{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T06:56:22Z","timestamp":1790751382470,"version":"4.1.0"},"reference-count":48,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T00:00:00Z","timestamp":1790726400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Artif. Intell."],"abstract":"<jats:p>Distributed Denial of Service (DDoS) attacks have become a serious threat in modern computer networks, which can commonly be integrated with other types of attacks to evade detection by conventional devices. Existing deep learning-based intrusion detection methods have high identification capability. However, they are also highly susceptible to adversarial attacks, in which even slight perturbations to features can fool the model into misclassification. To address these issues, this study introduced a hybrid deep learning framework. It integrates Convolutional Neural Networks (CNN) and Bidirectional Gated Recurrent Units (BiGRU) to detect diverse types of attacks in real time. CNN extracts spatial interactions to model traffic characteristics, while BiGRU, a recurrent neural network, models temporal dependencies in data flows. This combination enables the model to capture complex spatiotemporal behavioral patterns in network traffic. To address class imbalance, we propose a new Neuro-Evolutionary Resampling Algorithm (NERA). This method uses neural density estimation and evolutionary optimization to generate balanced, noise-filtered training samples. Additionally, a Context-Adaptive Deep Evolutionary Game Framework (CADEGF) is designed to improve resistance to attacks. It does this by simulating interactions between attackers and defenders. It also adjusts detection thresholds using game-theoretic ideas. Experimental results show that this approach achieves high classification accuracy, effectively detects minority classes, and highlights trade-offs between minority-class detection and adversarial robustness, indicating contexts where NERA benefits or harms resilience. The integrated synergy of NERA, CNN-BiGRU, and CADEGF establishes a context-aware, adaptive defense model that advances intelligent intrusion detection with balanced performance and adversarial robustness.<\/jats:p>","DOI":"10.3389\/frai.2026.1928178","type":"journal-article","created":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T06:06:32Z","timestamp":1790748392000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Robust multi-class DDoS and fraud detection using a Context-Adaptive Deep Evolutionary Game Framework with CNN\u2013BiGRU"],"prefix":"10.3389","volume":"9","author":[{"given":"Ashwini","family":"V.","sequence":"first","affiliation":[{"name":"School of Computer Science Engineering and Information Systems (SCORE), Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Priya","family":"V.","sequence":"additional","affiliation":[{"name":"School of Computer Science Engineering and Information Systems (SCORE), Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,9,30]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"1585","DOI":"10.1109\/TCNS.2020.2988007","article-title":"Behavioral and game-theoretic security investments in interdependent systems modeled by attack graphs","volume":"7","author":"Abdallah","year":"2020","journal-title":"IEEE Trans. Control Netw. Syst"},{"key":"B2","doi-asserted-by":"publisher","first-page":"3","DOI":"10.22667\/JOWUA.2020.06.30.003","article-title":"Why would we get attacked? An analysis of attacker's aims behind ddos attacks","volume":"11","author":"Abhishta","year":"2020","journal-title":"J. Wirel. Mobile Netw. Ubiquitous Comput. Dependable Appl"},{"key":"B3","doi-asserted-by":"publisher","first-page":"5845","DOI":"10.3390\/s20205845","article-title":"Error-robust distributed denial of service attack detection based on an average common feature extraction technique","volume":"20","author":"Abreu Maranh\u00e3o","year":"2020","journal-title":"Sensors"},{"key":"B4","doi-asserted-by":"publisher","first-page":"9827","DOI":"10.1007\/s00521-019-04557-3","article-title":"Review of intrusion detection systems based on deep learning techniques: coherent taxonomy, challenges, motivations, recommendations, substantial analysis and future directions","volume":"32","author":"Aleesa","year":"2020","journal-title":"Neural Comput. Appl"},{"key":"B5","doi-asserted-by":"publisher","first-page":"7427","DOI":"10.1007\/s12652-022-04449-w","article-title":"A practical intrusion detection system based on denoising autoencoder