{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,20]],"date-time":"2026-10-20T20:07:45Z","timestamp":1792526865469,"version":"4.5.0"},"reference-count":47,"publisher":"Public Library of Science (PLoS)","issue":"10","license":[{"start":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T00:00:00Z","timestamp":1760486400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100005911","name":"Najran University","doi-asserted-by":"publisher","award":["NU\/GP\/SERC\/13\/575"],"award-info":[{"award-number":["NU\/GP\/SERC\/13\/575"]}],"id":[{"id":"10.13039\/501100005911","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007446","name":"King Khalid University","doi-asserted-by":"publisher","award":["RGP.2\/556\/45"],"award-info":[{"award-number":["RGP.2\/556\/45"]}],"id":[{"id":"10.13039\/501100007446","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The increasing volumes and sophistication of cyber threats, particularly Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, pose significant dangers to contemporary network structures, particularly the Internet of Things (IoT) environment. Conventional Intrusion Detection Systems (IDS) are also becoming obsolete because they perform detection in a built-in manner and are unable to capture the time trends of dynamic changes of threats. To eliminate such shortcomings, a new hybrid deep learning architecture named the Neural Turing Machine-Gated Recurrent Unit (NTM-GRU) model is proposed in this paper that incorporates the external memory of NTMs and extra temporal learning power of GRUs. The architecture supports analysis on dual timescales, which in turn captures short- and long-term dependencies, exposing the model to unravel complex, low, slow, and zero-day intrusions with recall. Huge testing on the standard sets (UNSW-NB15 and BoT-IoT) and actual (CICIDS2017 and CSE-CID-IS2018 ) demonstrate the high effectiveness of the usage of the model, reaching an accuracy of 99.98%, F1-scores of up to 96% on unknown threats, and the low false positive rates (less than 0.4%). The proposed framework can be applied in both industrial settings and high-speed network settings, where the real-time inference speed was measured at 2.3 milliseconds. The model also incorporates interpretability aspects, making it suitable for Security Operation Centres (SOCs). This work, through the merger of complex memory neural-network structures with cybersecurity needs and requirements encountered in the world, can be realized as providing a scalable, adaptive, and interpretable intrusion detection module, establishing a new state-of-the-art standard for securing next-generation networks.<\/jats:p>","DOI":"10.1371\/journal.pone.0332752","type":"journal-article","created":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:46:30Z","timestamp":1760550390000},"page":"e0332752","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":9,"title":["Deep memory for deep threats: A novel architecture combining GRUs and deep learning models for IDS"],"prefix":"10.1371","volume":"20","author":[{"given":"Abdulmajeed","family":"Alqhatani","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-5905-1325","authenticated-orcid":true,"given":"Sajid","family":"Mehmood","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rashid","family":"Amin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9471-7720","authenticated-orcid":true,"given":"Mohammed S.","family":"Alshehri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Asma Hassan","family":"Alshehri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fatima","family":"Asiri","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"340","published-online":{"date-parts":[[2025,10,15]]},"reference":[{"key":"pone.0332752.ref001","doi-asserted-by":"crossref","first-page":"104155","DOI":"10.1016\/j.cose.2024.104155","article-title":"HIDIM: A novel framework of network intrusion detection for hierarchical dependency and class imbalance","volume":"148","author":"W Zhou","year":"2025","journal-title":"Comput Security"},{"key":"pone.0332752.ref002","article-title":"GRASS: learning spatial-temporal properties from chainlike cascade data for microscopic diffusion prediction","author":"H Li","year":"2023","journal-title":"IEEE Trans Neural Netw Learn