{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T04:06:45Z","timestamp":1771646805124,"version":"3.50.1"},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,9,27]],"date-time":"2025-09-27T00:00:00Z","timestamp":1758931200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,9,27]],"date-time":"2025-09-27T00:00:00Z","timestamp":1758931200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>The Internet of Things enabled Wireless Sensor Networks (IoT-enabled WSNs) are highly susceptible to a wide range of Distributed Denial of Service (DDoS) attacks. While several methods have been developed to identify and mitigate these attacks, creating a unified strategy to counter multi-layer DDoS attacks remains a challenge due to the diverse nature of threats presented at different layers of IoT communication networks. To address this, a new protocol called Multi-Layer DDoS threat Detection and Mitigation (MLDDM) has been proposed. MLDDM's core capability lies in its audit trail analysis of trusted networks. By continuously calculating trust parameters across various IoT layers, the trust-based network tree analysis method evaluates each sensor node within the network. This analysis is then used to detect and prevent DDoS attacks. The MLDDM is a comprehensive approach designed to detect and mitigate DDoS attacks across the application, transport, internet, and edge layers. The proposed multi-layer trust-based network tree method analyzes each node to determine whether it is a potential attacker, identifying DDoS threats and their root causes. Once a DDoS attack is detected, MLDDM disconnects the affected nodes from the IoT-enabled WSNs until the next scheduled check. Simulation results demonstrate that the MLDDM protocol outperforms existing solutions in terms of throughput, Packet Delivery Rate (PDR), energy efficiency, communication latency, and overhead.<\/jats:p>","DOI":"10.1186\/s42400-025-00378-1","type":"journal-article","created":{"date-parts":[[2025,9,27]],"date-time":"2025-09-27T03:02:10Z","timestamp":1758942130000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Multi-layer DDoS attacks detection with mitigation in IoT-enabled sensor network"],"prefix":"10.1186","volume":"8","author":[{"given":"Kavita S.","family":"Kumavat","sequence":"first","affiliation":[]},{"given":"Joanne","family":"Gomes","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,9,27]]},"reference":[{"issue":"2","key":"378_CR1","first-page":"45","volume":"8","author":"AP Abidoye","year":"2028","unstructured":"Abidoye AP, Obagbuwa IC (2028) DDoS attacks in WSNs: detection and countermeasures. IET Wirel Sensor Syst 8(2):45\u201397","journal-title":"IET Wirel Sensor Syst"},{"issue":"3","key":"378_CR2","first-page":"342","volume":"11","author":"AMA Abuagoub","year":"2019","unstructured":"Abuagoub AMA (2019) IoT security evolution: challenges and countermeasures review. IJCNIS 11(3):342\u2013351","journal-title":"IJCNIS"},{"key":"378_CR3","doi-asserted-by":"crossref","unstructured":"Akhtar N et al (2019) Congestion aware and adaptive routing protocols for MANETs: a survey. In: Recent trends and advances in wireless and IoT-enabled networks, vol 1(15). Springer, pp 159\u2013169","DOI":"10.1007\/978-3-319-99966-1_15"},{"issue":"1","key":"378_CR4","doi-asserted-by":"publisher","first-page":"2604","DOI":"10.48084\/etasr.1810","volume":"8","author":"I Alameri","year":"2018","unstructured":"Alameri I et al (2018) MANET network in internet of things system. Eng Technol Appl Sci Res 8(1):2604\u20132608","journal-title":"Eng Technol Appl Sci Res"},{"issue":"1","key":"378_CR5","first-page":"1","volume":"10","author":"Z Alansari","year":"2021","unstructured":"Alansari Z et al (2021) A systematic review of routing attacks detection in wireless sensor networks. PeerJ Comput Sci 10(1):1\u201336","journal-title":"PeerJ Comput Sci"},{"issue":"9","key":"378_CR6","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/s22093367","volume":"22","author":"JG Almaraz-Rivera","year":"2022","unstructured":"Almaraz-Rivera JG et al (2022) Transport and application layer DDoS attacks detection to IoT devices by using machine learning and deep learning models. Sensors (Basel) 22(9):1\u201321","journal-title":"Sensors (Basel)"},{"key":"378_CR7","doi-asserted-by":"publisher","unstructured":"Almon L et al (2017) Lightweight detection of denial-of-service attacks on wireless sensor networks revisited. In: 2017 IEEE 42nd conference on local computer networks (LCN), Singapore. IEEE. https:\/\/doi.org\/10.1109\/LCN.2017.110","DOI":"10.1109\/LCN.2017.110"},{"issue":"16","key":"378_CR8","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/app12168294","volume":"12","author":"MA Alzahrani","year":"2022","unstructured":"Alzahrani MA et al (2022) Detecting DDoS attacks in IoT-based networks using matrix profile. Appl Sci 12(16):1\u201316","journal-title":"Appl Sci"},{"issue":"4","key":"378_CR9","doi-asserted-by":"publisher","first-page":"2911","DOI":"10.1007\/s11277-021-08855-9","volume":"121","author":"C Anand","year":"2021","unstructured":"Anand C, Vasuki N (2021) Trust based DoS attack detection in wireless sensor networks for reliable data transmission. Wirel Pers Commun 121(4):2911\u20132926","journal-title":"Wirel Pers Commun"},{"key":"378_CR10","doi-asserted-by":"crossref","unstructured":"Aziz U et al (2021) A blockchain based secure authentication and routing mechanism for wireless sensor networks sensors. In: International conference on innovative mobile and internet services in ubiquitous computing, vol 279(1). Springer, pp 87\u201395","DOI":"10.1007\/978-3-030-79728-7_10"},{"issue":"2","key":"378_CR11","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1109\/TCOMM.2012.031912.110179","volume":"9","author":"F Bao","year":"2012","unstructured":"Bao F et al (2012) Hierarchical trust management for wireless sensor networks and its applications to trust-based routing and intrusion detection. IEEE Trans Netw Serv Manag 9(2):169\u2013183","journal-title":"IEEE Trans Netw Serv Manag"},{"issue":"6","key":"378_CR12","doi-asserted-by":"publisher","first-page":"4569","DOI":"10.1109\/JIOT.2020.3028652","volume":"8","author":"V Borgiani","year":"2020","unstructured":"Borgiani V, Moratori P, Kazienko JF et al (2020) Towards a distributed approach for detection and mitigation of denial of service attacks within industrial internet of things. IEEE Internet Things J 8(6):4569\u20134578","journal-title":"IEEE Internet Things J"},{"issue":"1","key":"378_CR13","doi-asserted-by":"publisher","first-page":"96","DOI":"10.1016\/j.comcom.2022.10.026","volume":"197","author":"R Chaganti","year":"2023","unstructured":"Chaganti R et al (2023) A survey on Blockchain solutions in DDoS attacks mitigation: techniques, open challenges and future directions. Comput Commun 197(1):96\u2013112","journal-title":"Comput Commun"},{"key":"378_CR14","unstructured":"Chen Y et al (2007) Distributed change-point detection of DDoS attacks: experimental results on DETER testbed. In: DETER community workshop on cyber security experimentation and test (DCWCSET), vol 1(2), pp 1\u20138"},{"key":"378_CR15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13638-019-1618-7","volume":"2020","author":"G Cheng","year":"2020","unstructured":"Cheng G et al (2020) A network-wide view-based detection and mitigation of a sophisticated interest flooding attack. EURASIP J Wirel Commun Network 2020:1\u201318","journal-title":"EURASIP J Wirel Commun Network"},{"issue":"3","key":"378_CR16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/JSEN.2020.2964488","volume":"20","author":"J Galeano-Brajones","year":"2020","unstructured":"Galeano-Brajones J et al (2020) Detection