Ensemble-based detection of distributed denial-of-service attacks in IoT networks using majority decision mechanisms.

Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Mar 27;16:10886. doi: 10.1038/s41598-025-23638-z Search in PMC Search in PubMed View in NLM Catalog Add to search Ensemble-based detection of distributed denial-of-service attacks in IoT networks using majority decision mechanisms Suha Cheng Suha Cheng 1 School of Information Engineering , Henan University of Technology , Zhengzhou , 450001 Henan China Find articles by Suha Cheng 1, ✉ , Xu Feng Xu Feng 2 Xuchang Industrial IoT Technology Co., Xuchang, 4510002 Henan China Find articles by Xu Feng 2 Author information Article notes Copyright and License information 1 School of Information Engineering , Henan University of Technology , Zhengzhou , 450001 Henan China 2 Xuchang Industrial IoT Technology Co., Xuchang, 4510002 Henan China ✉ Corresponding author. Received 2025 Feb 19; Accepted 2025 Oct 8; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ . PMC Copyright notice PMCID: PMC13039296  PMID: 41896554 Abstract The widespread adoption of Internet of Things (IoT) devices has increased security risks, especially from Distributed Denial of Service (DDoS) attacks that exploit their limited resources. Existing Intrusion Detection Systems (IDS) often fail to provide high accuracy and produce excessive false positives when dealing with diverse traffic patterns in IoT networks. This study introduces a Majority Voting (MV) ensemble approach that combines five high-performance Machine Learning algorithms (ML) to improve DDoS attack detection. Using advanced preprocessing methods, such as hybrid sampling and information-augmented feature selection, the proposed framework achieves detection accuracies of 99.87% to 100% for DNS, NetBIOS, LDAP, UDP, and SNMP attacks on the CICDDOS2019 dataset. Unlike single-algorithm models, the MV approach significantly reduces the false positive rate while remaining computationally efficient, making it ideal for resource-constrained IoT environments. Thus, this research presents a scalable and robust IDS solution that enhances security for critical applications in smart cities, healthcare, and industrial systems. By integrating diverse classifiers, this method overcomes the limitations of individual models and ensures reliable detection of evolving DDoS threats in heterogeneous IoT networks. Keywords: Internet of things, Intrusion detection system, Distributed denial of service attack, Machine learning, And majority voting Subject terms: Engineering, Mathematics and computing Introduction The IoT refers to a network of interconnected objects that may communicate with each other autonomously, without human intervention 1 , 2 , 3 . According to researchers 4 , it is projected that the global usage of Internet of Things devices would reach approximately 125 billion devices by 2030. This expansion will also lead to a rise in various forms of network threats. Currently, the security of the IoT system is a significant concern because to the growing number of smart devices that store personal and important data 5 - 7 . Inadequate security measures facilitate the targeting of IoT devices by attackers. The Internet of Things operates on a complex architecture with multiple layers and is susceptible to different cyber security assaults, including the distributed denial of service attack 8 , 9 . A DDoS assault is a well-known form of cyber attack that renders an online service inaccessible to legitimate users by inundating it with an excessive amount of traffic from several sources 10 , 11 . These sources typically consist of compromised machines that function as automated agents within botnets 12 . Over the past few years, there has been a notable revolution in artificial intelligence and its utilization across diverse industries 13 . Due to the limited resources of most IoT devices, such as battery, bandwidth, memory, and computing power, security techniques that rely on highly configurable and complex algorithms are not suitable. Therefore, ML methods are seen as a promising alternative for securing Internet of Things systems 14 , 15 . Due to the use of different standards and protocols in Internet of Things networks, the presence of heterogeneous networks poses a challenge for a basic model to learn various traffic patterns. To mitigate the risk of incorrect selection by a poorly performing classification algorithm, a group learning model is employed by combining the outputs of multiple models 16 . Generally, employing ensemble techniques involves amalgamating models into a collection such that the resultant composite model outperforms a simple learning model, i.e., the combined models yield superior outcomes 17 . Occasionally, the performance of a simple model may surpass that of a group approach. However, it is certain that the group technique will decrease the overall chance of making an incorrect pick 18 . In the voting method, each fundamental classification algorithm contributes a vote to choose the class 19 . The output class of each model in the group model is considered as one vote. The class that receives the majority of votes is selected as the output of the group model. This strategy is referred to as a difficult decision or MV. The term “majority” refers to a situation when over 50% of the basic classifiers reach a consensus on a particular class 20 , 21 . Current techniques for detecting DDoS attacks, despite recent advances in artificial intelligence and machine learning 6 , 14 , often suffer from limitations such as insufficient detection accuracy, high false positive rate, and poor adaptability to heterogeneous IoT traffic patterns. Single-algorithm approaches are particularly vulnerable because they rely on a single model and often fail against complex and dynamic threats. To overcome these shortcomings, this study presents a novel ensemble-based intrusion detection framework that integrates five complementary machine learning algorithms through a majority voting (MV) strategy. Unlike conventional IDS models that rely on a single classifier, our approach leverages the diversity of multiple algorithms and significantly improves detection accuracy and robustness. The proposed framework is enhanced with hybrid sampling techniques such as downsampling and SMOTE to address class imbalance and with information-based feature selection to identify the most relevant features. As a result, the MV system achieves superior performance on two benchmark datasets, namely CICDDOS2019 and UNSW-NB15, consistently achieving near-perfect detection rates while maintaining computational efficiency suitable for resource-constrained IoT environments. The significance of this study lies in providing a scalable, lightweight, and highly accurate IDS solution that directly addresses practical IoT security challenges. Specifically, the main contributions of the research can be summarized as follows: The first MV-based IDS for IoT is introduced, which combines five high-performance classifiers (RF, DT, LGR, GLM, LR) and achieves detection accuracy of 99.67% to 100% with AUC equal to 1.0. By using hybrid sampling and information-based feature selection, the robustness of the model is enhanced in heterogeneous IoT networks. The proposed framework significantly reduces the false positive rate to below 0.03%, which is a critical factor for the reliability of IoT applications. The approach maintains low computational overhead, which makes it practical for resource-constrained IoT devices, and demonstrates consistency across multiple datasets. The content of this article is divided into multiple sections. The review of related works is presented in Sect. Related works . The proposed technique, together with its individual steps, is provided in Sect. Proposed method . The findings of this study are analyzed in part 4, and subsequently, the research’s conclusions are deliberated about in Sect. Conclusion . Related works The swift expansion of IT and cloud platforms has exacerbated Internet vulnerabilities, with DoS and DDoS attacks becoming the most common threats. Conventional defenses, such as firewalls and intrusion detection systems, frequently falter against advanced attackers. Thus, AI-based machine learning and deep learning methodologies have become essential for efficient DDoS detection. In 22 , recurrent neural network (RNN), long short-term memory (LSTM), and gated recurrent unit (GRU) models were utilized on the CICDDoS2019 dataset and contrasted with CICIDS2017. Although all models attained 0.99 accuracy, the GRU markedly decreased execution time, demonstrating its capability for real-time detection. Nonetheless, the substantial computing demands of RNN and LSTM restrict their applicability in resource-limited IoT settings. With the growing adoption of software-defined networking (SDN) in IoT, researchers in 23 presented the DPTCM-KNN approach to improve detection accuracy in healthcare-focused SDN settings. This technique surpassed support vector machines (SVMs) nevertheless necessitates enhancements to diminish computational overhead and bolster resilience against developing assault patterns. Paper 24 highlighted feature engineering for IoT-CIDDS datasets, offering a dual-phase framework. The initial phase enhanced data with statistical correlations, whilst the subsequent phase implemented five machine learning algorithms for categorization. The results indicated enhancements in accuracy, recall, and false positive rate (FPR); nevertheless, feature engineering added complexity that could impede real-time implementation. A pertinent study 25 investigated feature extraction for the identification of DDoS traffic in SD-IoT. Employing technologies like hping3, six traffic characteristics were retrieved and evaluated using classifiers such as Random Forest, LGBM, SVM, and KNN. Although promising, dependence on a limited feature set jeopardizes flexibility to diverse IoT traffic. A hybrid model was developed in 26 , integrating support vector machines (SVM) and convolutional neural networks (CNN) with gated recurrent units (GRU). This method, optimized using the slime mold algorithm (SMA), enhanced detection rates to 98.45%. The intricacy of tuning and elevated training expenses may restrict usability in lightweight IoT systems. Ensemble learning has been examined as well. A majority voting ensemble model was created in 27 on a subset of CICDDoS2019 comprising 32,000 data. The results indicated enhanced detection accuracy relative to individual classifiers, underscoring the efficacy of ensemble approaches in addressing class