Search Results (637)

The use of Artificial Intelligence (AI) and Machine Learning (ML) in cybersecurity, especially for creating Intrusion Detection Systems (IDSs), has become increasingly important. These systems are essential for detecting malicious behaviour, identifying network issues, and stopping cyberattacks in real time. Despite extensive research on various ML and Deep Learning (DL) models for IDS, the current literature remains incomplete. It has many different datasets, methods, and evaluation standards. As cyber threats become more advanced, it is crucial to conduct a thorough analysis of ML techniques for intrusion detection. The goal of this Systematic Literature Review (SLR) is to provide a full picture of the most recent academic articles on ML-based IDS. The study addresses important research questions about the most widely used algorithms, the types of attacks and network environments covered, the methodological problems that remain unsolved, and the new trends that should shape future research. Following the PRISMA framework, we conducted a systematic review of peer-reviewed articles published between January 2022 and May 2025. We searched IEEE Xplore, ACM Digital Library, and SpringerLink, yielding 22,558 initial records. After carefully applying strict inclusion criteria, 125 papers were selected for the final analysis. We created a standardised data extraction form (i.e., using MS Excel) to gather bibliographic details, research emphasis, methodological strategies, datasets, evaluation criteria, and recognised constraints. We employed thematic analysis to develop a clear taxonomy. We identified five main research themes in our analysis: (1) ensemble and hybrid learning pipelines focused on performance optimisation (30 papers), (2) context-specific IDS designs for Internet of Things (IoT), cloud, and Software-Defined Networking (SDN) environments (34 papers), (3) data-centric engineering that deals with class imbalance and feature selection (20 papers), (4) deep neural architectures for representation learning (31 papers), and (5) trustworthiness concerns like adversarial robustness, zero-day detection, and Explainable AI (XAI) (10 papers). Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM), and Random Forests are the most commonly used algorithms, often combined. Nonetheless, significant deficiencies remain: about 2% of papers incorporate XAI, only 4% focus on adversarial robustness, and none validate their models in real-world production settings. Denial-of-Service (DoS) and Distributed DoS (DDoS) attacks are the most common types in the literature, whereas Web attacks, ransomware, and advanced persistent threats remain poorly studied. The number of publications grows at an average of 30.2% annually, but the field still relies on legacy benchmark datasets rather than operational validation. Full article

This paper investigates the distributed fusion estimation problem for multi-sensor cyber-physical systems (CPSs), where the communication channels from local estimators to the fusion center are subject to random packet dropouts. Packet dropouts induced by either network congestion or intermittent denial-of-service (DoS) attacks are modeled as Bernoulli random variables. When a local estimate is lost, a prediction compensation strategy is adopted at the fusion center, where the missing data are replaced by their one-step predictors. By constructing an augmented state consisting of the original state, local prediction errors, and virtual measurements, the multi-sensor system is transformed into a stochastic system with random parameter matrices and one-step autocorrelated noises. Based on the transformed system, a distributed state fusion (DSF) filter is proposed via the innovation analysis method, whose filter gain depends on the successful-reception probabilities. The stability of the proposed DSF filter is analyzed, and a sufficient condition for the existence of a steady-state filter is obtained. The steady-state gain can be pre-computed offline, thereby reducing the online computational burden. Simulation results validate the effectiveness of the proposed algorithm. Full article

The Internet of Things (IoT) continues to expand rapidly, bringing with it a new set of security concerns. Many IoT devices are lightweight and limited in processing power, which makes them vulnerable when used in critical applications. Although there are several datasets available for network-level intrusion detection, very few provide practical guidance on how microcontrollers and physical sensors can be combined to recreate realistic attack scenarios in a way that supports reproducible research. In this work, we present a microcontroller-based testbed that integrates multiple sensors to capture, store, and analyze data under both normal operation and simulated cyberattacks. The testbed connects environmental, motion, and network sensors to model IoT systems that are exposed to common threats including Denial-of-Service (DoS), Distributed DoS (DDoS), and Slowloris attacks. The system enables direct sensor-to-microcontroller connections, real-time logging, and synchronized event monitoring, allowing for detailed analysis of how devices behave under attack. Environmental and physical sensor measurements are included to provide synchronized cyber-physical context and baseline operational information rather than demonstrated direct indicators of the investigated network attacks. Alongside the testbed, we share a dataset containing sensor readings, system metrics, and labeled attack events. This contribution provides a practical resource for researchers and educators interested in IoT security, machine-learning-based intrusion detection, and the development of countermeasures rooted in real-world data. By combining low-level hardware experimentation with higher-level security analysis, this work creates a foundation for advancing experimental approaches to cybersecurity in IoT environments. Full article