and mitigation of DoS and DDoS attacks in IoT-based stateful SDN: an experimental approach. Sensors (Basels) 20(3):1\u201318","journal-title":"Sensors (Basels)"},{"issue":"5","key":"378_CR17","doi-asserted-by":"publisher","first-page":"74","DOI":"10.14445\/22315381\/IJETT-V70I5P209","volume":"70","author":"Xu Gang","year":"2022","unstructured":"Gang Xu et al (2022) Improvement of wireless sensor networks against service attacks based on machine learning. Int J Eng Trends Technol 70(5):74\u201379","journal-title":"Int J Eng Trends Technol"},{"issue":"16","key":"378_CR18","first-page":"1","volume":"22","author":"A Ghaihab","year":"2022","unstructured":"Ghaihab A et al (2022) Fault tolerance structures in wireless sensor networks (WSNs): survey, classification, and future directions. Sensors (Basel) 22(16):1\u201339","journal-title":"Sensors (Basel)"},{"key":"378_CR19","doi-asserted-by":"publisher","unstructured":"Gupta V et al (2019) DNS amplification based DDoS attacks in SDN environment: detection and mitigation. In: Proc. 2019 IEEE 4th international conference on computer and communication systems (ICCCS), Singapore. IEEE https:\/\/doi.org\/10.1109\/CCOMS.2019.8821716","DOI":"10.1109\/CCOMS.2019.8821716"},{"issue":"2","key":"378_CR20","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/s11277-019-06405-y","volume":"108","author":"Y Harbi","year":"2019","unstructured":"Harbi Y et al (2019) A review of security in internet of things. Wirel Personal Commun 108(2):325\u2013344","journal-title":"Wirel Personal Commun"},{"issue":"10","key":"378_CR21","first-page":"156","volume":"13","author":"V Hema","year":"2022","unstructured":"Hema V (2022) H-Gwmfo: efficient energy aware clustering for WSN using hybrid grey wolf based multi objective forest optimization. J Pharm Negat Results 13(10):156\u2013174","journal-title":"J Pharm Negat Results"},{"issue":"4","key":"378_CR22","first-page":"261","volume":"3","author":"A Hosamsoleman","year":"2013","unstructured":"Hosamsoleman A et al (2013) Detection collision attacks in wireless sensor network usingrule-based packet flow rate. IJERA 3(4):261\u2013268","journal-title":"IJERA"},{"issue":"18","key":"378_CR23","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/s22186806","volume":"22","author":"RF Ibrahim","year":"2022","unstructured":"Ibrahim RF et al (2022) DDoS attack prevention for internet of thing devices using ethereum blockchain technology. Sensors 22(18):1\u201321","journal-title":"Sensors"},{"issue":"1","key":"378_CR24","first-page":"1","volume":"2","author":"P Jayashree","year":"2008","unstructured":"Jayashree P, Easwarakumar KS (2008) An effective defense cum prevention of DDoS attacks in active networks using attribute trees. UCCJ 2(1):1\u201310","journal-title":"UCCJ"},{"issue":"18","key":"378_CR25","first-page":"1","volume":"4","author":"A Khraisat","year":"2021","unstructured":"Khraisat A, Alazab A (2021) A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges. Cybersecurity 4(18):1\u201327","journal-title":"Cybersecurity"},{"key":"378_CR26","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-023-10453-w","author":"K Kumavat","year":"2023","unstructured":"Kumavat K, Gomes J (2023) EIDDM: edge and internet layer distributed dos threats detection and mitigation for internet of things wireless communications. Wirel Personal Commun. https:\/\/doi.org\/10.1007\/s11277-023-10453-w","journal-title":"Wirel Personal Commun"},{"issue":"23","key":"378_CR27","doi-asserted-by":"publisher","first-page":"1","DOI":"10.3390\/app122312407","volume":"12","author":"S-H Lee","year":"2022","unstructured":"Lee S-H et al (2022) Detection and prevention of DDoS attack on IoT. Appl Sci 12(23):1\u201319","journal-title":"Appl Sci"},{"issue":"2","key":"378_CR28","first-page":"37","volume":"2","author":"H Mahajan","year":"2018","unstructured":"Mahajan