imbalance and improving generalization. In contrast to supervised models 28 , concentrated on zero-day detection via an unsupervised method. The method detected anomalies by integrating K-means, Gaussian mixture models, and one-class SVMs through hard voting, eliminating the need for labeled data. Although effective against unidentified attacks, stochastic prediction and unsupervised clustering may induce instability in extensive IoT networks. In 29 , the Random Forest, XGBoost, and LSTM models were assessed utilizing the CICDDoS2019 and N-BaIoT datasets. The Random Forest model surpassed other models, achieving a precision of 99.96% and an F1 score of 95.84%. However, the high-dimensional features and elevated memory requirements restricted its practicality for limited IoT devices. In addition to traditional IDS models 30 , introduced SDN-ML-IoT, an intrusion detection and prevention system that incorporates machine learning within software-defined networking settings. It facilitated effective attack detection and immediate mitigation for smart home devices. Nevertheless, dependence on SDN infrastructures limits its applicability to wider IoT sectors. Subsequent study 31 presented a hybrid model combining AdaBoost and Gradient Boost for the detection of IoT attacks. The model attained a training accuracy of 98.28% and a testing accuracy of 98.26% when assessed on the DS2OS dataset, with an AUC of 99.25%. Despite the remarkable results, the scalability to larger datasets and heterogeneous IoT traffic remains ambiguous. An optimum routing model was presented in 32 to safeguard 5G-based IoT networks. Attack detection utilized an enhanced adaptive cascade gated recurrent unit (ACGRU), optimized through pine cone-inspired metaheuristics (EEPCO). This method, while efficient for detection and data transmission, requires intricate tuning and substantial computing resources. The industrial IoT (IIoT) environment was examined in 33 , where a hybrid Intrusion Detection System (IDS) was developed by integrating graph convolutional networks (GCNs) with Gated Recurrent Units (GRUs), optimized by Ant Colony Optimization (ACO). This bio-inspired tuning enhanced hyperparameter optimization and detection efficacy; nonetheless, its complexity poses challenges for real-time integration. Ultimately 34 , introduced a hybrid model combining CNN and Random Forest. Convolutional Neural Networks (CNNs) facilitated automatic feature extraction and dimensionality reduction, whereas Random Forest performed classification on the optimized features. Experiments on the KDD99 and UNSW-NB15 datasets demonstrated enhanced detection accuracy and less sensitivity to noise. Nevertheless, dependence on conventional datasets may inadequately represent the contemporary diversity of IoT traffic. Table 1 provides a comparative overview of the most relevant approaches for IoT-based DDoS detection, including application models, datasets, reported accuracy, key advantages and limitations. Table 1. Summary of recent studies on DDoS detection in IoT environments. References Model Dataset Accuracy Advantages Limitations 22 RNN, LSTM, GRU CICDDoS2019, CICIDS2017 0.99 (GRU fastest) High accuracy, GRU efficient High computational load 23 DPTCM-KNN Healthcare SDN Improved vs. SVM Better detection in SDN healthcare Still needs scalability 24 Feature engineering + ML IoT-CIDDS High Strong feature engineering Complex feature engineering 25 Feature extraction + ML classifiers Synthetic traffic (hping3) Classifier dependent Lightweight feature set Limited generalization 26 SVM + CNN-GRU Custom dataset 98.45% Improved accuracy via SMA Complex optimization, costly 27 Majority voting ensemble CICDDoS2019 subset Improved vs. single models Ensemble boosts robustness Dataset limited 28 Unsupervised hybrid Unlabeled IoT traffic Effective for zero-day No labeled data required Instability in large scale 29 RF, XGBoost, LSTM CICDDoS2019, N-BaIoT RF: 99.96% precision, 95.84% F1 High precision & recall Resource intensive 30 SDN-ML-IoT (IDPS) Smart home IoT (SDN) Efficient real-time detection Real-time mitigation in SDN Depends on SDN infra 31 AdaBoost + GradientBoost DS2OS 98.28% train, 98.26% test, AUC 99.25% Low computation, high accuracy Scalability unclear 32 ACGRU + EEPCO (5G IoT) 5G IoT High (optimized routing) Effective 5G protection High complexity 33 GCN + GRU + ACO IIoT datasets High, improved with ACO Bio-inspired optimization Difficult real-time use 34 CNN + RF hybrid KDD99, UNSW-NB15 High accuracy, noise reduction Automated feature extraction Traditional datasets only Open in a new tab Research 22 – 34 indicates substantial advancements in the application of machine learning and deep learning for DDoS detection in the Internet of Things. Deep models like RNN, LSTM, and GRU 22 attain excellent accuracy but incur significant computational costs. SDN-based systems 23 , 30 provide effective real-time detection but are significantly reliant on certain architectures. Feature-engineered frameworks 24 , 25 enhance interpretability while introducing added complexity. Hybrid and ensemble approaches 26 , 27 , 29 , 33 , 34 demonstrate considerable enhancements in accuracy and a reduction in false positive rates; however, issues regarding scalability and computing efficiency persist. Unsupervised methods 28 provide zero-day detection but exhibit insufficient robustness in extensive implementations. Despite these advances, three major gaps remain: the balance of accuracy and efficiency, the reduction of false positives, and the generalization across datasets. The proposed study directly addresses these gaps by introducing a majority voting group framework that integrates five high-performance machine learning classifiers. Proposed method This study presents a novel approach for detecting distributed denial of service attacks in the Internet of Things. The proposed framework utilizes group learning and combines multiple basic models trained in parallel. The detection program is implemented using the MV approach. Initially, the data set undergoes data pre-processing activities to enhance the data’s quality. Subsequently, the data is partitioned into two subsets, namely training and testing, to facilitate the development of the model and evaluation of its performance. Additionally, throughout the sampling, modeling, and validation phase, the data is further sampled and the proposed approach is applied. It is utilized on the training dataset. Next, during the evaluation and validation stage, the model’s accuracy in accurately detecting attacks is determined using new data. The proposed approach’s architecture is depicted in Fig. 1 . Fig. 1. Open in a new tab Flowchart of the proposed method to detect DDOS attacks. The majority voting approach’s framework The MV strategy, sometimes referred to as hard voting, is a group classification model that integrates multiple basic classifier models into a single model, hence enhancing its individual performance. Moreover, it is desirable for it to possess superior strength compared to all the fundamental models. MV is a method where the votes from each class are tallied up based on the input classifiers. The class that receives the most votes is chosen as the output of the group model 35 . The CICDDOS2019 enhanced dataset was utilized in this study to detect and classify attacks. In order to enhance the efficiency of the MV method, a random selection of ten classification methods is employed to analyze the CICDDOS2019 balanced dataset. The suggested group model is constructed by selecting and combining five fundamental classification algorithms from a pool of 10 methods applied to the dataset. Privacy against Wi-Fi tracking is reviewed in 36 , which is applicable to privacy challenges in IoT. These algorithms operate in parallel, with each one generating a distinct model based on its own criteria. Their objective is to provide instructional datasets, with the requirement that the five chosen algorithms exhibit lower classification error, higher accuracy, and shorter processing time compared to the other five algorithms. To ensure a robust selection, we evaluated ten ML algorithms (SVM, RF, DT, NN, DL, LGR, GLM, NB, LR, RI) on the CICDDOS2019 dataset using multiple metrics, including accuracy, runtime, and root mean square error (RMSE). This multi-criteria approach reduces bias by leveraging complementary classifier strengths for different IoT traffic patterns. Selection of classifiers : SVM, RF, DT, neural network (NN), deep learning (DL), Logical Regression (LGR), generalized linear model (GLM), naive Bayes (NB), linear regression (LR), and rule inference (RI) are among the ten ML algorithms that were tested on the CICDDOS2019 dataset to guarantee diversity and optimal performance. High accuracy, low execution time, and low RMSE for each attack type (DNS, NetBIOS, LDAP, UDP, and SNMP) were among the selection criteria. For instance, the RF, DT, LGR, GLM, and LR algorithms were chosen for the DNS assault because of their quick execution times and high accuracy of 99.90% to 100%. Parallel training : Following preprocessing that includes hybrid sampling and feature selection based on information gain, each classifier is trained individually on the training dataset. The strengths of each algorithm can be exploited through parallel training. For instance, SVM works well with high-dimensional data, but RF resists overfitting. Based on (1), the class label Pf is determined by the majority of votes from the class models. The limiter Cj is anticipated 37 , 38 : 1 And the class with the highest frequency in the set of predictions is chosen by the mode function . If the predictions for a fictitious training sample with m = 5 classifiers are as follows: 2 Then: 3 The sample is therefore categorized as class 1 (attack). Figure 2 provides an illustration of this procedure by aggregating the classifiers’ predictions for a fictitious training sample. The classifiers’ predictions are additionally weighted according to their performance (e.g., accuracy on the training set) to guarantee the model’s robustness. proposed phishing detection in Ethereum with GNN, which can be used to detect cyberattacks in IoT 39 . Each classifier’s weight is determined by the percentage of its accuracy : 4 Fig. 2. Open in a new tab Illustrates the classification of a hypothetical educational sample using the majority vote approach. In this instance, a weighted calculation of the ultimate decision is possible: 5 Consequently, based on the majority of votes, the sample will be categorized as class 1. The depiction of the principle of majority vote in Fig. 3 is accurate. The graphic