{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,6]],"date-time":"2026-01-06T13:08:13Z","timestamp":1767704893505,"version":"build-2065373602"},"reference-count":36,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T00:00:00Z","timestamp":1757289600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Distributed denial-of-service (DDoS) attacks are a prevalent threat to resource-constrained IoT deployments. We present an edge-based detection and mitigation system integrated with the oneM2M architecture. By using a Raspberry Pi 4 client and five Raspberry Pi 3 attack nodes in a smart-home testbed, we collected 200,000 packets with 19 features across four traffic states (normal, SYN\/UDP\/ICMP floods), trained Decision Tree, 2D-CNN, and LSTM models, and deployed the best model on an edge computer for real-time inference. The edge node classifies traffic and triggers per-attack defenses on the device (SYN cookies, UDP\/ICMP iptables rules). On a held-out test set, the 2D-CNN achieved 98.45% accuracy, outperforming the LSTM (96.14%) and Decision Tree (93.77%). In end-to-end trials, the system sustained service during SYN floods (time to capture 200 packets increased from 5.05 s to 5.51 s after enabling SYN cookies), mitigated ICMP floods via rate limiting, and flagged UDP floods for administrator intervention due to residual performance degradation. These results show that lightweight, edge-deployed learning with targeted controls can harden oneM2M-based IoT systems against common DDoS vectors.<\/jats:p>","DOI":"10.3390\/fi17090411","type":"journal-article","created":{"date-parts":[[2025,9,9]],"date-time":"2025-09-09T12:15:17Z","timestamp":1757420117000},"page":"411","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Detection and Mitigation in IoT Ecosystems Using oneM2M Architecture and Edge-Based Machine Learning"],"prefix":"10.3390","volume":"17","author":[{"given":"Yu-Yong","family":"Luo","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering, National Formosa University, Yunlin 632301, Taiwan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu-Hsun","family":"Chiu","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, National Formosa University, Yunlin 632301, Taiwan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6656-8921","authenticated-orcid":false,"given":"Chia-Hsin","family":"Cheng","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, National Formosa University, Yunlin 632301, Taiwan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,9,8]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"8411","DOI":"10.1109\/JIOT.2020.3045733","article-title":"A Network-Aware Internet-Wide Scan for Security Maximization of IPv6-Enabled WLAN IoT Devices","volume":"8","author":"Verma","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Bellini, P., Nesi, P., and Pantaleo, G. (2022). IoT-Enabled Smart Cities: A Review of Concepts, Frameworks and Key Technologies. Appl. Sci., 12.","DOI":"10.3390\/app12031607"},{"key":"ref_3","unstructured":"Forsey, C. (2021, February 24). The 13 Best Smart Home Devices & Systems of 2021. Available online: https:\/\/blog.hubspot.com\/marketing\/smart-home-devices."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"10091","DOI":"10.1109\/JIOT.2020.3003528","article-title":"Landscape of Architecture and Design Patterns for IoT Systems","volume":"7","author":"Washizaki","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"6882","DOI":"10.1109\/JIOT.2020.2970501","article-title":"Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices","volume":"7","author":"Eskandari","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"6282","DOI":"10.1109\/JIOT.2020.3026023","article-title":"A Quantitative Study of DDoS and E-DDoS Attacks on WiFi Smart Home Devices","volume":"8","author":"Tushir","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_7","unstructured":"Bock, P. (2025, August 31). Lessons Learned from a Forensic Analysis of the Ukrainian Power Grid Cyberattack. Available online: https:\/\/blog.isa.org\/lessons-learned-forensic-analysis-ukrainian-power-grid-cyberattack-malware."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"170553","DOI":"10.1109\/ACCESS.2024.3473895","article-title":"A Novel Dataset for Experimentation with Intrusion Detection Systems in SCADA Networks Using IEC 60870-5-104 Standard","volume":"12","author":"Arifin","year":"2024","journal-title":"IEEE Access"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2523","DOI":"10.1109\/TNSM.2020.3014870","article-title":"Bringing Intelligence to Software Defined Networks: Mitigating DDoS Attacks","volume":"17","author":"Khoukhi","year":"2020","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_10","first-page":"569","article-title":"DDoS Detection on Internet of Things Using Unsupervised Algorithms","volume":"10","author":"Odumuyiwa","year":"2021","journal-title":"J. Cyber Secur. Mobil."