H, Badarla A (2018) Application of internet of things for smart precision farming: solutions and challenges. Int J Adv Sci Technol 2(2):37\u201345","journal-title":"Int J Adv Sci Technol"},{"issue":"1","key":"378_CR29","first-page":"1","volume":"94","author":"H Mahajan","year":"2022","unstructured":"Mahajan H et al (2022) LCIPA: lightweight clustering protocol for industry 4.0 enabled precision agriculture. Microprocess Microsyst 94(1):1\u201324","journal-title":"Microprocess Microsyst"},{"issue":"8","key":"378_CR30","first-page":"4489","volume":"20","author":"S Maheswari","year":"2022","unstructured":"Maheswari S et al (2022) A novel firefly based nodal gradient artificial neural network to mitigate black hole and gray hole attacks. Neuro Quantol 20(8):4489\u20134500","journal-title":"Neuro Quantol"},{"issue":"1","key":"378_CR31","doi-asserted-by":"publisher","first-page":"26","DOI":"10.1016\/j.compeleceng.2018.09.001","volume":"72","author":"MT Manavi","year":"2018","unstructured":"Manavi MT et al (2018) Defense mechanisms against distributed denial of service attacks: a survey. Comput Electr Eng 72(1):26\u201338","journal-title":"Comput Electr Eng"},{"issue":"15","key":"378_CR32","first-page":"226","volume":"150","author":"S Meenaakshi","year":"2022","unstructured":"Meenaakshi S, Jaikumar K (2022) IoT assisted hierarchical computation strategic making (HCSM) and dynamic stochastic optimization technique (DSOT) for energy optimization in wireless sensor networks for smart city monitoring. Comput Commun 150(15):226\u2013234","journal-title":"Comput Commun"},{"key":"378_CR33","doi-asserted-by":"publisher","unstructured":"Mijanur R, Khatun F (2023) Challenges and prospective of AI and 5G-enabled technologies in emerging applications during the pandemic. In: Industry 4.0\u2014perspectives and applications, vol 8(3). https:\/\/doi.org\/10.5772\/intechopen.109450","DOI":"10.5772\/intechopen.109450"},{"issue":"5","key":"378_CR34","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1177\/1550147720921624","volume":"16","author":"KH Mohammadani","year":"2020","unstructured":"Mohammadani KH et al (2020) Preamble time-division multiple access fixed slot assignment protocol for secure mobile ad hoc networks. Int J Distrib Sens Netw 16(5):1\u201318","journal-title":"Int J Distrib Sens Netw"},{"key":"378_CR35","doi-asserted-by":"publisher","unstructured":"Nanthiya D et al (2022) SVM based DDoS attack detection in Iot using Iot-23 botnet dataset. In: Proc. 2021 innovations in power and advanced computing technologies (i-PACT), Kuala Lumpur, Malaysia. IEEE. https:\/\/doi.org\/10.1109\/i-PACT52855.2021.9696569","DOI":"10.1109\/i-PACT52855.2021.9696569"},{"key":"378_CR36","doi-asserted-by":"crossref","unstructured":"Poongodi M et al (2019) DDoS detection mechanism using trust-based evaluation system in VANET. In: Special section on artificial intelligence (AI)\u2014empowered intelligent, vol 7(1), pp 183532\u2013183544","DOI":"10.1109\/ACCESS.2019.2960367"},{"key":"378_CR37","doi-asserted-by":"publisher","unstructured":"Ramkumar BN, Subbulakshmi T (2021) Tcp Syn flood attack detection and prevention system using adaptive thresholding method. In: ITM web of conferences, ICITSD 2021, vol 37(1). https:\/\/doi.org\/10.1051\/itmconf\/20213701016","DOI":"10.1051\/itmconf\/20213701016"},{"issue":"1","key":"378_CR38","doi-asserted-by":"publisher","first-page":"515","DOI":"10.1016\/j.protcy.2013.12.390","volume":"10","author":"RR Sahoo","year":"2013","unstructured":"Sahoo RR et al (2013) A light weight trust based secure and energy efficient clustering in wireless sensor network: honey bee mating intelligence approach. Procedia Technol 10(1):515\u2013523","journal-title":"Procedia Technol"},{"key":"378_CR39","doi-asserted-by":"publisher","unstructured":"Segura GAN, Skaperas S et al (2020) Denial