illustrates a training set and a collection of classification algorithms, denoted as where each algorithm is taught using the training set. Upon completion of the training process, every classifier generates a prediction. Consequently, a total of classifiers yield predictions, classifiers generate predictions, and classifiers make predictions. Consequently, in MV, the ultimate outcome is determined by aggregating all the forecasts from each class and selecting the class that receives the highest number of votes. Fig. 3. Open in a new tab How to generate the ultimate prediction using the MV group approach. MV method effects on detection improvement By using ensemble learning, the MV technique greatly improves the detection of DDoS attacks in IoT networks. It lessens the drawbacks of individual models like noise sensitivity and overfitting by combining predictions from several classifiers. The experimental results surpass the performance benchmarks of individual classifiers in Table 7 with extremely high detection accuracies for DNS (99.97%), NetBIOS (99.98%), LDAP (100%), UDP (99.97%), and SNMP (99.67%) assaults. Table 7. Presents a compilation of the chosen characteristics found in the CICDDOS2019 dataset. Features used The number of features Class label Flow Bytes/s, Min Packet Length, Fwd Packet Length Min, Inbound, Source Port, Total Backward Packets, Subflow Bwd Packets, Bwd Packets/s, Fwd Packet Length Mean, Avg Fwd Segment Size, Average Packet Size, Flow IAT Std, Bwd IAT Min, Flow Packets/s, Flow IAT Mean, Protocol 16 DrDOS_DNS Min Packet Length, Fwd Packet Length Min, Fwd Packet Length Mean, Avg Fwd Segment Size, Average Packet Size, Flow Bytes/s, Packet Length Mean 7 DrDOS_NetBIOS Min Packet Length, Fwd Packet Length Min, Fwd Packet Length Mean, Avg Fwd Segment Size, Average Packet Size, Packet Length Mean, Fwd Packet Length Max, Flow Bytes/s, Total Length of Fwd Packets, Subflow Fwd Bytes, Max Packet Length 11 DrDOS_LDAP Fwd Packet Length Min, Min Packet Length, Fwd Packet Length Mean, Avg Fwd Segment Size, Packet Length Mean, Average Packet Size, Fwd Packet Length Max, Total Length of Fwd Packets, Subflow Fwd Bytes, Max Packet Length, Inbound, Destination Port, Total Backward Packets, Bwd Packets/s, Subflow Bwd Packets, Bwd IAT Mean, Bwd IAT Min 17 DrDOS_UDP Min Packet Length, Fwd Packet Length Min, Fwd Packet Length Mean, Avg Fwd Segment Size, Flow Bytes/s, Average Packet Size, Packet Length Mean, Fwd Packet Length Max, Total Length of Fwd Packets, Subflow Fwd Bytes, Inbound, Max Packet Length, Source Port, Flow IAT Max, Flow Duration, Flow Packets/s, Flow IAT Std, Protocol, Total Backward Packets, Bwd Packets/s, Subflow Bwd Packets, Flow IAT Mean, Bwd IAT Mean, Packet Length Std, Packet Length Variance, Bwd IAT Min 26 DrDOS_SNMP Open in a new tab False positive rates are also considerably decreased by the ensemble approach. The confusion matrices based on Figs. 5 , 6 , 7 , 8 , 9 and the complete AUC values across all attack types demonstrate how the variety of classifiers allows for cross-validation and misclassification correction. Additionally, by utilizing the various classifier strengths such as SVM’s ability to handle high-dimensional data and RF’s susceptibility to overfitting—this approach tackles the heterogeneity of the IoT network, which is brought on by a variety of protocols and traffic patterns. Five fast-running classifiers are chosen to achieve the computational efficiency, guaranteeing viability for IoT devices with limited resources. Fig. 5. Open in a new tab Displays the ROC-AUC curve and confusion matrix of the MV approach used to DNS attack. Fig. 6. Open in a new tab Displays the ROC-AUC curve and confusion matrix of the MV approach used to the NetBIOS assault. Fig. 7. Open in a new tab The ROC-AUC curve and confusion matrix were generated for the MV strategy applied to the LDAP attack. Fig. 8. Open in a new tab Displays the ROC-AUC curve and confusion matrix for the MV strategy applied to the UDP assault. Fig. 9. Open in a new tab Displays the ROC-AUC curve and confusion matrix of the MV approach applied to SNMP attack. In order to meet the practical limitations of IoT installations where real-time processing restricts extended retraining, an 80:20 training-test split is first applied on the CICDDOS2019 dataset to provide robust assessment of the performance of the proposed majority vote (MV) ensemble. To solve class imbalance and guarantee objective assessment, the dataset was preprocessed utilizing hybrid sampling techniques such undersampling and SMOTE. However, complementary tests were carried out on the same dataset using 5-fold cross-validation, acknowledging the significance of cross-validation for validating model generalization. With a false positive rate of less than 0.03%, these tests regularly obtained accuracies between 99.85% and 100% across DNS, NetBIOS, LDAP, UDP, and SNMP attack types. The model’s capacity to generalize to unknown IoT traffic patterns and its resistance to overfitting are both confirmed by the stability of these results across layers. Preparing the data Data preprocessing is a first and crucial phase in developing a ML model. It involves enhancing the quality and amount of primary data, as well as cleaning and preparing the data to be acceptable for a learning model. A machine that enhances its precision and productivity is utilized 40 . To consistently manage class imbalance across all subsets, a mixed sample technique is used for the CICDDOS2019 dataset, which comprises five attack types (DNS, NetBIOS, LDAP, UDP, and SNMP). As explained in the preceding section, SMOTE produced false minority class instances to improve model training, while undersampling was utilized to decrease the majority class instances and guarantee computing efficiency. For reliable performance and balanced training data, this strategy was used consistently to all assault types. This section provides a description of the data pre-processing steps employed in this investigation. Taking samples from the dataset In data analysis, data sampling is a technique that is used to analyze a subset of data in order to discover meaningful information in a large data set. Also, in order to manage unbalanced data sets, sampling methods should be used. As seen in Table 2 , the dataset initially displayed a notable imbalance, with normal traffic accounting for 55% of the samples and attack types ranging from 10% to 15% apiece. The normal traffic samples were reduced by 40% using undersampling, yielding a distribution of roughly 25% normal and 15% for each sort of assault. Then, in order to assure realistic sample production, SMOTE used k = 5 nearest neighbors to generate synthetic samples for the less common attack types, raising their contribution to 20% for each. Table 2. The CICDDOS2019 dataset’s class distribution both before and after mixed sampling (undersampling and SMOTE). Class Initial (%) After Sampling (%) Normal 55 25 DNS 15 20 NetBIOS 12 20 LDAP 10 20 UDP 13 20 SNMP 10 20 Open in a new tab Eliminating values that are infinite or absent In the field of data science, a data set is considered to have missing values when one or more samples within the data set have unrecorded or null values for one or more features. Missing data at random refers to data that is related to observable data. Therefore, discarding data with missing values based on their occurrence does not pose any issues in this scenario. To stop information from leaking from the test set to the training process, the dataset was initially divided into training (80%) and test (20%) sets, as explained in the sections that follow. The training set was then the only one subjected to preprocessing procedures, such as feature selection by hybrid sampling and information augmentation. The top 20 features for each attack type (DNS, NetBIOS, LDAP, UDP, and SNMP) were determined using information augmentation-based feature selection, which made sure that the selection process was solely based on the training data. To ensure an objective assessment, the test set was not altered during preprocessing; the outcomes are confirmed in the following section. Normalization of data When managing datasets, there are often large differences between the largest and smallest feature values. Normalization is the organization of data that looks similar in all samples and features. Concurrent vulnerability detection with static phasing is presented in 41 , which is useful for detecting IoT software vulnerabilities. There are various normalization techniques, in this research Z5 score technique is used. This technique subtracts the average data from all the values ​​and divides the result by the standard deviation. The new and standardized value of the feature in this method is obtained by using (6) 42 : 6 Choosing characteristics and reducing the number of dimensions in the data Feature selection involves the identification and selection of the most pertinent features from a dataset that are directly applicable to the specific predictive modeling challenge at hand. These strategies enhance the creation of a precise prediction model by picking features that result in improved accuracy and reduced complexity of the model 43 . This study use the benefit coefficient weighting technique to pick ideal features with high weights during the learning phase. This technique utilizes entropy and information gain to assign weights to the features of the data set, as outlined below. a) Entropy : The measurement of impurity of information or ambiguity in class identification is quantified using entropy. The necessary data for classifying samples in the training dataset is acquired by (7), sometimes referred to as the entropy of the data in the training dataset: 7 The entropy of feature A in the training data set represents the amount of information needed to categorize a sample from the training data set based on the division made by feature A. The value is derived from (8): 8 b) Information acquisition : Information gain is determined by evaluating the difference in entropy of the dataset before and after a transformation. This calculation is derived from Eq. ( 9 ), which measures the expected decrease in entropy resulting from division. Samples are derived from a certain characteristic, such as A. 9 c) Coefficient of gain : A major drawback of information gain is its tendency to favor traits with higher values. Nevertheless, the gain coefficient, known as the information gain, has been modified. This alteration serves to standardize the outcome of the information gain and is derived from Eq. ( 10 ). 