2026· IEEE Transactions on Network and Service Management· Vol 23, pp. 5940-5949· 0 citations· 40 references
Computer Science
Abstract
Distributed Denial-of-Service (DDoS) attacks across cloud, edge, and Internet-of-Things infrastructures have intensified the need for detectors that are accurate, computationally efficient, and deployable at resource-constrained monitoring points. Much of the intrusion-detection literature implicitly links detection quality to architectural depth, larger parameter spaces, and richer learned representations. This paper examines a narrower hypothesis: for binary flow-level DDoS detection, a carefully engineered shallow pipeline can retain high detection quality while maintaining a compact computational footprint. We propose ShallowNet, a single-hidden-layer neural detector integrated with leakage-aware data partitioning, training-only normalization, principled feature selection, class-imbalance-aware optimization, early stopping, and calibration-guided threshold selection. The evaluation extends beyond standard held-out accuracy by incorporating cross-day temporal transfer, leave-one-attack-family-out robustness testing, controlled baseline comparison, systematic pipeline ablation, and probability-calibration analysis. The results show both the empirical utility and the limits of the approach: class concentration in widely used benchmark datasets can make aggregate metrics overly optimistic, and generalization degrades most sharply when the test traffic contains attack signatures absent from training. These findings suggest that, in lightweight binary flow-level DDoS detection, disciplined pipeline design can be as important as model depth and that stress-tested evaluation should accompany high benchmark accuracy claims.
Web injection attacks continue to threaten critical infrastructures in power network environments because traditional Web Application Firewalls show limited adaptability when attack payloads become obfuscated or structurally modified. Existing detection approaches also face challenges from heterogeneous payload structures and the trade-off between detection accuracy and inference efficiency under high-concurrency environments. We thus propose an injection attack detection framework, TDNET, that combines dual-channel feature extraction, multidimensional feature fusion, adaptive attention refinement, and time-sensitive neural architecture search optimization. Unlike prior work that adopts off-the-shelf components, each module in TDNET is specifically adapted for the injection detection task: the character channel captures fine-grained structural perturbations, the subword channel preserves semantic token relationships, and a cross-layer fusion mechanism retains hierarchical representations from all encoder depths. Experiments on public datasets and generated attack samples containing SQL injection, XSS, and RCE payloads demonstrate that TDNET achieves an F1-score of 98.13%, which exceeds the compared baselines by an average of 3.94%. Ablation studies confirm that the dual-channel design provides complementary gains over single-channel variants, and the FPD-searched architecture reduces normalized inference time to 65.47% while maintaining detection performance close to the full architecture.
Congzhao Wen, Mingzhan Wu, Kongsheng Lin et al.· IEEE Access· 0 citations
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Fatimah Alhamzawi· Al-Noor Journal of Engineeri...· 0 citations
Deep learning has generated strong results for network intrusion detection, but much of the literature still treats the problem as static offline classification, leaving unclear how such models should be conceived for deployment. In practice, intrusion detection must learn from traffic streams, cope with previously unseen attacks, and exploit heterogeneous evidence sources without relying on bulky preprocessing or heavyweight models. This paper addresses that conceptual gap by introducing SmartVille, a framework for formulating and studying deep learning-based NID under online, open-world, and multi-modal assumptions. The main contribution is therefore not a new stand-alone detection algorithm, but a coherent research blueprint that integrates existing learning principles into a single technical vision. In particular, SmartVille advocates an end-to-end differentiable encode–process–decode organisation, in which neural encoders replace bulk feature engineering, online learning replaces static train-once evaluation, and collective anomaly detection is studied alongside supervised classification within the same framework. This perspective clarifies what SmartVille specifically solves: it provides a principled way to design, train, and benchmark adaptive NID models under realistic assumptions, while separating the theoretical contribution from its open-source implementation. Representative use cases show how the framework can be used to analyse curriculum design, input-modality composition, and architectural choices for adaptive intrusion detection research.
