments,":[221],"improved":[223],"adaptability":[225],"threats,":[228],"resilience":[230]},"counts_by_year":[],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2026-05-21T00:00:00"}