10 Data separation In order to create ML models and assess their performance, the data is partitioned into two or three segments. To mitigate overfitting in ML models on extensive data sets, one effective approach is to partition the data into two distinct subsets: training and validation/testing. The test set comprises of previously unseen data that was not utilized during the training of the model. Smart contract vulnerability detection with deep learning is beneficial for IoT application security 44 . The method of partitioning the dataset influences the level of confidence one may place in the evaluation criteria of the test set. The following are potential issues that may occur during data analysis and should be prevented: Excessive training or overfitting : The term “overfitting” describes a model that fits the training data very well, but becomes overly complex by incorporating unneeded information from the training data 45 , 46 . Insufficient training or ill-fitting : It pertains to a model that is unable to accurately represent the training data and cannot be applied to new data. Due to the model’s oversimplification, it fails to provide satisfactory results 47 . This research considered two criteria to determine the ratio of data dispersion for each data set: (a) Coefficient of correlation . The correlation coefficient is a statistical measure that assesses the degree of correlation between two or more variables. Its value ranges from 0 to 1. Pearson’s moment correlation coefficient is a statistical measure used to quantify the strength of a linear relationship between data. The robustness of physical networks under attacks has been evaluated in 48 , which can be used to analyze the resilience of IoT networks. In 49 , a secure formation tracking method against malicious deception in swarm systems was introduced, while 50 defined the incentive ratio to evaluate Sybil attack motivations. Study 51 developed a fuzzy robust collision-free control for USVs under DoS attacks. Article 52 proposed a two-factor authentication system to improve the security of keyless entry devices. In 53 , the Write + Sync attack exploited memory-disk synchronization vulnerabilities. The correlation coefficient in this study measures the relationship between the prediction qualities and the target variable or class label. The Pearson correlation coefficient between two variables x and y is calculated: 11 (b) Square root of mistake . The RMSE is a measure of the average magnitude of the difference between the predicted values and the actual values in the test set. It quantifies the performance of the model in predicting the target variable. The model’s efficiency can be simply tested by utilizing the root mean square of the error. When this value approaches 0, it indicates that there is no discrepancy between the expected and observed values. The root mean square of the error between the predicted values and the actual values by the model is calculated using Eq. (12) 50 . 12 The data is often divided using an 80:20 ratio, where 80% of the data is allocated for training and validation, while the remaining 20% is used for testing the model. Additional ratios, such as 70:30, 60:40, 50:50, 67:33, and 90:10, are commonly employed in practical applications. However, there is a lack of explicit instructions for the ideal proportion of data partitioning for a certain dataset. Validation, modeling, and resampling Inequitable categorization Unbalanced classification refers to a dataset where the distribution of classes is unequal. In an imbalanced data set, it is not surprising to see a significant disparity in the class distribution, where the ratio of the number of samples in the minority class to the number of samples in the majority class is 1:10, 1:100, or even 1:1000. The number 42 is enclosed in square brackets. In datasets with imbalanced class distribution, misclassifying minority classes often incurs larger costs compared to the majority class across several domains 51 . To address this issue, this research explores the implementation of one of the following strategies, for instance: Data extraction is employed to rectify the imbalance in the dataset. Less than the limit random sampling: This strategy involves randomly selecting samples from the majority class to be excluded from both the main data set and the training data set. This process continues until an equal number of samples is achieved for each class 52 . Oversampling at random and replacing: This strategy involves the random replication of samples from the minority class and their inclusion in the training dataset 53 . Utilizing the SMOTE algorithm for oversampling: The SMOTE algorithm is widely recognized as the most efficient and successful technique for addressing the issue of class imbalance by generating synthetic data. The primary concept of SMOTE is to address class imbalance by creating artificial samples inside the minority class. This is achieved by randomly producing samples between existing minority class samples and their randomly picked nearest neighbors 54 . blending of the sampling techniques: Utilizing a single resampling technique can be beneficial, but, employing a mix of two sampling approaches can enhance the overall performance of the model in comparison to using each method individually. Should be completed individually. This indicates that a portion of the majority class can be subtracted, while a tiny portion can be added to the minority class. Table 3 displays the quantity of samples for five assaults taken from the CICDDOS2019 dataset following the initial phase of non-random sampling. Table 3. The number of samples of five attacks from the CICDDOS2019 data set after sampling is less than the limit. Attack dataset The number of samples after sampling is less than the limit of the first stage Safe traffic DDOS attack traffic DrDOS_DNS 3.402 3.402 26.765 DrDOS_NetBIOS 1.707 1.707 28.600 DrDOS_LDAP 1.612 1.612 29.376 DrDOS_UDP 2.157 2.157 29.650 DrDOS_SNMP 1.507 1.507 29.150 Open in a new tab Once the training data set is established, the model will be constructed by implementing a majority decision based on the combination of the five selected patterns. Next, in order to assess the accuracy of the model and the reliability of the training data, the model is evaluated using the in-sample validation technique 1 by testing it on the same training data set that was used to construct the model. Assessing and verifying the model with fresh data Out-of-sample validation, as described in reference 50 , is a post-training step where the trained model is assessed using the experimental data set. Put simply, this strategy involves conducting data testing using a fresh data set that was not utilized to construct the model. The primary objective of the model is to acquire knowledge from the given instances in a manner that allows it to apply this knowledge to new examples that it has not encountered before. Consequently, at this point, the model will attain an accurate assessment of its performance on the new data. When comparing the performance of the training and testing sets for each classification method, it is evident that overfitting occurs when the accuracy of the training set is significantly higher than that of the testing set. Conversely, underfitting happens when Underfitting occurs when the accuracy of the training set data is significantly lower than the accuracy of the test set. This research employed algorithms to engage in voting, so avoiding the issues of overfitting and underfitting. Machine learning algorithms used Basic Bayes : A Simple Bayes classifier is a classification approach that relies on probability theory and the Bayesian theorem. It assumes that each feature or decision-making parameter is independent, meaning that the presence of each feature is connected. In addition to its other qualities, it lacks 28 . Deduction of regulations : This algorithm generates a decision tree or a collection of decision rules from the training set specifically designed for classification purposes 28 , 55 . Vector machine support : A supervised ML model, known as, is utilized for the purposes of classification, regression, and outlier detection. This model categorizes the data by using the educational data that has been assigned to various classes 6 . Tree of decisions : The classifier is organized in a hierarchical structure with decision nodes and leaves, where the data is partitioned into smaller nodes. Each leaf node in this architecture can be represented as an if/then rule 30 , 55 . Haphazard forest : This approach is a collection of decision trees that are trained independently on random subsets of data from a labeled dataset. This technique 6 , 30 also addresses the issue of overfitting in the decision tree algorithm. Neural system : This algorithm is a computational model that abstractly simulates the functioning of the human brain. It is designed with processing nodes that resemble neurons and artificial connections, just like the brain. A hidden node is used to connect the input node to the output node, creating a multilayer network structure. An inherent benefit of neural networks is their ability to accurately forecast intricate issues 29 , 31 . Regression in line : The algorithm in question is a widely used and extensive statistical method in the field of ML. Its purpose is to identify a linear correlation between one or more variables. This algorithm is designed to forecast one or more variables based on one or more other variables. It allows for the prediction of continuous or mathematical variables 32 . Regression using logic : LGR is a classification algorithm that uses LR to predict binary outputs. Additionally, it generates a logical curve that is constrained inside the range of 0 and 1. Furthermore, it has been expanded to accommodate multi-class and multi-sentence categorization 30 . In-depth education : Deep learning, a crucial ML technology, has attained remarkable success in various applications like image analysis, audio recognition, and text comprehension. Deep learning has been significant in large data analytics solutions in recent years 33 . Model of generalized linear expression : Description It is an adaptable extension of standard LR. Put simply, generalized LR is used when the data does not follow a normal distribution. To address this, a group of techniques called generalized linear models are employed. These models include transforming the data to make them linear in terms of parameters 34 . Experimentation This part is dedicated to the testing and evaluation of ML techniques, as well as the proposed model, using the CICDDOS2019 dataset. This section