Syst"},{"issue":"7","key":"pone.0332752.ref003","doi-asserted-by":"crossref","first-page":"319","DOI":"10.3390\/systems11070319","article-title":"Exploring the computational effects of advanced deep neural networks on logical and activity learning for enhanced thinking skills","volume":"11","author":"D Li","year":"2023","journal-title":"Systems"},{"key":"pone.0332752.ref004","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TIM.2025.3542871","article-title":"Privacy-preserving NILM: a self-alignment source-aware domain adaptation approach","volume":"74","author":"P Hao","year":"2025","journal-title":"IEEE Trans Instrum Meas"},{"key":"pone.0332752.ref005","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TIM.2025.3570355","article-title":"A generalizable load recognition method in NILM based on transferable random forest","volume":"74","author":"Z Yan","year":"2025","journal-title":"IEEE Trans Instrum Meas"},{"issue":"1","key":"pone.0332752.ref006","doi-asserted-by":"crossref","DOI":"10.1371\/journal.pone.0312425","article-title":"Distributed denial of services (ddos) attack detection in sdn using optimizer-equipped CNN-MLP","volume":"20","author":"S Mehmood","year":"2025","journal-title":"PLoS One"},{"issue":"9","key":"pone.0332752.ref007","doi-asserted-by":"crossref","first-page":"5532","DOI":"10.1109\/TCOMM.2024.3392795","article-title":"Computation and privacy protection for satellite-ground digital twin networks","volume":"72","author":"Y Gong","year":"2024","journal-title":"IEEE Trans Commun"},{"issue":"3","key":"pone.0332752.ref008","first-page":"239","article-title":"Hybrid deep learning-based intrusion detection system for wireless sensor network","volume":"9","author":"V Gowdhaman","year":"2024","journal-title":"Int J Veh Inform Commun Syst"},{"key":"pone.0332752.ref009","doi-asserted-by":"crossref","first-page":"51810","DOI":"10.1109\/ACCESS.2023.3280122","article-title":"Detection of application-layer ddos attacks produced by various freely accessible toolkits using machine learning","volume":"11","author":"D Mohammed Sharif","year":"2023","journal-title":"IEEE Access"},{"issue":"5","key":"pone.0332752.ref010","doi-asserted-by":"crossref","first-page":"70","DOI":"10.23919\/JCC.2023.00.006","article-title":"Fast GNSS acquisition algorithm based on SFFT with high noise immunity","volume":"20","author":"H Zhang","year":"2023","journal-title":"China Commun"},{"issue":"2","key":"pone.0332752.ref011","doi-asserted-by":"crossref","first-page":"1300","DOI":"10.1109\/TIT.2023.3340147","article-title":"Age-dependent differential privacy","volume":"70","author":"M Zhang","year":"2024","journal-title":"IEEE Trans Inform Theory"},{"key":"pone.0332752.ref012","first-page":"1","article-title":"Tradeoff of code estimation error rate and terminal gain in SCER attack","volume":"73","author":"X Li","year":"2024","journal-title":"IEEE Trans Instrum Meas"},{"key":"pone.0332752.ref013","doi-asserted-by":"crossref","unstructured":"Aggarwal C. Advanced topics in deep learning. Neural Networks and Deep Learning. Springer International Publishing. 2023. p. 435\u201385. https:\/\/doi.org\/10.1007\/978-3-031-29642-0_12","DOI":"10.1007\/978-3-031-29642-0_12"},{"key":"pone.0332752.ref014","doi-asserted-by":"crossref","unstructured":"Dey R, Salem FM. Gate-variants of Gated Recurrent Unit (GRU) neural networks. In: 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS), 2017. 1597\u2013600. https:\/\/doi.org\/10.1109\/mwscas.2017.8053243","DOI":"10.1109\/MWSCAS.2017.8053243"},{"key":"pone.0332752.ref015","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: 2015 Military Communications and Information Systems Conference (MilCIS), 2015. 1\u20136. https:\/\/doi.org\/10.1109\/milcis.2015.7348942","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"pone.0332752.ref016","doi-asserted-by":"crossref","unstructured":"Peterson JM, Leevy JL, Khoshgoftaar TM. A review and analysis of the Bot-IoT dataset. In: 2021 IEEE International Conference on Service-Oriented System Engineering (SOSE). IEEE. 2021. 