{"id":"https://openalex.org/W7127612860","doi":"https://doi.org/10.1186/s13677-026-00848-y","title":"Online machine learning for proactive threat intelligence and timely DDoS attack prediction","display_name":"Online machine learning for proactive threat intelligence and timely DDoS attack prediction","publication_year":2026,"publication_date":"2026-02-04","ids":{"openalex":"https://openalex.org/W7127612860","doi":"https://doi.org/10.1186/s13677-026-00848-y"},"language":"en","primary_location":{"id":"doi:10.1186/s13677-026-00848-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-026-00848-y","pdf_url":null,"source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1186/s13677-026-00848-y","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5069200789","display_name":"Rrezearta Thaqi","orcid":"https://orcid.org/0009-0007-7721-5228"},"institutions":[{"id":"https://openalex.org/I78768387","display_name":"University of Prishtina","ror":"https://ror.org/05t3p2g92","country_code":"XK","type":"education","lineage":["https://openalex.org/I78768387"]}],"countries":["XK"],"is_corresponding":false,"raw_author_name":"Rrezearta Thaqi","raw_affiliation_strings":["Faculty of Electrical and Computer Engineering, University of Prishtina, Prishtina, Kosovo"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Electrical and Computer Engineering, University of Prishtina, Prishtina, Kosovo","institution_ids":["https://openalex.org/I78768387"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123186135","display_name":"Gabriele Lenzini","orcid":null},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Gabriele Lenzini","raw_affiliation_strings":["Interdisciplinary Centre for Security Reliability and Trust (SnT), University of Luxembourg, Esch-sur-Alzette, Luxembourg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Interdisciplinary Centre for Security Reliability and Trust (SnT), University of Luxembourg, Esch-sur-Alzette, Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005578675","display_name":"Marcus V\u00f6lp","orcid":"https://orcid.org/0000-0002-8020-4446"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Marcus V\u00f6lp","raw_affiliation_strings":["Interdisciplinary Centre for Security Reliability and Trust (SnT), University of Luxembourg, Esch-sur-Alzette, Luxembourg"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Interdisciplinary Centre for Security Reliability and Trust (SnT), University of Luxembourg, Esch-sur-Alzette, Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085641767","display_name":"Blerim Rexha","orcid":"https://orcid.org/0000-0002-3428-7666"},"institutions":[{"id":"https://openalex.org/I78768387","display_name":"University of Prishtina","ror":"https://ror.org/05t3p2g92","country_code":"XK","type":"education","lineage":["https://openalex.org/I78768387"]}],"countries":["XK"],"is_corresponding":true,"raw_author_name":"Blerim Rexha","raw_affiliation_strings":["Faculty of Electrical and Computer Engineering, University of Prishtina, Prishtina, Kosovo"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Electrical and Computer Engineering, University of Prishtina, Prishtina, Kosovo","institution_ids":["https://openalex.org/I78768387"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5085641767"],"corresponding_institution_ids":["https://openalex.org/I78768387"],"apc_list":{"value":1490,"currency":"USD","value_usd":1490},"apc_paid":{"value":1490,"currency":"USD","value_usd":1490},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.10593702,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"15","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8989999890327454,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8989999890327454,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.009800000116229057,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.006399999838322401,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7063000202178955},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.4456000030040741},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4449999928474426},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.38429999351501465},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.37720000743865967},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.36660000681877136},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.3456000089645386},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.3416000008583069},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.33000001311302185},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.3142000138759613}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7836999893188477},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7063000202178955},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5349000096321106},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5256999731063843},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5209000110626221},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.4456000030040741},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4449999928474426},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.38429999351501465},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.37720000743865967},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.36660000681877136},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.3456000089645386},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.3416000008583069},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3142000138759613},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.3111000061035156},{"id":"https://openalex.org/C97256817","wikidata":"https://www.wikidata.org/wiki/Q1462316","display_name":"Spurious relationship","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2962000072002411},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2849000096321106},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.2809999883174896},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2802000045776367},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.2782999873161316},{"id":"https://openalex.org/C83209312","wikidata":"https://www.wikidata.org/wiki/Q1053367","display_name":"Predictive