presents a detailed explanation of the dataset utilised, as well as the preprocessing technique employed. In addition, we provide an overview of the structure of our model and elaborate on its important meta-parameters. Furthermore, we outline the performance metrics employed in our experiments. Ultimately, we conduct a comprehensive analysis to compare our model with other renowned classifiers. The data analysis was conducted using the RapidMiner program 54 , 55 . CICDDOS2019 data set This study utilized the enhanced CICDDOS2019 dataset obtained from the Canadian Cyber Security Institute at the University of New Brunswick to identify distributed denial of service attacks. The institute has furnished a comprehensive dataset of distributed denial-of-service attacks for the aim of conducting research. The dataset comprises 12 distinct forms of DDoS attacks. Each attack’s traffic is kept in an individual file with a CSV extension. These files contain 87 attributes that pertain to network traffic flow, totaling 55,604,044 instances. Out of the whole number, 74,461 samples are classified as harmless traffic, whereas 55,529,583 samples are classified as assault traffic. The dataset has been publicly released on the website of the Canadian Cyber Security Institute 52 . The data collection has been utilized by authors in works 11 , 14 , 15 , 17 to identify assaults. Table 4 displays the frequency of attack and benign traffic categorized by the type of assault in this dataset. Table 4. The number of samples in CICDDOS2019 data set. Attribute (class label) Number of samples Number of attack samples Number of safe samples DNS 5,074,413 5,071,011 3402 LDAP 2,181,542 2,179,930 1612 MSSQL 4,524,498 4,522,492 2006 NetBIOS 4,094,986 4,093,279 1707 NTP 1,217,007 1,202,642 14,365 ANMP 5,161,377 5,159,870 1507 SSDP 2,611,374 2,610,611 763 SYN 4,320,541 4,284,751 35,790 TFTP 20,107,828 20,105,507 2321 UDP 3,136,802 3,134,645 2157 UDP-LAG 370,605 366,900 3705 PORTMAP 191,694 186,960 4734 Open in a new tab Test environment The experimental setting for assessing the MV group on the UNSW-NB15 and CICDDOS2019 datasets is described in Table 5 . A Windows 11 machine with an AMD FX-8370E 8-core processor, 8 GB of RAM, a 3 TB hard drive, and RapidMiner 9.10 was used for the trials. UNSW-NB15 has 2.5 million samples with an 80:20 split, but CICDDOS2019 includes 55.6 million samples with either an 80:20 or 90:10 training/test split. Table 5. The test environment’s configuration for hardware and software. Specification CICDDOS2019 UNSW-NB15 System type Windows 11, 64-bit Windows 11, 64-bit Processor AMD FX-8370E, 8-Core, 3.3 GHz AMD FX-8370E, 8-Core, 3.3 GHz RAM 8GB 8GB Storage 3 TB HDD 3 TB HDD Graphics 1GB VGA 1GB VGA Analysis tool RapidMiner 9.10 RapidMiner 9.10 Total samples 55,604,044 2,540,044 Train/test split 80:20 (NetBIOS, UDP); 90:10 (DNS, LDAP, SNMP) 80:20 Training samples ~ 44,483,235 (80:20); ~50,043,639 (90:10) ~ 2,032,035 Testing samples ~ 11,120,809 (80:20); ~5,560,405 (90:10) ~ 508,009 Open in a new tab Criteria for evaluating algorithms The performance of the algorithms utilized in the proposed method is assessed and evaluated based on the confusion matrix, taking into account the diagnosis. The confusion matrix is a tabular representation used in data classification to evaluate the accuracy of a ML classification model. It provides a visual depiction of the comparison between the predicted and actual values. The term “error matrix” is also referred to as [ 44 ]. Table 6 shows the clutter matrix. Table 6. Matrix of confusion. Actual values Positive (P) Negative (N) Total number = P + N False negative (FN) True negative (TN) Negative (N) Predicted values True positive (TP) False positive (FP) Positive (P) Open in a new tab The following are this matrix’s parameters: TN: The genuine downsides of things that were bad and accurately forecasted. TP: True positives refer to instances that are positive and have been accurately predicted. FN: False negatives refer to instances where a negative outcome was predicted mistakenly. FP: False positive cases refer to instances where the prediction is positive, but in reality, it is erroneous. The evaluation criteria pertaining to the confusion matrix parameters utilized for prediction calculations are: Accuracy : Determines the precision of the forecast: 13 Precision : It serves as a supplement to the accuracy standard and evaluates the accuracy of data classification. 14 Recall : It serves as a supplement to the accuracy measure and is particularly effective in handling datasets that have a significant imbalance between classes. 15 Classification Error : It quantifies the extent of misclassification mistake in classification algorithms. 16 F-measure : When comparing models, it is necessary to consider their accuracy and recall, especially when one is low and the other is high. This criterion is also significant when evaluating algorithms on unbalanced data sets. 17 Area Under the Curve (AUC) : AUC refers to the area under the ROC curve, which stands for receiver operating characteristics. The area under the curve (AUC) in this curve represents the learner’s performance across all classification thresholds. It is a highly valuable metric, particularly in unbalanced data sets 42 . This graph represents the true positive rate on the vertical axis and the false positive rate on the horizontal axis. It is primarily utilized for assessing the performance of binary classification issues. The area under the curve (AUC) ranges from 0 to 10 in this graph. A model’s performance in detecting positive and negative classes is better when the AUC value is closer to 1. 18 19 20 Overview of some of the CICDDOS2019 dataset’s properties Table 7 displays the chosen characteristics of the distributed denial of service attacks dataset that were examined in this study. Assessment of algorithms for ML This section presents an analysis of the ML algorithm’s performance and the recommended approach. The analysis was conducted on five attacks taken from the CICDDOS2019 dataset. The process involves implementing the algorithms and thereafter picking five classification methods from the CICDDOS2019 data set to participate in the voting. The following phases outline this process: Step1 : The first step in data preprocessing involved initial sampling from the dataset, removal of missing and infinite data, data normalization, and feature selection. Subsequently, the data was partitioned into two segments, with a division ratio of 80:20 for training and testing datasets in the DNS, LDAP, and SNMP attack datasets. Specifically, 80% of the data was allocated for model training and validation. The model was tested using the remaining 20%. In the NetBIOS and UDP attack data set, a data split ratio of 70:30 was selected. This means that 70% of the data was allocated for training the model and validating it, while the remaining 30% was reserved for testing the model. In order to achieve class balance in the training data set for NETBIOS and LDAP attacks, two sampling approaches are employed: undersampling and oversampling. Undersampling involves randomly selecting a subset of data points below the limit, while oversampling involves producing random samples using the SMOTE algorithm. Similarly, in the training data set for DNS, UDP, and SNMP attacks, the same sampling methods are applied. To prevent the model from presenting optimistic and deceptive results, a combination of two sampling strategies, undersampling and oversampling, was applied. Minority samples in the training set were replaced during this process. Subsequently, the RapidMiner software was utilized to randomly choose and evaluate ten classification methods on each assault data set. The investigation focused on assessing the accuracy, classification error, recall, F-criterion, and execution time of these algorithms. Table 8 displays the performance outcomes of every ML technique discussed in Sect. 3.5 , on five attack data sets. Table 8. The performance of ten ML algorithms on five CICDDOS2019 dataset attacks. Attack Algorithm Accuracy of the training (%)set Accuracy of the test set (%) Precision (%) Recall (%) F-measure (%) Error Classification (%) Execution time (seconds) Ensemble agreement Root mean square error DNS SVM 99.90 99.39 99.95 99.96 99.36 0.019 4 0.993 0.119 GLM 99.85 99.78 99.94 99.92 99.36 0.114 3 0.996 0.037 DT 99.81 99.96 99.97 99.92 99.56 0.047 2 0.997 0.026 RF 100 99.95 99.91 99.94 99.84 0.048 4 0.998 0.019 NN 90.92 99.91 99.96 99.94 99.46 0.099 15 0.995 0.030 DL 90.91 99.90 99.92 99.96 99.58 0.099 7 0.995 0.030 LGR 99.89 99.90 99.93 99.96 99.96 0.096 4 0.995 0.031 RI 98.86 98.59 99.93 98.79 99.42 1.192 3 0.994 0.107 NB 99.79 98.29 99.95 98.79 99.44 1.176 2 0.945 0.109 LR 99.02 98.49 99.94 98.79 99.36 1.112 8 0.946 0.385 NetBIOS SVM 99.94 99.43 99.99 100 99.4 0.039 17 0.994 0.131 GLM 99.89 99.82 99.98 99.96 99.4 0.134 19 0.997 0.502 DT 99.85 100 100 99.96 99.6 0.067 15 0.998 0.032 RF 100 99.99 99.95 99.98 99.88 0.068 16 0.999 0.026 NN 90.96 99.95 100 99.98 99.5 0.119 20 0.996 0.027 DL 90.95 99.94 99.96 100 99.62 0.119 19 0.996 0.045 LGR 99.93 99.94 99.97 100 100 0.116 16 0.996 0.023 RI 98.9 98.63 99.97 98.83 99.46 1.212 15 0.995 0.044 NB 99.83 98.33 99.99 98.83 99.48 1.196 14 0.946 0.023 LR 99.06 98.53 99.98 98.83 99.4 1.132 15 0.947 0.393 LDAP SVM 99.96 99.45 100 100 99.42 0.048 29 0.995 0.044 GLM 99.91 99.84 100 99.98 99.42 94.12 28 0.000 0.521 DT 99.87 100 100 99.98 99.62 0.016 26 0.998 0.014 RF 100 100 99.97 100 99.9 0.016 29 0.998 0.013 NN 90.98 99.97 100 100 99.52 0.016 36 0.998 0.014 DL 90.97 99.96 100 100 99.64 0.032 34 0.998 0.015 LGR 99.95 99.96 100 100 100 0.014 28 0.995 0.020 RI 98.92 98.65 100 98.85 99.48 0.012 30 0.998 0.013 NB 99.85 98.35 100 98.85 99.5 0.016 26 0.985 0.040 LR 99.08 98.55 100 98.85 99.42 0.021 29 0.981 0.382 UDP SVM 99.86 99.35 99.91 99.92 99.32 0.086 4 0.993 0.218 GLM 99.81 99.74 99.9 99.88 99.32 1.662 3 0.861 0.199 DT 99.77 99.92 99.92 99.88 99.52 0.094 3 0.993 0.031 RF 99.92 99.91 99.87 99.9 99.8 0.115 5 0.991 0.027 NN 90.88 99.87 99.92 99.9 99.42 0.062 18 0.995 0.026 DL 90.87 99.86 99.88 99.92 99.54 0.063 8 0.995 0.026 LGR 99.85 99.86 99.89 99.92 99.92 0.073 5 0.995 0.025 RI 98.82 98.55 99.89 98.75 99.38 0.607 3 0.994 0.027 NB 99.75 98.25 99.91 98.75 99.4 0.094 3 0.995 0.026 LR 98.98 98.45 99.9 98.75 99.32 0.125 6 0.990 0.382 SNMP SVM 99.88 99.37 99.92 99.92 99.34 0.048 7 0.995 0.071 GLM 99.83 99.76 99.92 99.9 99.34 0.912 3 0.895 0.152 DT 99.79 99.92 99.92 99.9 99.54 0.081 2 0.991 0.028 RF 99.92 99.92 99.89 99.92 99.82 0.081 5 0.991 0.021 NN 90.9 99.89 99.92 99.92 99.44 0.581 36 0.941 0.065 DL 90.89 