20\u20137.","DOI":"10.1109\/SOSE52839.2021.00007"},{"issue":"1","key":"pone.0332752.ref017","doi-asserted-by":"crossref","DOI":"10.1186\/s40537-020-00320-x","article-title":"A comprehensive survey of anomaly detection techniques for high dimensional big data","volume":"7","author":"S Thudumu","year":"2020","journal-title":"J Big Data"},{"key":"pone.0332752.ref018","first-page":"103736","article-title":"Automatic decision tree-based NIDPS ruleset generation for DoS\/DDoS attacks","volume":"82","author":"A Coscia","year":"2024","journal-title":"J Inform Security Appl"},{"key":"pone.0332752.ref019","unstructured":"Alfatemi A, Rahouti M, Amin R, ALJamal S, Xiong K, Xin Y. Advancing DDoS attack detection: A synergistic approach using deep residual neural networks and synthetic oversampling. arXiv preprint arXiv:2401.03116, 2024."},{"issue":"1","key":"pone.0332752.ref020","article-title":"Predicting DoS and DDoS attacks in network security scenarios using a hybrid deep learning model","volume":"33","author":"AF Al-zubidi","year":"2024","journal-title":"J Intell Syst"},{"key":"pone.0332752.ref021","doi-asserted-by":"crossref","DOI":"10.1016\/j.sciaf.2020.e00497","article-title":"Network intrusion detection system using supervised learning paradigm","volume":"9","author":"JO Mebawondu","year":"2020","journal-title":"Scientific African"},{"key":"pone.0332752.ref022","doi-asserted-by":"crossref","first-page":"2269","DOI":"10.1109\/ACCESS.2021.3137201","article-title":"Protocol-based deep intrusion detection for DoS and DDoS attacks using UNSW-NB15 and Bot-IoT datasets","volume":"10","author":"M Zeeshan","year":"2021","journal-title":"IEEE Access"},{"key":"pone.0332752.ref023","doi-asserted-by":"crossref","first-page":"106432","DOI":"10.1016\/j.engappai.2023.106432","article-title":"Towards a machine learning-based framework for DDOS attack detection in software-defined IoT (SD-IoT) networks","volume":"123","author":"J Bhayo","year":"2023","journal-title":"Eng Appl Artif Intell"},{"key":"pone.0332752.ref024","first-page":"41828","article-title":"Comparison and analysis of DDoS detection techniques using machine learning","volume":"11","author":"A Ali","year":"2023","journal-title":"IEEE Access"},{"issue":"3","key":"pone.0332752.ref025","first-page":"2567","article-title":"Web application DDoS attack detection using ensemble learning","volume":"15","author":"A Mohammed","year":"2024","journal-title":"J Ambient Intell Human Comput"},{"key":"pone.0332752.ref026","first-page":"253","article-title":"Ensembling deep learning models for DDoS attack detection in IoT networks","volume":"155","author":"S Das","year":"2024","journal-title":"Future Generation Comput Syst"},{"key":"pone.0332752.ref027","first-page":"110239","article-title":"Enhancing DDoS attack detection in IoT using hybrid CNN-LSTM models","volume":"242","author":"M Lina","year":"2024","journal-title":"Comput Networks"},{"issue":"6","key":"pone.0332752.ref028","first-page":"3605","article-title":"Efficient detection of DDoS attacks using deep learning models in cloud computing environments","volume":"10","author":"MA Dheyab","year":"2022","journal-title":"IEEE Trans Cloud Comput"},{"key":"pone.0332752.ref029","first-page":"29820","article-title":"A hybrid approach for network intrusion detection using supervised and unsupervised learning techniques","volume":"6","author":"R Amin","year":"2018","journal-title":"IEEE Access"},{"key":"pone.0332752.ref030","first-page":"143694","article-title":"A survey on machine learning techniques for network intrusion detection systems","volume":"9","author":"R Amin","year":"2021","journal-title":"IEEE Access"},{"key":"pone.0332752.ref031","unstructured":"Alfatemi A, Rahouti M, Amin R, A L J amal S, Xiong K, Xin Y. Advancing DDoS attack detection: A synergistic approach using deep residual neural networks and synthetic oversampling. arXiv preprint. 2024. https:\/\/arxiv.org\/abs\/2401.03116"},{"key":"pone.0332752.ref032","doi-asserted-by":"crossref","first-page":"2269","DOI":"10.1109\/ACCESS.2021.3137201","article-title":"Protocol-based deep intrusion detection for DoS and DDoS attacks using UNSW-NB15 and Bot-IoT datasets","volume":"10","author":"M Zeeshan","year":"2021","journal-title":"IEEE Access"},{"issue":"8","key":"pone.0332752.ref033","first-page":"13542","article-title":"Intrusion detection in IoT-based networks using optimized deep learning models","volume":"11","author":"J Mustafa","year":"2024","journal-title":"IEEE Int Things J"},{"key":"pone.0332752.ref034","doi-asserted-by":"crossref","first-page":"106432","DOI":"10.1016\/j.engappai.2023.106432","article-title":"Towards