The recent trend of Software-Defined Networking (SDN) has posed significant cybersecurity challenges as a result of its centralized control architecture, dynamic traffic behavior, and high programmability. Although these attributes improve network flexibility and management, they also increase vulnerability to Distributed Denial-of-Service (DDoS) attacks that can overwhelm network resources and disrupt services. Traditional signature- and rule-based detection methods may struggle with evolving traffic patterns and generate excessive false alarms. Machine learning offers a more promising solution that can learn the complex traffic patterns and separate malicious traffic from normal traffic. Most machine learning models, however, are black-box models that provide only superficial insight into the model predictions. Explainable Artificial Intelligence (XAI) addresses this limitation by identifying influential traffic features and providing interpretable evidence for detection decisions. This research develops an explainable machine learning-based framework for accurate, transparent, and reliable DDoS attack detection in an SDN environment. Several machine learning models are assessed, and XAI techniques are applied to explain the results of the predictions at global and instance levels. Gradient Boosting, Logistic Regression, AdaBoost, and Gaussian Naive Bayes were evaluated on 104,345 network-flow records using a 70:30 training–testing split. Gradient Boosting achieved the strongest performance, with 99.88% training accuracy, 99.87% testing accuracy, a testing F1-score of 99.84%, and a 0.20% miss rate. SHAP identified the most influential traffic features, while LIME linked individual predictions to feature-specific contributions. The proposed framework therefore combines reliable DDoS detection with transparent, analyst-oriented decision support for SDN security monitoring. Full article

Reliable coordination of unmanned aerial vehicle (UAV) swarms is significantly challenged by random denial-of-service (R-DoS) attacks, which introduce stochastic packet loss, time-varying communication interruptions, and strong concealment. Existing fault-tolerant consensus approaches typically assume known attack information or treat attack detection, topology recovery, and control design as separate processes, resulting in limited resilience under dynamically evolving attack conditions. To address this issue, this paper proposes a detection-guided resilient consensus control framework for UAV swarms under R-DoS attacks. A dual-dimensional statistical detection method is developed by jointly modeling packet reception rate (PRR) and inter-arrival time (IAT), enabling real-time identification of attack-induced anomalies through spatio-temporal feature fusion. Based on the detection results, a distributed topology reconstruction strategy is designed, incorporating redundant node identification and cluster-based dynamic communication reconfiguration. The communication graph is adaptively updated via online adjustment of adjacency and Laplacian matrices, and robustness guarantees for the resulting consensus process are analytically established. Hardware-in-the-loop simulation experiments under both single-leader and multi-leader architectures demonstrate that the proposed method can accurately detect attacked nodes, effectively reconstruct the communication topology, and maintain stable formation coordination under severe R-DoS attacks. The position tracking error is constrained within 0.4 m, validating the effectiveness and robustness of the proposed framework. This study is limited to defensive cyber-resilience in a closed hardware-in-the-loop simulation environment and does not address reconnaissance payloads, weaponization, target selection, or operational attack execution. Unlike methods that assume known attack schedules or treat detection, topology recovery, and control separately, this study focuses on their online coupling under unknown random packet loss; its validation is limited to the stated closed HIL impairment model. Full article

This paper presents an adaptive event-triggered nonsingular fast terminal sliding-mode control (AETSMC) framework for quadrotor unmanned aerial vehicles subject to aerodynamic disturbances, actuator loss of effectiveness (LOE) of up to 60%, and intermittent denial-of-service (DoS) attacks. First, a nonsingular fast terminal sliding-mode (NFTSM) surface is constructed using fractional powers of the tracking error rather than fractional-order derivatives. This design ensures finite-time convergence while avoiding the singularity associated with conventional terminal sliding-mode schemes. Second, a smooth positive-semidefinite barrier function (Smooth-PSBF) is incorporated into the adaptive gain law. The resulting law provides only the compensation required to maintain the prescribed bound, thereby limiting gain overestimation and chattering. Third, a dual-mode event-triggering mechanism combines an exponentially decaying threshold with a zero-order hold. A positive lower bound on the inter-event interval is derived from the closed-loop dynamics, which excludes Zeno behaviour. Simulations under matched conditions show that the proposed method reduces the pitch-channel root-mean-square error by 79.4% and the integral squared error by 95.8% relative to the first reproduced baseline. In a separate 15-s communication experiment sampled at 1 kHz, the controller generated 128 transmissions instead of 15,000 periodic updates, corresponding to a 99.15% reduction. These results indicate that the proposed framework can improve fault-tolerant tracking while reducing communication demand under intermittent DoS attacks. Full article