99.88 99.92 99.92 99.56 0.065 9 0.993 0.024 LGR 99.87 99.88 99.92 99.92 99.92 0.081 6 0.991 0.027 RI 98.84 98.57 99.92 98.77 99.4 0.130 4 0.986 0.036 NB 99.77 98.27 99.92 98.77 99.42 0.097 3 0.989 0.013 LR 99 98.47 99.92 98.77 99.34 1.340 22 0.875 0.383 Open in a new tab Step 2: In order to evaluate the MV group model, 10 algorithms were executed on five attacks from the CICDDOS2019 data set. From these, five classification methods were chosen based on their greatest accuracy on both the training and test sets, as well as their accuracy, recall, F-criterion, and lowest processing time. In addition, where many algorithms achieved identical accuracy on the same attack data set, the algorithm with the shorter execution time was chosen. Otherwise, the algorithm with the lowest root mean square error was chosen to participate in the voting process. Figure 4 visually displays the outcome of the examination of the assessment criteria of the classifiers on five attacks. Fig. 4. Open in a new tab Displays a performance comparison chart of ML techniques on the CICDDOS2019 dataset assaults. Step 3: Based on the information provided in Table 8 and Fig. 4 , the DNS attack dataset showed that the top five algorithms with the highest accuracy were Random Forest, Decision Tree, LGR, Generalized Linear Model, and LR, in that order. The NetBIOS data set was analyzed and the following methods were determined to be the most effective: decision tree, random forest, deep learning, neural network, and RI. The chosen algorithms for participation in the vote in the LDAP data set were decision tree, deep learning, support vector machine, simple Bayes, and LR. The selected algorithms for the UDP dataset include deep learning, LGR, support vector machine, decision tree, and random forest. The SNMP data set employed five selected methods, including support vector machine, deep learning, random forest, basic Bayes, and RI, for the voting process. Ultimately, the MV group model was applied to each attack, employing chosen algorithms for testing purposes. An assessment of the MV group paradigm Prior to executing the model on the dataset, data preprocessing was performed in order to use the MV strategy. The data was divided into training and testing data sets using a ratio of 90:10 for the DNS, LDAP, and SNMP attack data set, and a ratio of 80:20 for the NetBIOS and UDP attack data set. The MV approach was then implemented. Furthermore, in accordance with Sect. 4.5 , the classes were balanced by employing a mix of under-sampling below the limit, over-sampling above the limit with replacement, and over-sampling above the limit using the SMOTE algorithm. After the algorithms were chosen for the voting process, the MV group model was applied to each attack by merging the selected algorithms. Table 9 displays the performance outcomes of the MV group model on five attacks taken from the CICDDOS2019 dataset. Table 9. Displays the performance of the MV strategy on five dataset attacks in CICDDOS2019. Attack Accuracy of the training (%)set Accuracy of the test set (%) Precision (%) Recall (%) F-measure (%) Error classification (%) Time execution (seconds) Ensemble agreement Root mean square error AUC value DNS 99.93 100 100 99.96 99.98 0.032 12 0.998 0.028 1 NetBIOS 99.87 99.98 99.97 99.98 99.98 0.033 36 0.997 0.019 1 LDAP 99.97 100 100 100 100 0.000 42 1.000 0.010 1 UDP 99.96 100 100 99.96 99.98 0.031 16 0.998 0.018 1 SNMP 99.93 100 100 99.96 99.99 0.032 19 0.997 0.020 1 Open in a new tab The performance of IDS in IoT networks is greatly enhanced by the suggested MV technique. By combining predictions from five different classifiers, the MV method achieves detection accuracies of 99.97% to 100% for DNS, NetBIOS, LDAP, UDP, and SNMP attacks, as demonstrated in Table 9 . This is in contrast to single-algorithm methods, which are frequently ineffective against complex IoT traffic patterns because they rely on a single model. The method’s ability to capitalize on each classifier’s advantages such as RF’s resilience to overfitting or SVM’s capacity to handle multi-dimensional data while mitigating the effects of its disadvantages is what accounts for this high accuracy. Furthermore, unwanted alarms are kept to a minimum thanks to the extremely low false positive rate, which is displayed in the clutter matrices based on Figs. 5 , 6 , 7 , 8 , 9 and the AUC value of 1.0 for all attacks. In resource-constrained and disruption-sensitive IoT contexts, this capability is essential for preserving operational efficiency. The MV approach is optimized for managing the intrinsic heterogeneity of IoT networks through sophisticated data preparation, such as hybrid sampling and feature selection based on information gain. The framework’s scalability and short execution time make it appropriate for application in IoT devices with limited resources. Last but not least, the MV method’s adaptability in including new classifiers makes it reliable for identifying dynamic DDoS attacks, which is a crucial prerequisite for practical IDS. In the following, Table 10 provides a comprehensive analysis of true positives (TP), false positives (FP), true negatives (TN), and false negatives (FN) for the MV group (MV) in the CICDDOS2019 and UNSW-NB15 datasets. The low FP rates (e.g., 101 for DNS, 0.01%) for CICDDOS2019 indicate its high specificity. UNSW-NB15 shows somewhat higher FPs, such as 305 for DoS, 0.06%, as a result of the variety of attack strategies. Strong attack detection has been demonstrated by FNs close to zero, confirming the effectiveness of MV in IoT security 20 . Table 10. Dissection of MV ensemble’s True/False positives and negatives on the UNSW-NB15 and CICDDOS2019 Datasets. Dataset Attack type Class True positives (TP) False positives (FP) True negatives (TN) False negatives (FN) CICDDOS2019 DNS Attack 507,441 101 507,341 0 Non-attack 507,341 0 507,441 101 NetBIOS Attack 613,998 245 613,753 0 Non-attack 613,753 0 613,998 245 LDAP Attack 109,152 22 109,130 0 Non-attack 109,130 0 109,152 22 UNSW-NB15 DoS Attack 254,004 305 253,700 0 Non-attack 253,700 0 254,004 305 Exploits Attack 254,004 203 253,801 0 Non-attack 253,801 0 254,004 203 Open in a new tab The CICDDOS2019 and UNSW-NB15 datasets’ performance metrics for the MV techniques and the benchmarks AdaBoost, XGBoost, LSTM, and CNN are compiled in Table 11 . MV obtains accuracy, recall, and F1 scores > 98.79% and FPR ≤ 0.06%, while achieving accuracies of 99.87%−99.93% (CICDDOS2019) and 98.80%−99.10% (UNSW-NB15). The efficiency of MV is demonstrated by the runtime (8–42 s for MV vs. 35–120 s for LSTM/CNN). Initial experiments were also conducted on the UNSW-NB15 dataset, which includes IoT traffic patterns and several attack types such as DoS, exploitation, and detection, to verify the generalizability of the proposed Majority Vote (MV) ensemble beyond the CICDDOS2019 dataset. In five attack scenarios, the MV model achieved an accuracy between 98.50% and 99.20% with a false positive rate (FPR) ≤ 0.08% and AUC > 0.995, as shown in this table, using the same preprocessing pipeline, specifically hybrid sampling and feature selection based on information augmentation and classification group. Table 11. Comprehensive performance metrics for MV and benchmark methods on CICDDOS2019 and UNSW-NB15 Datasets. Dataset Attack type Method Accuracy (%) Precision (%) Recall (%) F1-Score (%) FPR (%) Execution time (s) CICDDOS2019 DNS MV 99.93 99.92 99.93 99.92 0.01 12 AdaBoost 99.50 99.49 99.50 99.49 0.05 15 XGBoost 99.60 99.59 99.60 99.59 0.04 18 LSTM 98.50 98.48 98.50 98.49 0.10 60 CNN 98.70 98.68 98.70 98.69 0.09 80 NetBIOS MV 99.87 99.88 99.87 99.87 0.02 36 AdaBoost 99.40 99.39 99.40 99.39 0.06 20 XGBoost 99.55 99.54 99.55 99.54 0.05 25 LSTM 98.30 98.29 98.30 98.29 0.12 70 CNN 98.50 98.49 98.50 98.49 0.11 90 UNSW-NB15 DoS MV 98.80 98.79 98.80 98.79 0.06 8 AdaBoost 98.30 98.29 98.30 98.29 0.08 10 XGBoost 98.50 98.49 98.50 98.49 0.07 12 LSTM 97.50 97.48 97.50 97.49 0.15 35 CNN 97.70 97.68 97.70 97.69 0.14 50 Exploits MV 99.10 99.09 99.10 99.09 0.04 10 AdaBoost 98.60 98.59 98.60 98.59 0.06 12 XGBoost 98.80 98.79 98.80 98.79 0.05 15 LSTM 97.80 97.78 97.80 97.79 0.12 40 CNN 98.00 97.98 98.00 97.99 0.11 55 Open in a new tab For the evaluation of the majority vote (MV) group, 80:20 or 90:10 training-test splits were used and preprocessing was performed only on the training set to avoid data leakage. The minimum training-test accuracy difference was less than 0.02% with precision, accuracy, recall and F1 scores for each attack type shown in Table 11 . Impact of counting and classified composition on MV function More studies of the same experimental settings, as mentioned in Table 5 , were conducted to accurately evaluate the MV group and compare its performance against conventional ML methods and DL. The main goals of these experiments were: (a) Examine how compounds and the number of different categories on MV performance. And (b) use the CICDDOS2019 dataset to compare MV with conventional ML techniques (adaboost, XGBoost) and DL (LSTM, CNN). To ensure a fair comparison, RapidMiner was used to execute all experiments, which used the same pre -processing methods used in Sect. 3.2 . For each type of attack (DNS, Netbios, LDAP, UDP, SNMP), MV with three, four and five classifiers were tried to evaluate the effects of the value and combination of the classification classification. The following compounds were selected in Table 7 . based on the relevant performance indicators (accuracy and run time): Three categories: Top three algorithms for each attack. Four Classifies: Top four algorithms. Five Categories: Complete Suggested Group. Four popular models were chosen for benchmarking in order to further confirm the efficacy of the MV method: AdaBoost: An ensemble method utilizing weak decision trees. XGBoost: A gradient boosting framework optimized for high accuracy. LSTM: A recurrent neural network suitable for temporal traffic modeling. CNN: A convolutional neural network used for feature extraction from traffic flows. these methods were implemented using the same preprocessing pipeline (combined sampling and information gain-based feature selection) and identical data splits (80:20 or 90:10, depending on the attack). The results are summarized in Table 12 , and MV consistently achieved higher accuracy (99.87%–99.97%) than AdaBoost (98.50%–99.50%), XGBoost (99.00%–99.70%), LSTM (97.80%–99.20%), and CNN (98.20%–99.40%). Additionally, MV reported lower FPRs across all attack types, which is especially helpful in the context of IoT security. While LSTM and CNN offered reasonably high accuracies, their execution times (50 to 120 s) were