of service attacks detection in software-defined wireless sensor networks. In: Proc. IEEE international conference on communications workshops (ICC workshops). IEEE, pp 1\u20137. https:\/\/doi.org\/10.1109\/iccworkshops49005","DOI":"10.1109\/iccworkshops49005"},{"issue":"1","key":"378_CR40","first-page":"1","volume":"2022","author":"M Shafiq","year":"2022","unstructured":"Shafiq M et al (2022) The rise of \u201cinternet of things\u201d: review and open research issues related to detection and prevention of IoT-based security attacks. Wirel Commun Mobile Comput 2022(1):1\u201312","journal-title":"Wirel Commun Mobile Comput"},{"issue":"1","key":"378_CR41","first-page":"1","volume":"1","author":"R Sharma","year":"2022","unstructured":"Sharma R, Dinkar SK (2022) Selfish node detection by modularized deep NMF autoencoder based incentivized reputation scheme. Cybern Syst 1(1):1\u201321","journal-title":"Cybern Syst"},{"issue":"5","key":"378_CR42","doi-asserted-by":"publisher","first-page":"3719","DOI":"10.1007\/s40747-021-00498-4","volume":"8","author":"A Singh","year":"2022","unstructured":"Singh A, Chatterjee K, Satapathy SC (2022) An edge-based hybrid intrusion detection framework for mobile edge computing. Complex Intell Syst 8(5):3719\u20133746","journal-title":"Complex Intell Syst"},{"key":"378_CR43","unstructured":"Wang J (2012) Advanced attack tree-based intrusion detection. In: Lough borough University Institutional Repository (LUIR), Leicestershire, UK. IEEE, pp 1\u201311"},{"key":"378_CR44","doi-asserted-by":"publisher","unstructured":"Wang J, Phan RC-W, Whitley JN, Parish DJ (2010) Augmented attack tree modeling of distributed denial of services and tree-based attack detection method. In: Proc. 10th IEEE international conference on computer and information technology. IEEE. https:\/\/doi.org\/10.1109\/CIT.2010.185","DOI":"10.1109\/CIT.2010.185"},{"issue":"1","key":"378_CR45","first-page":"1","volume":"19","author":"P Williams","year":"2022","unstructured":"Williams P et al (2022) A survey on security in internet of things with a focus on the impact of emerging technologies. Internet Things 19(1):1\u201324","journal-title":"Internet Things"},{"key":"378_CR46","doi-asserted-by":"publisher","unstructured":"Wu Y-C et al (2009) DDoS detection and traceback with decision tree and grey relational analysis. In: Proc. 2009 3rd international conference on multimedia and ubiquitous engineering. IEEE. https:\/\/doi.org\/10.1109\/mue.2009.60","DOI":"10.1109\/mue.2009.60"},{"issue":"C","key":"378_CR47","first-page":"1544","volume":"101","author":"O Yousuf","year":"2022","unstructured":"Yousuf O, Mir R (2022) DDoS attack detection in Internet of Things using recurrent neural network. Comput Electr Eng 101(C):1544\u20131564","journal-title":"Comput Electr Eng"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00378-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00378-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00378-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,27]],"date-time":"2025-09-27T03:02:40Z","timestamp":1758942160000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-025-00378-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,27]]},"references-count":47,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["378"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00378-1","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9,27]]},"assertion":[{"value":"28 March 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 February 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"27 September 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The competing interest of this research is designing a single protocol that can handle multiple DDoS attacks from all layers of IoT-enabled WSNs.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"72"}}