This study investigates the fixed-time quasi-consensus and quasi-containment control for multi-agent systems (MASs) under non-periodic unknown denial-of-service (DoS) attacks. Most available strategies fail to construct fixed-time observers and feasible corresponding parameter tuning rules to guarantee the precise fixed-time convergence of observer states to the convex hull trajectory spanned with multiple leaders under arbitrary non-periodic DoS interference. Moreover, most existing relevant fixed-time cooperative control methods for MASs commonly impose restrictive assumptions on system input matrices, requiring the matrix to be square and invertible, which severely limits their practical applicability. To overcome these limitations, the observers and corresponding parameter selection conditions are designed in this study, which can ensure that the observer states converge to the target trajectory formed by the leaders within a fixed time under non-periodic unknown DoS attacks. Then, based on the linear transformation of the state space and the theory of sliding mode control, a novel observer-based controller is proposed to solve the fixed-time quasi-consensus and quasi-containment control problems. The proposed approach remains effective even when, under mild conditions, the input matrix is non-square or non-invertible—a challenge that many existing methods cannot address. Finally, numerical simulations demonstrate that the proposed control strategy enables MASs with non-square input matrices suffering from unknown non-periodic DoS attacks to achieve fixed-time quasi-consensus and quasi-containment under mild conditions. Full article

This paper investigates the problem of event-triggered secure regulation for high-order fully actuated (HOFA) systems subject to stochastic denial-of-service (DoS) attacks. Through a suitable state transformation, the original HOFA plant is recast into an error-state representation. A dual-dynamic event-triggered control (DETC) law is devised, which operates solely during DoS sleep intervals. By employing Lyapunov-based arguments, sufficient conditions are derived to ensure the practical stability of the closed-loop system for both attack and sleep phases. Moreover, a strictly positive lower bound on the minimum inter-event interval is established, thereby ruling out Zeno phenomena. Numerical experiments confirm the effectiveness of the proposed approach. Full article

The development of intrusion detection and network security solutions for securing Internet of Things (IoT) networks is constrained by the limited availability of representative network security datasets. Many existing datasets rely on centralised traffic collection and do not capture the non-Independent and Identically Distributed (non-IID) characteristics inherent to edge environments. To address this limitation, this work presents a device-level IoT network dataset generated using the open-source Gotham testbed, a virtualised smart city environment. Network traffic is collected in a distributed manner at the interfaces of 78 heterogeneous IoT devices operating across multiple protocols, including MQTT, CoAP, and RTSP. The dataset comprises over 31.8 million packet-level records, each described by 22 features. It includes both benign traffic and multiple attack classes, namely Network Scanning, Brute Force, Infection, Denial of Service (DoS), and Command and Control (C&C) Communication. Ground-truth labels are assigned using a deterministic process based on orchestration logs. The dataset preserves device-level traffic distributions and captures non-IID characteristics without artificial partitioning. It is publicly available and can be used to support reproducible evaluation of intrusion detection approaches and network analysis tasks in both centralised and distributed learning settings. Full article

In DC microgrid (DC-MG) clusters, distributed generation units rely on electronic communication networks to exchange voltage measurements, current information, and coordination signals for voltage recovery and current sharing. As the degree of system clustering and communication coupling increases, nodal denial-of-service (DoS) attacks may interrupt the information exchange of leaders and followers, resulting in communication topology switching and degraded cooperative control performance. Accordingly, this paper proposes an event-triggered (ET) resilient control scheme with high communication efficiency for networked DC-MG clusters under nodal DoS attacks. First, a distributed secondary control model with a cross-layer communication mechanism is constructed in accordance with the requirements of the system’s overall power distribution, which incorporates the two-layer node architecture of leaders and followers in DC-MG clusters. Second, a statistical multimode nodal DoS attack model is developed to characterize heterogeneous communication interruptions through topology-dependent attack modes and their occurrence probabilities. Finally, an exponential threshold ET mechanism based on bus-voltage recovery errors is designed within the distributed secondary control framework to reduce redundant information transmission while preserving resilience against nodal communication attacks. Simulation results demonstrate that the proposed method can maintain accurate voltage recovery and current sharing in networked DC-MG clusters under large-scale DoS attacks, while improving communication efficiency through ET updates. Full article

In this work, an adaptive fixed-time dynamic triggered control issue for interconnected power systems under Denial-of-Service (DoS) attacks is investigated. Such attacks would impede the transmission of sensor signals in interconnected power systems, precipitating a severely unstable power supply or even paralysis. To effectively confront this challenge, an adaptive switching neural network state observer is designed. The observer can maintain the output of the observation state under both attack conditions and normal conditions, thereby compensating for the adverse effects of DoS attacks on interconnected power systems. Meanwhile, a nonlinear fixed-time filter is constructed, which not only obviates the complexity explosion issue but also enhances the convergence capability of interconnected power systems. Moreover, a dual dynamic parameter threshold Event-Triggered Mechanism (ETM) is developed. Influenced by multiple dynamic parameters, this mechanism achieves a more precise control of triggered conditions, drastically conserving the communication resources of the interconnected power systems and preventing the occurrence of Zeno behavior. Ultimately, the effectiveness of the proposed methods is demonstrated by the simulation results. Full article

