MP-IoT Defender: A Unified Deep Neural Network for Multi-Protocol DDoS Detection in IoT Networks
Year: 2026
Type: article
Abstract: The rapid growth of Internet of Things (IoT) deployments has made them both a prime source and a prime target of Distributed Denial-of-Service (DDoS) attacks. Existing detectors are typically designed for a single protocol, so mixed Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) traffic either requires separate models or leaves gaps in coverage. This paper presents MP-IoTDefender, a unified deep neural network that detects DDoS traffic across TCP, UDP, and ICMP within a single model. Training and evaluation use a custom labelled dataset, captured in an isolated testbed, that covers benign traffic and SYN, UDP, and HTTP-flood attacks; the dataset is publicly available. The framework extracts thirty-four deterministic packet- and flow-level features and passes them to a twelve-layer feed-forward network regularised with dropout and L2 penalties and trained with stratified splitting. On a held-out test set, the unified model reaches 96.60% accuracy, 97.56% precision, 98.94% recall, and 98.25% F1-score after 50 epochs, with recall above 98% in every training configuration and no sign of overfitting in the training and validation curves. Preliminary mixed-protocol runs exceeded 99% accuracy. Compared with recent protocol-specific and hybrid detectors, MP-IoTDefender provides broader protocol coverage within a single model.
Source: Computer and decision making.
Institution: Utkal University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7225463686