{"id":"https://openalex.org/W7138833722","doi":"https://doi.org/10.1109/globecom59602.2025.11431718","title":"A Two-Stage LLM-Enhanced DDoS Detection Framework for Next-Generation IoT and Edge Networks","display_name":"A Two-Stage LLM-Enhanced DDoS Detection Framework for Next-Generation IoT and Edge Networks","publication_year":2025,"publication_date":"2025-12-08","ids":{"openalex":"https://openalex.org/W7138833722","doi":"https://doi.org/10.1109/globecom59602.2025.11431718"},"language":null,"primary_location":{"id":"doi:10.1109/globecom59602.2025.11431718","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom59602.2025.11431718","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"GLOBECOM 2025 - 2025 IEEE Global Communications Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129801992","display_name":"Ali Alfatemi","orcid":null},"institutions":[{"id":"https://openalex.org/I164389053","display_name":"Fordham University","ror":"https://ror.org/03qnxaf80","country_code":"US","type":"education","lineage":["https://openalex.org/I164389053"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ali Alfatemi","raw_affiliation_strings":["Fordham Univ.,NY,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fordham Univ.,NY,USA","institution_ids":["https://openalex.org/I164389053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129777853","display_name":"Mohamed Rahouti","orcid":null},"institutions":[{"id":"https://openalex.org/I164389053","display_name":"Fordham University","ror":"https://ror.org/03qnxaf80","country_code":"US","type":"education","lineage":["https://openalex.org/I164389053"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mohamed Rahouti","raw_affiliation_strings":["Fordham Univ.,NY,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fordham Univ.,NY,USA","institution_ids":["https://openalex.org/I164389053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103232490","display_name":"Md Zakirul Alam Bhuiyan","orcid":"https://orcid.org/0000-0002-5996-5259"},"institutions":[{"id":"https://openalex.org/I164389053","display_name":"Fordham University","ror":"https://ror.org/03qnxaf80","country_code":"US","type":"education","lineage":["https://openalex.org/I164389053"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zakirul Alam Bhuiyan","raw_affiliation_strings":["Fordham Univ.,NY,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fordham Univ.,NY,USA","institution_ids":["https://openalex.org/I164389053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129892660","display_name":"Abdellah Chehri","orcid":null},"institutions":[{"id":"https://openalex.org/I51768193","display_name":"Royal Military College of Canada","ror":"https://ror.org/04yr71909","country_code":"CA","type":"education","lineage":["https://openalex.org/I51768193"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Abdellah Chehri","raw_affiliation_strings":["Royal Military College,Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Royal Military College,Canada","institution_ids":["https://openalex.org/I51768193"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081065040","display_name":"Aiman Solyman","orcid":"https://orcid.org/0000-0003-3570-7981"},"institutions":[{"id":"https://openalex.org/I189158943","display_name":"University of Milan","ror":"https://ror.org/00wjc7c48","country_code":"IT","type":"education","lineage":["https://openalex.org/I189158943"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Aiman Solyman","raw_affiliation_strings":["Univ. of Milano,Milan,Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Univ. of Milano,Milan,Italy","institution_ids":["https://openalex.org/I189158943"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"7","last_page":"12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9107999801635742,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9107999801635742,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.01679999940097332,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.007400000002235174,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.8003000020980835},{"id":"https://openalex.org/keywords/handshake","display_name":"Handshake","score":0.758400022983551},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.6101999878883362},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5720000267028809},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5393000245094299},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.45419999957084656},{"id":"https://openalex.org/keywords/edge-computing","display_name":"Edge