J. F. C. Moreno, A. Rizzardi, S. Sicari et al.· Journal of Network and Syste...· 0 citations
: The increasing frequency and sophistication of cyber-attacks continue to expose vulnerabilities in modern digital infrastructures. System logs provide a rich source of evidence for detecting such threats, but raw logs are noisy, heterogeneous, and imbalanced, making them inconvenient for direct machine learning applications. This paper presents LogFusion, a lightweight preprocessing pipeline that fuses contextual embeddings of log messages with engineered behavioural indicators (e.g., temporal windows, event rarity, and log-level dynamics) to produce machine learning-ready features for unsupervised anomaly detection algorithms. Evaluated on three public benchmark datasets (HDFS, BGL, and OpenStack), LogFusion increases anomaly detection accuracy from 51 – 61% (raw Bag-of-Words baseline) to 84 – 98% across all detectors, with consistently high recall (>0.95 on HDFS and OpenStack). On HDFS, LogFusion-OCSVM achieves 87% F1-score, outperforming LogBERT (82.32%) and other deep learning baselines. Runtime profiling confirms end-to-end processing under 13 seconds on CPU-only hardware, demonstrating practical feasibility for resource-constrained deployments in SMEs and IoT/edge environments.
S. Rahman, A. Ullah, Masoud Mohammadian et al.· Proceedings of the 23rd Inte...· 0 citations
Low-and-slow data exfiltration by malicious insiders remains among the most operationally difficult threat classes to detect: the behavior is unremarkable in any individual session and becomes recognizable only across weeks of otherwise routine activity. This paper presents a UEBA-based machine learning framework that constructs per-user behavioral profiles from enterprise proxy and access log data, scoring sessions against a 30-feature behavioral representation spanning temporal patterns, data-transfer anomalies, domain interactions, HTTP characteristics, and session-device signals. The contribution is an operationally integrated and empirically audited UEBA pipeline that combines a pre-specified behavioral representation, isolated evaluation regimes, and session-level analyst explanations. Training used a hybrid corpus of approximately 8.96 million sessions drawn from 160 GB of real and behaviorally parameterized simulated logs. On the full hybrid held-out partition, the LightGBM classifier achieved 96.84% overall accuracy, 95.38% balanced accuracy, 91.80% malicious-class precision, 92.90% recall, 92.35% F1-score, and 98.2% ROC-AUC. Because the hybrid test set uses an enriched 20.5% malicious-session evaluation prevalence, balanced accuracy and malicious-class F1 are emphasized alongside overall accuracy. In the strict real-only evaluation, the independently trained and calibrated LightGBM model achieved 95.99% overall accuracy, 93.80% balanced accuracy, 90.30% malicious-class precision, 90.10% recall, 90.20% F1-score, and 95.8% ROC-AUC, while hybrid-to-real transfer achieved 90.1% F1-score, 89.8% recall, and 96.1% ROC-AUC. These settings are reported separately to distinguish full-corpus benchmark performance from real-log generalization. Each scored session is accompanied by a SHAP-based decomposition that identifies which behavioral signals drove the alert, supporting analyst triage in operational SOC environments. The framework was further validated on a confirmed 17-day insider exfiltration incident that existing organizational controls had not detected. BiLSTM and a Tabular Transformer evaluated under the same regime-specific partitions produced closely matched performance, with malicious-class F1 differences of at most 0.4 percentage points; LightGBM retained the strongest measured performance–deployment trade-off for the engineered tabular pipeline.
L. Lanuwabang, S. Suprakash· Applied Sciences· 0 citations
Software-Defined Networking (SDN) has become a key enabler of next-generation communication infrastructures because of its centralized control, programmability, and global network visibility. However, the centralized architecture also introduces significant security vulnerabilities, making SDN environments highly susceptible to attacks such as DoS, DDoS, probing, brute-force, and botnet activities. Although deep learning-based intrusion detection systems have achieved high detection accuracy, many existing approaches suffer from high computational complexity, long training time, and limited suitability for real-time deployment. This study addresses this gap by developing a lightweight stacking ensemble intrusion detection framework for SDN using the InSDN dataset. The proposed framework employs XGBoost, LightGBM, CatBoost, Random Forest, and Extra Trees as base learners, with Logistic Regression serving as the meta-learner. Experiments were conducted using 48-feature, 6-feature, and 4-feature configurations derived from previous feature-reduction studies. The results demonstrate consistently high detection performance, achieving accuracies above 99% across all feature subsets, with only marginal degradation under reduced feature dimensions. The framework showed excellent detection capability for major attack categories while maintaining reliable performance for most minority classes. These findings demonstrate that stacking ensemble learning is a practical and computationally efficient alternative to complex deep learning architectures for SDN intrusion detection, with strong potential for scalable and real-time cybersecurity deployment in modern network environments.
Ubakaghinwa Paul Chigbu, Abdulrashid Abdulrauf, Ishaq Isa et al.· Scientific Journal of Comput...· 0 citations