a machine learning-based framework for DDOS attack detection in software-defined IoT (SD-IoT) networks","volume":"123","author":"J Bhayo","year":"2023","journal-title":"Eng Appl Artif Intel"},{"issue":"14","key":"pone.0332752.ref035","first-page":"12543","article-title":"GMLP: gated multi-layer perceptron for intrusion detection in IoT networks","volume":"10","author":"A Berguiga","year":"2023","journal-title":"IEEE Int Things J"},{"issue":"2","key":"pone.0332752.ref036","first-page":"2345","article-title":"HIDS: a hierarchical intrusion detection system based on hybrid deep learning for IoT environments","volume":"12","author":"A Berguiga","year":"2025","journal-title":"IEEE Internet of Things Journal"},{"key":"pone.0332752.ref037","first-page":"103967","article-title":"FlowTransformer: A transformer-based architecture for flow-based network intrusion detection,","author":"M Manocchio","year":"2024","journal-title":"Computers & Security"},{"key":"pone.0332752.ref038","article-title":"Self-supervised representation learning for intrusion detection using transformers","author":"K Koukoulis","year":"2025","journal-title":"IEEE Trans Inform Foren Security"},{"key":"pone.0332752.ref039","first-page":"54738","article-title":"Real-time anomaly detection for network traffic using hierarchical transformers","volume":"11","author":"Y Chen","year":"2023","journal-title":"IEEE Access"},{"key":"pone.0332752.ref040","article-title":"HiViT: Hierarchical vision transformer for robust network intrusion detection","author":"T Zhou","year":"2025","journal-title":"IEEE Trans Netw Service Manage"},{"key":"pone.0332752.ref041","first-page":"8723","article-title":"TNN: Temporal neural network for network intrusion detection in IoT","volume":"10","author":"I Ullah","year":"2023","journal-title":"IEEE Internet of Things J"},{"key":"pone.0332752.ref042","article-title":"FT-Transformer: Feature tokenization transformer for network intrusion detection","author":"Y Dai","year":"2025","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"pone.0332752.ref043","doi-asserted-by":"crossref","unstructured":"Sun Z, Teixeira AMH, Toor S. GNN-IDS: Graph Neural Network based Intrusion Detection System. In: Proceedings of the 19th International Conference on Availability, Reliability and Security, 2024. 1\u201312. https:\/\/doi.org\/10.1145\/3664476.3664515","DOI":"10.1145\/3664476.3664515"},{"issue":"5","key":"pone.0332752.ref044","doi-asserted-by":"crossref","first-page":"6062","DOI":"10.1109\/JIOT.2025.3525494","article-title":"Transformer-Based Intrusion Detection for IoT Networks","volume":"12","author":"UC Akuthota","year":"2025","journal-title":"IEEE Internet Things J"},{"key":"pone.0332752.ref045","doi-asserted-by":"crossref","first-page":"82443","DOI":"10.1109\/ACCESS.2024.3404778","article-title":"Securing the IoT cyber environment: enhancing intrusion anomaly detection with vision transformers","volume":"12","author":"L Sana","year":"2024","journal-title":"IEEE Access"},{"key":"pone.0332752.ref046","doi-asserted-by":"crossref","unstructured":"Liu Q, Zhang H, Zhang Y, Fan L, Jin X. SSA-GAT: Graph-based self-supervised learning for network intrusion detection. In: International Conference on Artificial Neural Networks. Springer. 2024. 476\u201391.","DOI":"10.1007\/978-3-031-72356-8_31"},{"key":"pone.0332752.ref047","doi-asserted-by":"crossref","first-page":"107064","DOI":"10.1016\/j.neunet.2024.107064","article-title":"DDP-DAR: Network intrusion detection based on denoising diffusion probabilistic model and dual-attention residual network","volume":"184","author":"S Cai","year":"2025","journal-title":"Neural Netw"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0332752","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:46:41Z","timestamp":1760550401000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0332752"}},"subtitle":[],"editor":[{"given":"Rashmi","family":"Sahay","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"editor"}]}],"short-title":[],"issued":{"date-parts":[[2025,10,15]]},"references-count":47,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2025,10,15]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0332752","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,15]]}}}