computing","score":0.4465999901294708},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4359999895095825},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.3955000042915344}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8003000020980835},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7854999899864197},{"id":"https://openalex.org/C2778000800","wikidata":"https://www.wikidata.org/wiki/Q830043","display_name":"Handshake","level":3,"score":0.758400022983551},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.6101999878883362},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5720000267028809},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5583999752998352},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5393000245094299},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.45419999957084656},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.4465999901294708},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4359999895095825},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.3955000042915344},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3946000039577484},{"id":"https://openalex.org/C33588617","wikidata":"https://www.wikidata.org/wiki/Q8803","display_name":"Transmission Control Protocol","level":3,"score":0.36390000581741333},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3537999987602234},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3422999978065491},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.3384999930858612},{"id":"https://openalex.org/C146357865","wikidata":"https://www.wikidata.org/wiki/Q1123245","display_name":"Stage (stratigraphy)","level":2,"score":0.3310000002384186},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.328000009059906},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.31520000100135803},{"id":"https://openalex.org/C35341882","wikidata":"https://www.wikidata.org/wiki/Q8795","display_name":"Internet Protocol","level":3,"score":0.30970001220703125},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2896000146865845},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.2806999981403351},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.27320000529289246},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.26510000228881836},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.25369998812675476}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/globecom59602.2025.11431718","is_oa":false,"landing_page_url":"https://doi.org/10.1109/globecom59602.2025.11431718","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"GLOBECOM 2025 - 2025 IEEE Global Communications Conference","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6057116389274597,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2148143831","https://openalex.org/W2319799779","https://openalex.org/W2903294440","https://openalex.org/W2991723423","https://openalex.org/W4226319939","https://openalex.org/W4290991228","https://openalex.org/W4313040043","https://openalex.org/W4316039105","https://openalex.org/W4384695285","https://openalex.org/W4387183101","https://openalex.org/W4391530944","https://openalex.org/W4391671051","https://openalex.org/W4402672004","https://openalex.org/W4404102101","https://openalex.org/W4404744329","https://openalex.org/W4406613874","https://openalex.org/W4407163436","https://openalex.org/W4414568607"],"related_works":[],"abstract_inverted_index":{"The":[0,61],"rapid":[1],"expansion":[2],"of":[3,102,116],"IoT":[4,38,96],"and":[5,24,39,108],"edge":[6,40],"networks":[7,41],"has":[8],"increased":[9],"vulnerability":[10],"to":[11],"security":[12],"threats,":[13],"notably":[14],"Distributed":[15],"Denial-of-Service":[16],"(DDoS)":[17],"attacks,":[18],"which":[19],"target":[20],"the":[21,72,105,114],"application":[22],"layer":[23],"can":[25],"overwhelm":[26],"networks.":[27],"This":[28],"paper":[29],"introduces":[30],"a":[31,94],"novel":[32],"two-stage":[33],"DDoS":[34,77],"detection":[35,100],"pipeline":[36],"for":[37,49,125],"that":[42],"utilizes":[43],"large":[44],"language":[45],"model":[46],"(LLM)":[47],"embeddings":[48],"textual":[50,119],"protocol":[51],"fields":[52],"along":[53],"with":[54,121],"numeric":[55,123],"features":[56],"like":[57],"TCP":[58],"handshake":[59],"metrics.":[60],"first":[62,106],"stage":[63,74,107],"accurately":[64],"identifies":[65],"traffic":[66],"as":[67],"Normal":[68],"or":[69],"DDoS,":[70],"while":[71],"second":[73],"classifies":[75],"confirmed":[76],"flows":[78],"into":[79],"specific":[80],"types":[81],"(UDP,":[82],"ICMP,":[83],"TCP,":[84],"HTTP),":[85],"correcting":[86],"any":[87],"initial":[88],"false":[89],"positives.":[90],"Comprehensive":[91],"testing":[92],"on":[93],"specialized":[95],"dataset":[97],"demonstrated":[98],"perfect":[99],"rates":[101],"100%":[103],"in":[104,110],"99.91%":[109],"subclass":[111],"classification,":[112],"highlighting":[113],"effectiveness":[115],"combining":[117],"LLM-based":[118],"data":[120],"traditional":[122],"indicators":[124],"advanced":[126],"intrusion":[127],"detection.":[128]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-20T00:00:00"}