analytics","level":2,"score":0.26600000262260437},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.26420000195503235},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C62230096","wikidata":"https://www.wikidata.org/wiki/Q275969","display_name":"Crowdsourcing","level":2,"score":0.260699987411499},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2556000053882599},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.25360000133514404},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.2517000138759613},{"id":"https://openalex.org/C183003079","wikidata":"https://www.wikidata.org/wiki/Q1000371","display_name":"Personalization","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s13677-026-00848-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-026-00848-y","pdf_url":null,"source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:6f273c611c9d4f9ca7af9e2588a746c1","is_oa":true,"landing_page_url":"https://doaj.org/article/6f273c611c9d4f9ca7af9e2588a746c1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cloud Computing: Advances, Systems and Applications, Vol 15, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s13677-026-00848-y","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s13677-026-00848-y","pdf_url":null,"source":{"id":"https://openalex.org/S2486819371","display_name":"Journal of Cloud Computing Advances Systems and Applications","issn_l":"2192-113X","issn":["2192-113X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cloud Computing","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.5808746814727783,"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W2129112238","https://openalex.org/W3122859344","https://openalex.org/W3161094975","https://openalex.org/W3163100270","https://openalex.org/W3172979816","https://openalex.org/W3190671023","https://openalex.org/W4309557444","https://openalex.org/W4316494270","https://openalex.org/W4360977390","https://openalex.org/W4362544993","https://openalex.org/W4385444259","https://openalex.org/W4386541372","https://openalex.org/W4390636296","https://openalex.org/W4392045078","https://openalex.org/W4393010879","https://openalex.org/W4398173693","https://openalex.org/W4399491114","https://openalex.org/W4402426857","https://openalex.org/W4402475663","https://openalex.org/W4403091078","https://openalex.org/W4403353187","https://openalex.org/W4405281713","https://openalex.org/W4405633113","https://openalex.org/W4405975595","https://openalex.org/W4406257348","https://openalex.org/W4406261838","https://openalex.org/W4406354446","https://openalex.org/W4406500080","https://openalex.org/W4406815189","https://openalex.org/W4407783231","https://openalex.org/W4409508273","https://openalex.org/W4410597999","https://openalex.org/W4411687723","https://openalex.org/W4412346070","https://openalex.org/W4413351215"],"related_works":[],"abstract_inverted_index":{"Distributed":[0],"Denial":[1],"of":[2,234,258,261],"Service":[3],"(DDoS)":[4],"attacks":[5,30],"are":[6],"rapidly":[7],"escalating":[8],"in":[9,31],"scale":[10],"and":[11,34,64,93,95,125,146,152,173,184,201,230,245,288],"sophistication,":[12],"posing":[13],"critical":[14],"threats":[15],"to":[16,228,248,251,274,284],"modern":[17],"cloud":[18,291],"infrastructures.":[19],"Recent":[20],"reports":[21],"from":[22,89,225],"Cloudflare":[23],"show":[24,155],"unprecedented":[25],"attack":[26,286],"volumes,":[27],"20\u00b75":[28],"M":[29],"Q1":[32],"2025,":[33],"sophisticated":[35],"patterns":[36],"such":[37,277],"as":[38,127,278],"low-rate":[39],"stealth":[40],"or":[41,58,255],"bursty":[42],"bots,":[43],"underscoring":[44],"the":[45,171,232,235,262,272],"need":[46],"for":[47,79,148,188],"timely,":[48],"automated":[49,202,275],"threat":[50,103,209,240],"intelligence.":[51],"Traditional":[52],"defenses":[53],"\u2013":[54,61],"static":[55],"IDS":[56],"signatures":[57],"threshold":[59],"rules":[60],"remain":[62],"reactive":[63],"incur":[65],"high":[66],"false-alarm":[67],"rates.":[68],"To":[69],"address":[70],"these":[71],"gaps,":[72],"we":[73,110,222],"propose":[74],"a":[75,85,106,136,140],"real-time":[76],"ML":[77],"framework":[78],"proactive":[80,290],"DDoS":[81,92,214],"defense.":[82],"We":[83],"built":[84],"unified":[86],"labeled":[87],"dataset":[88],"public":[90],"(CIC-IDS2017":[91],"CIC-DDoS2019)":[94],"proprietary,":[96],"pfSense":[97,137],"traffic":[98,134],"captures,":[99],"enriched":[100],"with":[101,144,216],"MISP":[102],"indicators.":[104],"In":[105,220],"comparative":[107],"supervised":[108],"evaluation,":[109],"trained":[111],"multiple":[112],"classifiers":[113],"(SVM,":[114],"Random":[115],"Forest,":[116],"XGBoost)":[117],"via":[118],"cross-validated":[119],"grid":[120],"search,":[121],"using":[122],"accuracy,":[123,162],"precision,":[124],"recall":[126],"key":[128],"metrics.":[129],"The":[130,190],"architecture":[131],"routes":[132],"all":[133,156],"through":[135],"gateway":[138],"into":[139],"Wazuh":[141],"analytics":[142],"node,":[143],"OpenSearch":[145],"Grafana,":[147],"streaming":[149],"feature":[150],"extraction":[151],"prediction.":[153],"Results":[154],"models":[157,283],"achieved":[158],"near-perfect":[159],"detection":[160],"(\u224899.99%":[161],"100%":[163],"precision/recall)":[164],"on":[165,264],"test":[166],"data.":[167],"XGBoost":[168],"slightly":[169],"outperformed":[170],"others":[172],"maintained":[174],"$$":[175,195],">":[176],"99.9~\\%$$":[177],"accuracy":[178],"even":[179],"under":[180],"15,000":[181],"events/sec":[182],"load":[183],"was":[185],"thus":[186],"selected":[187],"deployment.":[189],"pipeline":[191],"sustained":[192],"inference":[193],"latency":[194],"<":[196],"50\\,\\text{ms}$$,":[197],"enabling":[198],"timely":[199],"alerts":[200],"mitigation.":[203],"These":[204],"findings":[205],"demonstrate":[206],"that":[207],"ML-based":[208],"intelligence":[210],"can":[211],"greatly":[212],"enhance":[213],"mitigation":[215],"minimal":[217],"false":[218],"alarms.":[219],"addition,":[221],"draw":[223],"inspiration":[224],"fault":[226],"tolerance":[227],"protect":[229],"improve":[231],"availability":[233],"watchmen":[236],"themselves,":[237],"by":[238],"replicating":[239],"intelligence,":[241],"distributing":[242],"them":[243,247],"geographically,":[244],"require":[246],"reach":[249],"consensus":[250],"filter":[252],"spurious":[253],"alerts,":[254],"worse,":[256],"compromise":[257],"individual":[259],"instances":[260],"servers":[263],"which":[265],"they":[266],"execute.":[267],"Future":[268],"work":[269],"will":[270],"close":[271],"loop":[273],"enforcement,":[276],"dynamic":[279],"firewall":[280],"updates,":[281],"adapt":[282],"evolving":[285],"patterns,":[287],"advancing":[289],"security.":[292]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-02-06T00:00:00"}