Software-defined Networking (SDN) is a promising networking architecture that separates the control and data planes to allow flexible network management. However, the SDN architecture makes networks vulnerable to various security threats, such as Distributed Denial-of-Service (DDoS) attacks. A DDoS attack is one of the most common SDN threats, aiming to exhaust a network’s computational and bandwidth resources. Self-similarity is a statistical property of time series in which data patterns repeat at different time scales. Several studies have shown that network traffic exhibits increased self-similarity during DDoS attacks, making it a promising tool for DDoS detection. Despite the effectiveness of statistical methods for detecting DDoS, some methods, such as self-similarity, are discarded due to their high computational cost, leading to detection delays. This paper proposes a lightweight Rescaled Range ($R/S$)-based scheme for effective real-time DDoS attack detection in SDN. The scheme employs the Welford online algorithm to compute statistical parameters of the $R/S$ scheme. Experimental results demonstrate that the proposed scheme efficiently captures changes in self-similarity and detects TCP/UDP DDoS attacks in real time. Moreover, it achieves high detection performance compared to other $R/S$ methods, with a False Positive Rate (FPR) below 0.5% and an average computation time of 0.047 ms. Full article

This article focuses on the projective synchronization control problem for a class of fractional-order complex-valued neural networks (FOCVNNs) with additive time-varying delays (ATVDs) subject to aperiodic denial-of-service (DoS) attacks. Initially, a switchingdelay FOCVNN model is designed to address the intermittent and unpredictable nature of aperiodic DoS attacks. Secondly, an adaptive event-triggering mechanism (AETM) with a sampled-data-based switching-adjusted threshold parameter is proposed, which can save network bandwidth effectively and strengthen the system’s defense against aperiodic DoS attacks. Third, leveraging event-triggered information, a switching controller for projective synchronization is designed to counteract the effects of DoS attacks and maintain system stability during intermittent data transmission failures. Subsequently, a novel common Lyapunov–Krasovskii function (LKF) is constructed for both the attack and dormant phases of DoS attacks, and by utilizing the fractional-order inequality method, the sufficient conditions for the projective synchronization are presented as linear matrix inequalities (LMIs). Finally, numerical examples confirm the practicality and effectiveness of the theoretical results, and demonstrate its capacity to sustain robust synchronization performance in complex attack scenarios. Full article

The issue of mean-square bounded synchronization for complex networks subject to random disturbances, time-varying delays, and cyber-attacks is investigated in this paper. We employ static and dynamic self-triggered impulsive control strategies, which can predict the next impulsive instant based on the current state of the system. These strategies not only ensure the convergence of the control error but also reduce the number of triggering instants. Denial-of-service (DoS) and deception attacks are jointly modeled using two independent Bernoulli stochastic processes. Meanwhile, sufficient conditions for the mean-square bounded synchronization are established through the Lyapunov functional method. In addition, it is demonstrated that these control strategies rule out Zeno behavior, ensuring the reliable achievement of mean-square bounded synchronization. Finally, the accuracy of the theoretical analysis is illustrated through numerical examples. Compared to static triggering, the dynamic self-triggered impulsive control mechanism demonstrates superior performance in reducing the number of triggers, as shown by experimental results. Full article

Distributed Denial-of-Service (DDoS) attacks are a major security threat to blockchain systems, especially in Internet-of-Things (IoT)-oriented and edge-assisted deployments where mining services, gateway nodes, and communication resources are more vulnerable to disruption. In Proof-of-Work (PoW) blockchain networks, such attacks can degrade mining pool connectivity, reduce effective revenue, and undermine both system security and resilient infrastructure design. Existing studies have mainly focused on DDoS detection or static mining games, while paying limited attention to dynamic strategy evolution and convergence under varying network conditions. To address this problem, this paper proposes a dynamic evolutionary game (DEG)-based revenue model for mining pools under DDoS attacks. Unlike static game methods that only identify equilibrium points, this work analyzes both the convergence dynamics and the sensitivity of equilibrium outcomes to key parameters, including attack scale, penalty, reward, and network quality. The proposed method characterizes the adaptive interaction between honest mining and attack behaviors through replicator dynamics, and analyzes strategy stability and convergence using equilibrium and Lyapunov-based methods. In addition, we investigate how key system parameters, including attack scale, reward, penalty, and network quality, affect the convergence speed of mining pool strategies in different environments. MATLAB results show that the proposed DEG model better captures the dynamic evolution of mining pool behaviors than conventional static-game formulations. The results further indicate that improved network conditions may unintentionally incentivize DDoS attacks, while proper parameter tuning can accelerate convergence toward security-favorable strategies. These findings provide useful insights for secure blockchain design and resilient mining infrastructure in IoT-oriented systems. Full article