and lightgbm classifier with improved detection performance","volume":"14","author":"Ayubkhan","year":"2023","journal-title":"J. Ambient Intell. Humaniz. Comput"},{"key":"B6","doi-asserted-by":"publisher","first-page":"2371","DOI":"10.1007\/s13369-019-03970-z","article-title":"Analysis of support vector machine-based intrusion detection techniques","volume":"45","author":"Bhati","year":"2020","journal-title":"Arab. J. Sci. Eng"},{"key":"B7","doi-asserted-by":"publisher","DOI":"10.21428\/e90189c8.eb32676c","article-title":"Attention-based deep learning frameworks for network intrusion detection: an empirical study","author":"Bhattacharya","year":"2024","journal-title":"Int. J. Glob. Innov. Solut"},{"key":"B8","doi-asserted-by":"publisher","first-page":"404","DOI":"10.3390\/a18070404","article-title":"Unveiling the shadows\u2014a framework for APT's defense AI and game theory strategy","volume":"18","author":"Brand\u00e3o","year":"2025","journal-title":"Algorithms"},{"key":"B9","doi-asserted-by":"publisher","first-page":"731","DOI":"10.1038\/s42256-020-00266-y","article-title":"Understanding adversarial examples requires a theory of artefacts for deep learning","volume":"2","author":"Buckner","year":"2020","journal-title":"Nat. Mach. Intell"},{"key":"B10","doi-asserted-by":"publisher","first-page":"4184","DOI":"10.3390\/app12094184","article-title":"Network intrusion detection model based on CNN and GRU","volume":"12","author":"Cao","year":"2022","journal-title":"Appl. Sci"},{"key":"B11","doi-asserted-by":"publisher","first-page":"1561","DOI":"10.1016\/j.procs.2020.03.367","article-title":"Analysis of KDD-Cup'99, NSL-KDD and UNSW-NB15 datasets using deep learning in iot","volume":"167","author":"Choudhary","year":"2020","journal-title":"Proc. Comput. Sci"},{"key":"B12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3585385","article-title":"Wild patterns reloaded: a survey of machine learning security against training data poisoning","volume":"55","author":"Cin\u00e0","year":"2023","journal-title":"ACM Comput. Surv"},{"key":"B13","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3424155","article-title":"On generating network traffic datasets with synthetic attacks for intrusion detection","volume":"24","author":"Cordero","year":"2021","journal-title":"ACM Trans. Priv. Secur"},{"key":"B14","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN48605.2020.9207637","article-title":"\u201cWhen explainability meets adversarial learning: detecting adversarial examples using SHAP signatures,\u201d","author":"Fidel","year":"2020","journal-title":"2020 international joint conference on neural networks IJCNN 2020 - Proceedings., Institute of Electrical and Electronics Engineers, Virtual, Glasgow, United Kingdom, July 19, 2020, 9207637"},{"key":"B15","doi-asserted-by":"publisher","first-page":"362","DOI":"10.3390\/fi14120362","article-title":"A game-theoretic approach for network security using honeypots","volume":"14","author":"Florea","year":"2022","journal-title":"Future Internet"},{"key":"B16","doi-asserted-by":"publisher","first-page":"142206","DOI":"10.1109\/ACCESS.2021.3120626","article-title":"Intrusion detection system using machine learning for vehicular ad hoc networks based on ton-IoT dataset","volume":"9","author":"Gad","year":"2021","journal-title":"IEEE Access"},{"key":"B17","doi-asserted-by":"publisher","first-page":"149","DOI":"10.1049\/cit2.12171","article-title":"Abusive adversarial agents and attack strategies in cyber-physical systems","volume":"8","author":"Gaur","year":"2023","journal-title":"CAAI Trans. Intell. Technol"},{"key":"B18","unstructured":"A review internet of things (IoT) security challenges\n          \n          1\n          20\n          \n            \n              Ghali\n              A. A.\n            \n            \n              Abdullah\n              M. H. A.\n            \n            \n              Jaafar\n              A. G.\n            \n            \n              Talpur\n              N.