Citation :

Jyotsna A Nanajkar, Sudhir B Lande, Sandhya A Shirsat, Anil S Shirsat, Vinay J Nagalkar, "An Adaptive Deep Learning Framework for DDoS Attack Detection under Concept Drift in IoT Networks," International Journal of Electrical and Electronics Engineering, vol. 13, no. 5, pp. 210-225, 2026. Crossref, https://doi.org/10.14445/23488379/IJEEE-V13I5P117

Abstract

DDoS attacks are a constant menace to Internet of Things (IoT) networks because they are growing in magnitude, changing their methods of attack, and can bypass fixed detection systems. This difficulty is also compounded by concept drift, in which the statistical characteristics of network traffic change with time, causing the performance of fixed or periodically retrained machine learning models to degrade quickly. This paper suggests a self-adaptive deep representation learning model to overcome these constraints to detect concept-drift-resilient DDoS attacks in IoT settings. The suggested solution trains small, behavior-sensitive latent network traffic representations and updates them in a prequential streaming protocol. It uses a drift-sensitive stability regularization mechanism to reduce catastrophic forgetting and allow continuous adaptation to changing traffic distributions. The framework is tested on chronologically ordered experimental protocols on recent IoT intrusion datasets, such as CIC IoT DIAD 2024 and IoT-DH, which capture long-term traffic evolution due to device behavior and adaptive attack dynamics. In both datasets, the proposed method has better detection performance than classical and deep learning baselines, with detection accuracies of 95.1% and 94.4%, respectively, and statistically significant improvements (p < 0.01) and a 10.5% increase in Matthews Correlation Coefficient over the best adaptive baseline. The model also shows that there is less temporal performance degradation, and the retraining cost is reduced by 82 % with incremental adaptation. These findings suggest that adaptive latent representation learning offers a strong and computationally efficient approach to maintaining long-term DDoS detection performance in non-stationary IoT network settings.

Keywords

Concept Drift, DDoS Detection, IoT, Network Security, Adaptive Intrusion Detection.