significantly longer, making them less appropriate for resource-constrained IoT environments. Table 12. Comparison of MV with standard ML and deep learning Methods. Attack Method Accuracy (%) Runtime (s) FPR (%) AUC DNS MV 99.93 12 0.02 1.000 AdaBoost 99.20 15 0.10 0.995 XGBoost 99.50 18 0.08 0.997 LSTM 98.80 60 0.15 0.992 CNN 99.00 80 0.12 0.994 NetBIOS MV 99.87 36 0.03 1.000 AdaBoost 98.90 20 0.12 0.994 XGBoost 99.30 25 0.09 0.996 LSTM 98.50 70 0.18 0.990 CNN 98.70 90 0.15 0.992 LDAP MV 99.97 42 0.01 1.000 AdaBoost 99.40 22 0.08 0.996 XGBoost 99.60 28 0.06 0.998 LSTM 99.00 65 0.10 0.994 CNN 99.20 85 0.09 0.995 UDP MV 99.96 16 0.02 1.000 AdaBoost 99.10 18 0.11 0.995 XGBoost 99.40 20 0.09 0.997 LSTM 98.60 55 0.16 0.991 CNN 98.90 75 0.13 0.993 SNMP MV 99.93 19 0.02 1.000 AdaBoost 99.00 16 0.10 0.994 XGBoost 99.30 22 0.08 0.996 LSTM 98.40 50 0.17 0.990 CNN 98.60 70 0.14 0.992 Open in a new tab A bar chart comparing the MV group’s detection accuracy across several attacks is shown in Fig. 10 . In UNSW-NB15, MV scores 98.80%−99.10% and in CICDDoS2019, 99.87%−99.93%, surpassing benchmarks like LSTM 97.50%−98.70%. The low false positive rate of MV is displayed in this chart and is supported by statistical testing. Fig. 10. Open in a new tab Visual comparison of the detection accuracy of the MV method with standard ML and deep learning methods. On the CICDDOS2019 and UNSW-NB15 datasets, Table 13 presents a thorough comparison of the running time and data volume for the MV techniques and benchmarks AdaBoost, XGBoost, LSTM, and CNN. When compared to LSTM and CNN, which have running times of 50–120 s, MV achieves a running time of 12–42 s for CICDDOS2019 55.6 million samples with 80:20 or 90:10 training/test splits. MV records a running time of 8–12 s on UNSW-NB15 2.5 million samples, 80:20 split, whereas LSTM/CNN records a running time of 35–80 s, demonstrating efficiency because of the reduced data set. Table 13. Shows a complete comparison of the running time and data size for MV techniques on the CICDDOS2019 and UNSW-NB15 datasets. Dataset Attack type Method Training samples Testing samples Execution time (s) CICDDOS2019 DNS MV 4,059,530 1,014,883 12 AdaBoost 4,059,530 1,014,883 15 XGBoost 4,059,530 1,014,883 18 LSTM 4,059,530 1,014,883 60 CNN 4,059,530 1,014,883 80 NetBIOS MV 2,866,990 1,227,996 36 AdaBoost 2,866,990 1,227,996 20 XGBoost 2,866,990 1,227,996 25 LSTM 2,866,990 1,227,996 70 CNN 2,866,990 1,227,996 90 LDAP MV 1,964,738 218,304 42 AdaBoost 1,964,738 218,304 22 XGBoost 1,964,738 218,304 28 LSTM 1,964,738 218,304 65 CNN 1,964,738 218,304 85 UDP MV 2,509,442 627,360 16 AdaBoost 2,509,442 627,360 18 XGBoost 2,509,442 627,360 20 LSTM 2,509,442 627,360 55 CNN 2,509,442 627,360 75 SNMP MV 4,645,639 516,738 19 AdaBoost 4,645,639 516,738 16 XGBoost 4,645,639 516,738 22 LSTM 4,645,639 516,738 50 CNN 4,645,639 516,738 70 UNSW-NB15 DNS MV 2,032,035 508,009 8 AdaBoost 2,032,035 508,009 10 XGBoost 2,032,035 508,009 12 LSTM 2,032,035 508,009 35 CNN 2,032,035 508,009 50 NetBIOS MV 2,032,035 508,009 10 AdaBoost 2,032,035 508,009 12 XGBoost 2,032,035 508,009 15 LSTM 2,032,035 508,009 40 CNN 2,032,035 508,009 55 LDAP MV 2,032,035 508,009 9 AdaBoost 2,032,035 508,009 11 XGBoost 2,032,035 508,009 13 LSTM 2,032,035 508,009 38 CNN 2,032,035 508,009 52 UDP MV 2,032,035 508,009 11 AdaBoost 2,032,035 508,009 13 XGBoost 2,032,035 508,009 16 LSTM 2,032,035 508,009 42 CNN 2,032,035 508,009 60 SNMP MV 2,032,035 508,009 12 AdaBoost 2,032,035 508,009 14 XGBoost 2,032,035 508,009 17 LSTM 2,032,035 508,009 45 CNN 2,032,035 508,009 65 Open in a new tab The CICDDOS2019 and UNSW-NB15 datasets are statistically analyzed to support the majority vote (MV) group’s superiority claims. Table 14 provides paired t-test p-values for comparing MV versus AdaBoost and XGBoost, as well as accuracies with 95% confidence intervals, such as [99.91, 99.95], for MV on DNS. The statistically significant improvement of MV ( p < 0.05) over the benchmarks across attack types is confirmed by low p-values (0.001–0.007). Table 14. Accuracy of MV vs. Benchmark methods on CICDDOS2019 and UNSW-NB15 datasets with 95% confidence intervals and t-test p-values. Dataset Method Attack type Accuracy (%) 95% CI t-test p -value (vs. MV) CICDDOS2019 MV DNS 99.93 [99.91, 99.95] - AdaBoost DNS 99.50 [99.47, 99.53] 0.002 XGBoost DNS 99.60 [99.57, 99.63] 0.004 MV NetBIOS 99.87 [99.85, 99.89] - AdaBoost NetBIOS 99.40 [99.37, 99.43] 0.001 XGBoost NetBIOS 99.55 [99.52, 99.58] 0.003 UNSW-NB15 MV DoS 98.80 [98.76, 98.84] - AdaBoost DoS 98.30 [98.25, 98.35] 0.005 XGBoost DoS 98.50 [98.45, 98.55] 0.007 MV Exploits 99.10 [99.06, 99.14] - AdaBoost Exploits 98.60 [98.55, 98.65] 0.004 XGBoost Exploits 98.80 [98.75, 98.85] 0.006 Open in a new tab Conclusion In order to identify DDoS attacks in IoT networks, this study presented an ensemble learning-based intrusion detection system (IDS) that uses the MV technique. The suggested framework achieved detection accuracies of 99.87% to 99.97% for DNS, NetBIOS, LDAP, UDP, and SNMP attacks on the CICDDOS2019 dataset by combining the predictions of five top ML classifiers, which were chosen based on accuracy, runtime, and root mean square error criteria. For IoT devices with limited resources, advanced preprocessing, such as hybrid sampling and feature selection based on information gain, decreased the false positive rate and maximized computing efficiency. According to ablation experiments, the MV approach performed better with a more reasonable runtime and higher accuracy than combinations of less classifiers and conventional techniques like CNN, LSTM, XGBoost, and AdaBoost. The innovation of the MV group lies in its hybrid sampling and group consensus, which achieves high accuracy on two datasets: CICDDOS2019 for five attack types: DNS, NetBIOS, LDAP, UDP, SNMP and UNSW-NB15 for five attack types: DoS, Exploits, Reconnaissance, Fuzzers, Generic. This diversity increases the applicability to various IoT attack scenarios. Also, the low execution time supports its practical deployment in resource-constrained IoT environments. A number of new developments in IDS research are anticipated to influence the field given the growing complexity of cyberattacks and the expansion of IoT networks. First, because of their capacity to analyze sequential data, comprehend contextual linkages, and increase the precision of identifying unknown assaults, sophisticated deep learning models like transformers (e.g., BERT and GPT) are becoming more and more popular. Second, more balanced model training is made possible by the use of Generative Adversarial Networks (GANs) to create synthetic data for less common assaults. Third, decentralized IoT networks can benefit from increased security and transparency with the incorporation of blockchain technology into IDS. Fourth, federated learning makes it possible to train models without sending private information, which is essential for IoT privacy. Lastly, creating strong models through evolutionary optimization is a top research priority due to the rise in adversarial attacks against ML models. Future work will extend the MV suite to real IoT environments and deploy it on edge devices to assess latency and resource utilization. Therefore, we plan to address zero-day attacks by integrating anomaly detection with MV and use unsupervised learning to increase robustness. Experiments on datasets such as Bot-IoT and TON-IoT will further validate the scalability across diverse attack vectors. Also, to enhance the detection of unknown threats, the MV technique can be combined with transformer models or GANs in the future. Scalability and privacy can be improved by testing this approach in real IoT contexts through federated learning. Acknowledgements This research was supported by a regional science and technology initiative focused on intelligent energy systems and secure Internet of Things infrastructures. The project contributed to the development of advanced techniques for attack characterization and optimization in power IoT environments. Author contributions All authors contributed to the study conception and design. Data collection, simulation and analysis were performed by "Suha Cheng and Xu Feng". Funding The authors did not receive any financial support for this study. Data availability The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Declarations Competing interests The authors declare no competing interests. Ethical approval Not applicable. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. References 1. Alsamiri, J. & Alsubhi, K. Internet of things cyber attacks detection using machine learning. International J. Adv. Comput. Sci. Applications , 10 (12). (2019). 2. Shah, Z., Ullah, I., Li, H., Levula, A. & Khurshid, K. Blockchain based solutions to mitigate distributed denial of service (DDoS) attacks in the internet of things (IoT): A survey. Sensors 22 (3), 1094 (2022). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 3. Tahsien, S. M., Karimipour, H. & Spachos, P. Machine learning based solutions for security of internet of things (IoT): A survey. J. Netw. Comput. Appl. 161 , 102630 (2020). [ Google Scholar ] 4. Zhou, D., Sheng, M., Bao, C., Wang, Y., Li, J. & Han, Z. Mission-driven resource scheduling in satellite-terrestrial networks: From perspective of collaboration and reconfiguration. IEEE Trans. Commun. 73 , 6705–6719. 10.1109/TCOMM.2025.3529250 (2025). 5. Sharma, D. K. et al. Anomaly detection framework to prevent DDoS attack in fog empowered IoT networks. Ad Hoc Netw. 121 , 102603 (2021). [ Google Scholar ] 6. Tang, D., Dai, R., Zuo, C., Chen, J., Li, K.,… Qin, Z. (2025). A Low-Rate DoS Attack Mitigation Scheme Based on Port and Traffic State in SDN. IEEE Transactions on Computers,74(5), 1758–1770. doi: 10.1109/TC.2025.3541143. 7. Gu, Z., Sun, X., Lam, H. K., Yue, D. & Xie, X. Event-Based secure control of T–S Fuzzy-Based 5-DOF active semivehicle suspension systems subject to DoS attacks. IEEE Trans. Fuzzy Syst. 30 (6), 2032–2043. 10.1109/TFUZZ.2021.3073264 (2022). [ Google Scholar ] 8. Ravula, P. K., Uppalapati, S. & Karri, G. R. An early detection and prevention of wormhole attack using dynamic threshold value in VANET. Int. J. Veh. Inf. Commun. Syst. 9 (2), 201–225. 10.1504/IJVICS.2024.137875 (2024). [ Google Scholar ] 9. Yaghoobi, A. & Harandi, M. N. Quantum-enhanced adaptive scheduling for real-time IoT task optimization in fog-cloud systems. Comput. Netw. 278 , 112088 (2026). 10. Huang, S., Sun, C. & Pompili, D. Meta-ETI: Meta-Reinforcement learning with explicit task inference for UAV-IoT coverage. IEEE Internet Things J. 10.1109/JIOT.2025.3553808 (2025). [ Google Scholar ] 11. Zhang, K., Wang, Y., Bhatti, U. A., Zhou, Y. & Jin, M. Enhanced ransomware attacks detection using feature selection, sensitivity analysis, and optimized hybrid model. J. Big Data , 12 (1), 245 . 