\n            \n          \n          Open Int. J. Inform\n          14\n          2026"},{"key":"B19","doi-asserted-by":"publisher","first-page":"182","DOI":"10.1016\/j.ins.2019.05.084","article-title":"Detecting adversarial examples via prediction difference for deep neural networks","volume":"501","author":"Guo","year":"2019","journal-title":"Inform. Sci"},{"key":"B20","doi-asserted-by":"publisher","first-page":"8","DOI":"10.5815\/ijcnis.2019.03.02","article-title":"Deep learning approach on network intrusion detection system using NSL-KDD dataset","volume":"11","author":"Gurung","year":"2019","journal-title":"Int. J. Comput. Netw. Inform. Secur"},{"key":"B21","doi-asserted-by":"publisher","first-page":"124","DOI":"10.1016\/j.procs.2025.07.164","article-title":"Efficient ddos detection with minimal features: high accuracy using CIC-DDoS2019","volume":"265","author":"Hasan","year":"2025","journal-title":"Proc. Comput. Sci"},{"key":"B22","doi-asserted-by":"publisher","first-page":"3820","DOI":"10.3390\/s20143820","article-title":"Recent analysis of forged request headers constituted by http ddos","volume":"20","author":"Jaafar","year":"2020","journal-title":"Sensors"},{"key":"B23","doi-asserted-by":"publisher","first-page":"676","DOI":"10.14569\/IJACSA.2024.0150568","article-title":"A raise of security concern in IoT devices: measuring IoT security through penetration testing framework","volume":"15","author":"Jaafar","year":"2024","journal-title":"Int. J. Adv. Comput. Sci. Appl"},{"key":"B24","doi-asserted-by":"publisher","first-page":"26547","DOI":"10.1038\/s41598-026-56617-z","article-title":"Detecting application layer DDos attack using an advanced signature detection algorithm","volume":"16","author":"Jaafar","year":"2026","journal-title":"Sci. Rep"},{"key":"B25","doi-asserted-by":"publisher","first-page":"1","DOI":"10.11113\/oiji2025.13n2.345","article-title":"A review of detection challenge for signature and anomaly-based detection in detecting http DDoS attacks","volume":"13","author":"Jaafar","year":"2025","journal-title":"Open Int. J. Inform"},{"key":"B26","doi-asserted-by":"publisher","first-page":"1283472","DOI":"10.1155\/2019\/1283472","article-title":"Review of recent detection methods for http ddos attack","volume":"2019","author":"Jaafar","year":"2019","journal-title":"J. Comput. Netw. Commun"},{"key":"B27","doi-asserted-by":"publisher","first-page":"2694","DOI":"10.3390\/app12052694","article-title":"Deep sentiment analysis using CNN-LSTM architecture of english and roman urdu text shared in social media","volume":"12","author":"Khan","year":"2022","journal-title":"Appl. Sci"},{"key":"B28","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1109\/CCC.2019.000-6","article-title":"\u201cAn improved convolutional neural network model for intrusion detection in networks,\u201d","volume-title":"2019 cybersecurity and cyberforensics conference (CCC)","author":"Khan","year":"2019"},{"key":"B29","doi-asserted-by":"publisher","first-page":"59289","DOI":"10.1109\/ACCESS.2024.3392338","article-title":"From bytes to insights: a systematic literature review on unraveling IDs datasets for enhanced cybersecurity understanding","volume":"12","author":"Khanan","year":"2024","journal-title":"IEEE Access"},{"key":"B30","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1109\/SPW50608.2020.00028","article-title":"\u201cAdversarial machine learning-industry perspectives,\u201d","volume-title":"2020 IEEE security and privacy workshops (SPW)","author":"Kumar","year":"2020"},{"key":"B31","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1186\/s40537-020-00382-x","article-title":"A survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 big data","volume":"7","author":"Leevy","year":"2020","journal-title":"J. Big Data"},{"key":"B32","doi-asserted-by":"publisher","first-page":"216","DOI":"10.1016\/j.inffus.2019.01.001","article-title":"Dynamic defense strategy against advanced persistent threat under heterogeneous networks","volume":"49","author":"Lv","year":"2019","journal-title":"Inform. Fusion"},{"key":"B33","doi-asserted-by":"publisher","first-page":"22351","DOI":"10.1109\/ACCESS.2021.3056614","article-title":"Benchmarking of machine learning for anomaly based intrusion detection systems in the cicids2017 dataset","volume":"9","author":"Maseer","year":"2021","journal-title":"IEEE Access"},{"key":"B34","doi-asserted-by":"publisher","first-page":"477","DOI":"10.12785\/IJCDS\/080505","article-title":"Network based intrusion detection using the UNSW-NB15 dataset","volume":"8","author":"Meftah","year":"2019","journal-title":"Int. J. Comput. Digit. Syst"},{"key":"B35","doi-asserted-by":"publisher","first-page":"5248","DOI":"10.1109\/TAC.2020.2976040","article-title":"A game-theoretic approach for dynamic information flow tracking to detect multistage advanced persistent threats","volume":"65","author":"Moothedath","year":"2020","journal-title":"IEEE