References

1. Mauro Conti et al., “Internet of Things Security and Forensics: Challenges and Opportunities,” Future Generation Computer Systems, vol. 78, pp. 544-546, 2018.
   [CrossRef] [Google Scholar] [Publisher Link]
2. Abebe Abeshu Diro, and Naveen Chilamkurti, “Distributed Attack Detection Scheme using Deep Learning Approach for Internet of Things,” Future Generation Computer Systems, vol. 82, pp. 761-768, 2018.
   [CrossRef] [Google Scholar] [Publisher Link]
3. Monowar H. Bhuyan, D.K. Bhattacharyya, and J.K. Kalita, “Network Anomaly Detection: Methods, Systems and Tools,” IEEE Communications Surveys and Tutorials, vol. 16, no. 1, pp. 303-336, 2014.
   [CrossRef] [Google Scholar] [Publisher Link]
4. Yair Meidan et al., “N-BaIoT: Network-based Detection of IoT Botnet Attacks using Deep Autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12-22, 2018.
   [CrossRef] [Google Scholar] [Publisher Link]
5. Nour Moustafa, and Jill Slay, “UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set),” 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia, pp. 1-6, 2015.
   [CrossRef] [Google Scholar] [Publisher Link]
6. Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,” Proceedings of the 4^th International Conference on Information Systems Security and Privacy (ICISSP 2018), pp. 108-116, 2018.
   [CrossRef] [Google Scholar]
7. João Gama et al., “A Survey on Concept Drift Adaptation,” ACM Computing Surveys, vol. 46, no. 4, pp. 1-37, 2014.
   [CrossRef] [Google Scholar] [Publisher Link]
8. Albert Bifet, and Ricard Gavaldà, “Learning from Time-Changing Data with Adaptive Windowing,” Proceedings of the SIAM International Conference on Data Mining, pp. 443-448, 2007.
   [CrossRef] [Google Scholar] [Publisher Link]
9. Saad Khan, Simon Parkinson, and Yongrui Qin, “Fog Computing Security: A Review of Current Applications and Security Solutions,” Journal of Cloud Computing, vol. 6, no. 1, pp. 1-22, 2017.
   [CrossRef] [Google Scholar] [Publisher Link]
10. Qiang Yang et al., “Federated Machine Learning: Concept and Applications,” ACM Transactions on Intelligent Systems and Technology, vol. 10, no. 2, pp. 1-19, 2019.
    [CrossRef] [Google Scholar] [Publisher Link]
11. Apoorva Gupta et al., “A Review on Machine Learning Techniques for DDoS Attack Detection in IoT,” 2022 4^th International Conference on Artificial Intelligence and Speech Technology (AIST), Delhi, India, pp. 1-6, 2022.
    [CrossRef] [Google Scholar] [Publisher Link]
12. John Kindervag, “Build Security into Your Network’s DNA: The Zero Trust Network Architecture,” Forrester Research, Technical Report, pp. 1-16, 2010.
    [Google Scholar]
13. Tao Peng, Christopher Leckie, and Kotagiri Ramamohanarao, “Survey of Network-based Defense Mechanisms Countering the DoS and DDoS Problems,” ACM Computing Surveys, vol. 39, no. 1, pp. 1-42, 2007.
    [CrossRef] [Google Scholar] [Publisher Link]
14. Arash Habibi Lashkari et al., “Characterization of Tor Traffic using Time-based Features,” Proceedings of the International Conference on Information Systems Security and Privacy (ICISSP), vol. 1, pp. 253-262, 2017.
    [CrossRef] [Google Scholar] [Publisher Link]
15. Chuanlong Yin et al., “A Deep Learning Approach for Intrusion Detection using Recurrent Neural Networks,” IEEE Access, vol. 5, pp. 21954-21961, 2017.
    [CrossRef] [Google Scholar] [Publisher Link]
16. Sydney Mambwe Kasongo, and Yanxia Sun, “A Deep Learning Method with Filter-based Feature Engineering for Wireless Intrusion Detection,” IEEE Access, vol. 7, pp. 38597-38607, 2019.
    [CrossRef] [Google Scholar] [Publisher Link]
17. Liang Xiao et al., “PHY-Layer Spoofing Detection with Reinforcement Learning in Wireless Networks,” IEEE Transactions on Vehicular Technology, vol. 65, no. 12, pp. 10037-10047, 2016.
    [CrossRef] [Google Scholar] [Publisher Link]
18. Jihyun Kim et al., “Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection,” 2016 International Conference on Platform Technology and Service (PlatCon), Jeju, Korea (South), pp. 1-5, 2016.
    [CrossRef] [Google Scholar] [Publisher Link]
19. Pascal Vincent et al., “Extracting and Composing Robust Features with Denoising Autoencoders,” Proceedings of the 25^th International Conference on Machine Learning, New York, NY, United States, pp. 1096-1103, 2008.
    [CrossRef] [Google Scholar] [Publisher Link]
20. Yuancheng Li, Rong Ma, and Runhai Jiao, “A Hybrid Malicious Code Detection Method based on Deep Learning,” International Journal of Security and its Applications, vol. 9, no. 5, pp. 205-216, 2015.
    [CrossRef] [Google Scholar]
21. Zhuo Chen et al., “XGBoost Classifier for DDoS Attack Detection and Analysis in SDN-based Cloud,” 2018 IEEE International Conference on Big Data and Smart Computing (BigComp), Shanghai, China, pp. 251-256, 2018.
    [CrossRef] [Google Scholar] [Publisher Link]
22. Muhammad Umair et al., “Hierarchical Federated Learning Approach for IoT Attacks Classification,” IEEE Access, vol. 14, pp. 65276-65291, 2026.
    [CrossRef] [Google Scholar] [Publisher Link]
23. Francesco Restuccia, Salvatore D’Oro, and Tommaso Melodia, “Securing the Internet of Things in the Age of Machine Learning and Software-Defined Networking,” IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4829-4842, 2018.
    [CrossRef] [Google Scholar] [Publisher Link]
24. Mahdi Rabbani et al., “Device Identification and Anomaly Detection in IoT Environments,” IEEE Internet of Things Journal, vol. 12, no. 10, pp. 13625-13643, 2025.
    [CrossRef] [Google Scholar] [Publisher Link]
25. Syaifuddin Saif, Ridi Ferdiana, and Widyawan Widyawan, IoT-DH Dataset, Mendeley Data, vol. 1, 2024. [Online]. Available: https://data.mendeley.com/datasets/8dns3xbckv/1
26. Manasa Koppula, and L.M.I. Leo Joseph, “A Real-World Dataset “IDSIoT2024” for Machine Learning/Deep Learning Based Cyber Attack Detection System for IoT Architecture” 2025 3^rd International Conference on Intelligent Data Communication Technologies and Internet of Things (IDCIoT), Bengaluru, India, pp. 1757-1764, 2025.
    [CrossRef] [Google Scholar] [Publisher Link]