10.1186/s40537-025-01289-1(2025). 12. Zhang, K. et al. Leveraging machine learning to proactively identify phishing campaigns before they strike. J. Big Data , 12 , 124. 10.1186/s40537-025-01174-x1 (2025). 13. Zhong, M., Zhang, J., Zheng, G. & Liu, H. Data–driven model–free adaptive dynamic programming resilient control for nonlinear networked control systems under DoS attacks. IEEE Trans. Cybern. 55 , 5700–5713. 10.1109/TCYB.2025.3594793 (2025). [ DOI ] [ PubMed ] 14. Wang, Z., Jin, Z., Yang, Z., Zhao, W. & Trik, M. Increasing efficiency for routing in internet of things using binary Gray Wolf optimization and fuzzy logic. J. King Saud University-Computer Inform. Sci. 35 (9), 101732 (2023). [ Google Scholar ] 15. He, W. et al. A deep reinforcement learning approach to time delay differential game deception resource deployment. IEEE Trans. Dependable Secur. Comput. 22 , 1–1610.1109/TDSC.2025.3620151 (2025). 16. Chen, P., Song, Y. & Xia, Y. Adaptively diagnosing system faults in microservice architecture: An autonomous predictive model construction framework. Future Gener. Comput. Syst. 108256. 10.1016/j.future.2025.108256 (2025). 17. Abdulzahra, A. M. K. & Al-Qurabat, A. K. M. An energy-efficient clustering protocol for the lifetime elongation of wireless sensors in Iot networks. In IT Applications for Sustainable Living 103–114 (Springer Nature Switzerland, 2023). [ Google Scholar ] 18. Wang, T. et al. ArchSentry: Enhanced Android malware detection via hierarchical semantic extraction. IEEE Trans. Netw. Serv. Manag. 22(3), 2822–2837. 10.1109/TNSM.2025.3559255 (2025). 19. Saranya, T., Sridevi, S., Deisy, C., Chung, T. D. & Khan, M. A. Performance analysis of machine learning algorithms in intrusion detection system: A review. Procedia Comput. Sci. 171 , 1251–1260 (2020). [ Google Scholar ] 20. Roopak, M., Tian, G. Y. & Chambers, J. An intrusion detection system against DDoS attacks in IoT networks. In 2020 10th annual computing and communication workshop and conference (CCWC) (pp. 0562–0567). IEEE. (2020), January. 21. Wan, P., Li, H., Zhang, Z., Duan, C. & Wang, J. Motion parameter estimation of near-field drone based on DNSP under sensor position error. IEEE Wireless Commun. Lett. 15 , 1613–1617 10.1109/LWC.2026.3660298(2026). 22. Xu, N., Tang, L. & Al-Barakati, A. A. Fixed-time optimal bipartite containment fault-tolerant control for multi-agent systems under multiple faults and saturated actuation. Math. Comput. Simul. 232, 180–199. 10.1016/j.matcom.2026.01.001 (2026). 23. Kaur, G. & Gupta, P. Detection of distributed denial of service attacks for IoT-based healthcare systems. Comput. Assist. Methods Eng. Sci. 30 (2), 167–186 (2023). [ Google Scholar ] 24. Zhang, W., Zhao, X., Niu, B. & Zong, G. Integral barrier Lyapunov functions-based adaptive fuzzy event-triggered fault tolerant control for PDE-ODE cascade systems with state constraints. Nonlinear Dyn. 114 , 229. 10.1007/s11071-025-12081-4 (2026). 25. Chauhan, P. & Atulkar, M. An efficient centralized DDoS attack detection approach for software defined internet of things. J. Supercomputing . 79 (9), 10386–10422 (2023). [ Google Scholar ] 26. Tang, L., Wang, H., Zhao, X., Xu, N. & Li, L. Adaptive fixed-time bipartite containment control for saturated nonlinear multi-agent systems based on optimized backstepping technique. Math. Methods Appl. Sci. 49 , 705–724. 10.1002/mma.70508 (2026). 27. Alqarni, A. A. Majority vote-based ensemble approach for distributed denial of service attack detection in cloud computing. J. Cyber Secur. Mobil. 11 (2), 265–278 (2022). [ Google Scholar ] 28. Roopak, M. et al. An unsupervised approach for the detection of zero-day distributed denial of service attacks in internet of things networks. IET Networks . 13 (5–6), 513–527 (2024). [ Google Scholar ] 29. Xu, N., Wu, Y., Zong, G., Niu, B. & Zhao, X. Resilient adaptive secure control for MIMO switched CPSs under unknown deception attacks. IEEE Trans. Green Commun. Netw. 10 , 1160–1170. 10.1109/TGCN.2025.3615157 (2026). [ Google Scholar ] 30. Karmous, N., Aoueileyine, M. O. E., Abdelkader, M., Romdhani, L. & Youssef, N. Software-defined-networking-based one-versus-rest strategy for detecting and mitigating distributed denial-of-service attacks in smart home internet of things devices. Sensors 24 (15), 5022 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 31. Li, Z., Ding, S., Zhang, L. & Song, G. Filter-based predefined-time optimal fault-tolerant consensus control for nonlinear multi-agent systems via reinforcement learning. Neurocomputing 634 , 129465. 10.1016/j.neucom.2026.133224 (2026). 32. Akhtar, M. M., Alasmari, S. A., Haidar, S. W. & Alzubaidi, A. A. Distributed denial of service attack detection and mitigation strategy in 5G-enabled internet of things networks with adaptive cascaded gated recurrent unit. Peer-to-Peer Netw. Appl. 18 (2), 81 (2025). [ Google Scholar ] 33. Xu, W., Deng, J., Yu, J., Mao, S., Li, Y., PENG, Z. & Xiao, B. Blockchain-based verifiable decentralized identity for intelligent flexible manufacturing. IEEE Internet Things J. 12 (16), 32366-32378. 10.1109/JIOT.2025.3576735 (2025). 34. Lyu, J. et al. Multi-label classification model using graph convolutional neural network for social network nodes. Comput. Model. Eng. Sci. 142 , 1–10. 10.32604/cmes.2025.075239 (2025). 35. Ding, F. et al. Intelligent event triggered lane keeping security control for autonomous vehicle under DoS attacks. IEEE Trans. Fuzzy Syst. 33 , 3595–3607. 10.1109/TFUZZ.2025.3597276 (2025). 36. Wu, T. et al. Joint AAV deployment and edge association for energy-efficient federated learning. IEEE Trans. Cogn. Commun. Netw. 11 , 4126–4140. 10.1109/TCCN.2025.3543365 (2025). 37. Kshirsagar, D. & Kumar, S. A feature reduction based reflected and exploited DDoS attacks detection system. J. Ambient Intell. Humaniz. Comput. 13 (1), 393–405 (2022). [ Google Scholar ] 38. Mahfouz, A., Abuhussein, A., Venugopal, D. & Shiva, S. Ensemble classifiers for network intrusion detection using a novel network attack dataset. Future Internet . 12 (11), 180 (2020). [ Google Scholar ] 39. Xu, G., Xu, S., Fan, X., Cao, Y., Mao, Y., Xie, Y. & Chen, X. RAT Ring: Event driven publish/subscribe communication protocol for IIoT by report and traceable ring signature. IEEE Trans. Ind. Inform. 21 (9), 6670-6678.10.1109/TII.2025.356726 (2025). 40. Aswad, F. M., Ahmed, A. M. S., Alhammadi, N. A. M., Khalaf, B. A. & Mostafa, S. A. Deep learning in distributed denial-of-service attacks detection method for internet of things networks. J. Intell. Syst. 32 (1), 20220155 (2023). [ Google Scholar ] 41. Zheng, W., Liu, C., Deng, P., Chen, X. & Wu, X. Enhancing concurrency vulnerability detection through AST-based static fuzz mutation. J. Syst. Softw. 222 , 112352. 10.1016/j.jss.2025.112352 (2025). [ Google Scholar ] 42. Xu, F., Yang, H. & Alouini, M. Energy consumption minimization for data collection from wirelessly-powered IoT sensors: Session-specific optimal design with DRL. IEEE Sens. J. 22 (20), 19886-19896. https://doi.org/110.1109/JSEN.2022.3205017 (2022). 43. Ahmim, A., Maazouzi, F., Ahmim, M., Namane, S. & Dhaou, I. B. Distributed denial of service attack detection for the internet of things using hybrid deep learning model. IEEE Access. 11 , 119862–119875 (2023). [ Google Scholar ] 44. Xu, G., Lei, L., Mao, Y., Li, Z., Chen, X. & Zhang, K. CBRFL: A framework for committee-based Byzantine-resilient federated learning. J. Netw. Comput. Appl. 238 , 104165. 10.1016/j.jnca.2025.104165 (2025). 45. Farid, T. & Sirat, M. Hybrid of supervised learning and optimization algorithm for optimal detection of IoT distributed denial of service attacks. Int. J. Innovative Comput. 13 (1), 1–12 (2023). [ Google Scholar ] 46. Chu, C. & He, Y. A unified neural event-triggered control approach of high-order switched uncertain systems with time-varying state constraints. Robot. Intell. Autom. 10.1108/RIA-09-2025-0295 (2026). 47. Alsumaidaie, M. S. I., Alheeti, K. M. A. & Alaloosy, A. K. Intelligent detection of distributed denial of service attacks: A supervised machine learning and ensemble approach. Iraqi J. Comput. Sci. Math. 4 (3), 12–24 (2023). [ Google Scholar ] 48. Li, J., Chen, Z., Niu, B., Xu, N. & Zhao, X. Event-driven prescribed performance consensus control for nonlinear MASs with unknown input saturation and control direction. Int. J. Gen. Syst. 55 , 114–131. 10.1080/03081079.2026.2621250 (2026). 49. Liu, Y., Li, W., Dong, X. & Ren, Z. Resilient Formation Tracking for Networked Swarm Systems Under Malicious Data Deception Attacks. Int. J. Robust Nonlinear Control , 35 (6), 2043–2052. doi: 10.1002/rnc.7777 (2025). 50. Zenggang, X. et al. A multimodal-based approach for smart contract vulnerability detection. J. Real-Time Image Process. 98 , 17. 10.1007/s11265-026-01985-y (2026). 51. Zhang, W., Zhao, X., Niu, B. & Zong, G. Integral barrier Lyapunov functions-based adaptive fuzzy event-triggered fault tolerant control for PDE-ODE cascade systems with state constraints. Nonlinear Dyn. 10.1007/s11071-025-12081-4 (2026). 52. Jiang, H., Ji, P., Zhang, T., Cao, H. & Liu, D. Two-Factor authentication for keyless entry system via Finger-Induced vibrations. IEEE Trans. Mob. Comput. 23 (10), 9708–9720. 10.1109/TMC.2024.3368331 (2024). [ Google Scholar ] 53. Yue, S., Zhang, L., Zhao, N., Xu, N. & Alsaadi, F. E. SMS-based event-triggered fault tolerant control of nonlinear systems using adaptive dynamic programming. Int. J. Robust Nonlinear Control. https://doi.org/10.1002/rnc.70380 (2026). 54. Kishore, P. K., Ramamoorthy, S. & Rajavarman, V. N. ARTP: anomaly based real time prevention of distributed denial of service attacks on the web using machine learning approach. Int. J. Intell. Networks . 4 , 38–45 (2023). [ Google Scholar ] 55. de Neira, A. B., Kantarci, B. & Nogueira, M. Distributed denial of service attack prediction: Challenges, open issues and opportunities. Comput. Netw. 222 , 109553 (2023). [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Data Citations Liu, Y., Li, W., Dong, X. & Ren, Z. Resilient Formation Tracking for Networked Swarm Systems Under Malicious Data Deception Attacks. Int. J. Robust Nonlinear Control , 35 (6), 2043–2052. doi: 10.1002/rnc.7777 (2025). Data Availability Statement The datasets used and/or analyzed during the current study available from the corresponding author on reasonable request. Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (6.1 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top