Trans. Autom. Control"},{"key":"B36","doi-asserted-by":"publisher","first-page":"108768","DOI":"10.1016\/j.asoc.2022.108768","article-title":"A two-stage intrusion detection system with auto-encoder and LSTMs","volume":"121","author":"Mushtaq","year":"2022","journal-title":"Appl. Soft Comput"},{"key":"B37","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/NOMS56928.2023.10154328","article-title":"\u201cInvestigating adversarial attacks against random forest-based network attack detection systems,\u201d","volume-title":"NOMS 2023-2023 IEEE\/IFIP network operations and management symposium","author":"Owezarski","year":"2023"},{"key":"B38","first-page":"265","article-title":"\u201cOutside the closed world: on using machine learning for network intrusion detection,\u201d","volume-title":"International conference on information and communication technology for intelligent systems","author":"Padhiar","year":"2023"},{"key":"B39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-66065-9","author":"Pawlick","year":"2021","journal-title":"Game Theory for Cyber Deception"},{"key":"B40","doi-asserted-by":"publisher","first-page":"407","DOI":"10.59670\/ml.v20iS13.6472","article-title":"Detection and mitigation of DDoS attack in SDN environment using hybrid CNN-LSTM","volume":"20","author":"Rajan","year":"2023","journal-title":"Migr. Lett"},{"key":"B41","doi-asserted-by":"publisher","first-page":"7705","DOI":"10.1007\/s00521-023-08830-4","article-title":"Improving paraphrase generation using supervised neural-based statistical machine translation framework","volume":"37","author":"Razaq","year":"2025","journal-title":"Neural Comput. Appl"},{"key":"B42","doi-asserted-by":"crossref","first-page":"611","DOI":"10.1145\/3427228.3427230","article-title":"\u201cQuery-efficient black-box attack against sequence-based malware classifiers,\u201d","volume-title":"Proceedings of the 36th annual computer security applications conference","author":"Rosenberg","year":"2020"},{"key":"B43","doi-asserted-by":"publisher","first-page":"74571","DOI":"10.1109\/ACCESS.2020.2988854","article-title":"Fog-based attack detection framework for internet of things using deep learning","volume":"8","author":"Samy","year":"2020","journal-title":"IEEE Access"},{"key":"B44","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417231","article-title":"\u201cGotta catch'em all: using honeypots to catch adversarial attacks on neural networks,\u201d","author":"Shan","year":"2020","journal-title":"27th ACM SIGSAC conference on computer and communications security, CCS 2020, Association for Computing Machinery, Virtual, Online, United States, September 11, 2020"},{"key":"B45","doi-asserted-by":"crossref","first-page":"108","DOI":"10.5220\/0006639801080116","article-title":"\u201cToward generating a new intrusion detection dataset and intrusion traffic characterization,\u201d","volume-title":"Proceedings of the 4th international conference on information systems security and privacy","author":"Sharafaldin","year":"2018"},{"key":"B46","doi-asserted-by":"publisher","first-page":"581","DOI":"10.1109\/TASLP.2019.2959251","article-title":"Tree-structured regional CNN-LSTM model for dimensional sentiment analysis","volume":"28","author":"Wang","year":"2019","journal-title":"IEEE ACM Trans. Audio Speech Lang. Process"},{"key":"B47","doi-asserted-by":"publisher","first-page":"19339","DOI":"10.1038\/s41598-024-70094-2","article-title":"An improved intrusion detection method for IIoT using attention mechanisms, BiGRU, and inception-CNN","volume":"14","author":"Yang","year":"2024","journal-title":"Sci. Rep"},{"key":"B48","doi-asserted-by":"publisher","first-page":"413","DOI":"10.1016\/j.neucom.2021.12.015","article-title":"Generating adversarial examples via enhancing latent spatial features of benign traffic and preserving malicious functions","volume":"490","author":"Zhang","year":"2022","journal-title":"Neurocomputing"}],"container-title":["Frontiers in Artificial Intelligence"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1928178\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T06:06:35Z","timestamp":1790748395000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/frai.2026.1928178\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,30]]},"references-count":48,"alternative-id":["10.3389\/frai.2026.1928178"],"URL":"https:\/\/doi.org\/10.3389\/frai.2026.1928178","relation":{},"ISSN":["2624-8212"],"issn-type":[{"value":"2624-8212","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,30]]},"article-number":"1928178"}}