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"122495","DOI":"10.1109\/ACCESS.2021.3109490","article-title":"Detection and Classification of DDoS Flooding Attacks on Software-Defined Networks: A Case Study for the Application of Machine Learning","volume":"9","author":"Sangodoyin","year":"2021","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: A New Comprehensive Realistic Cyber Security Dataset of IoT and IIoT Applications for Centralized and Federated Learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"86716","DOI":"10.1109\/ACCESS.2024.3416838","article-title":"A Survey of Decision Trees: Concepts, Algorithms, and Applications","volume":"12","author":"Mienye","year":"2024","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"3985","DOI":"10.1109\/TCAD.2023.3258747","article-title":"Circuit Learning: From Decision Trees to Decision Graphs","volume":"42","author":"Huang","year":"2023","journal-title":"IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"90061","DOI":"10.1109\/ACCESS.2024.3419228","article-title":"Assessing Decision Tree Stability: A Comprehensive Method for Generating a Stable Decision Tree","volume":"12","author":"Lee","year":"2024","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"11718","DOI":"10.1109\/TNNLS.2024.3446891","article-title":"A Survey of Neural Trees: Co-Evolving Neural Networks and Decision Trees","volume":"36","author":"Li","year":"2025","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"5706","DOI":"10.1109\/TNNLS.2024.3382174","article-title":"A Quantum Spatial Graph Convolutional Neural Network Model on Quantum Circuits","volume":"36","author":"Zheng","year":"2025","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"6999","DOI":"10.1109\/TNNLS.2021.3084827","article-title":"A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects","volume":"33","author":"Li","year":"2022","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_19","first-page":"275","article-title":"Weed Detection Model Using the Generative Adversarial Network and Deep Convolutional Neural Network","volume":"18","author":"Anthoniraj","year":"2021","journal-title":"J. Mob. Multimed."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Ma, R., Wang, Q., Bu, X., and Chen, X. (2023). Real-Time Detection of DDoS Attacks Based on Random Forest in SDN. Appl. Sci., 13.","DOI":"10.3390\/app13137872"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Aldaej, A., Ahanger, T.A., and Ullah, I. (2023). Deep Learning-Inspired IoT-IDS Mechanism for Edge Computing Environments. Sensors, 23.","DOI":"10.3390\/s23249869"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Chaira, M., Belhenniche, A., and Chertovskih, R. (2025). Enhancing DDoS Attacks Mitigation Using Machine Learning and Blockchain-Based Mobile Edge Computing in IoT. Computation, 13.","DOI":"10.3390\/computation13070158"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"129287","DOI":"10.1016\/j.optcom.2023.129287","article-title":"Image Classification and Adversarial Robustness Analysis Based on Hybrid Quantum\u2013Classical Convolutional Neural Network","volume":"533","author":"Huang","year":"2023","journal-title":"Opt. Commun."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"103622","DOI":"10.1016\/j.aei.2025.103622","article-title":"Quantum Generative Adversarial Network Based on the Quantum Born Machine","volume":"68","author":"Ding","year":"2025","journal-title":"Adv. Eng. Inform."},{"key":"ref_25","unstructured":"(2025, August 31). oneM2M. Available online: https:\/\/www.onem2m.org\/."},{"key":"ref_26","unstructured":"Kaushal, S., and Kumar, H. (2022, January 21\u201322). Interworking of M2M and oneM2M. Proceedings of the 2022 International Conference for Advancement in Technology (ICONAT), Goa, India."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Saini, P., Mahajan, N., Kaushal, S., and Kumar, H. An analytical survey on optimized authentication techniques in OneM2M. Proceedings of the 2023 International Conference on Innovative Data Communication Technologies and Application (ICIDCA), Uttarakhand, India.","DOI":"10.1109\/ICIDCA56705.2023.10099946"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Gupta, R., Naware, V., Vattem, A., and Hussain, A.M. A Wi-SUN network-based electric vehicle charging station using Open Charge Point Protocol (OCPP) and oneM2M platform. Proceedings of the 2024 IEEE Applied Sensing Conference (APSCON), Goa, India.","DOI":"10.1109\/APSCON60364.2024.10465759"},{"key":"ref_29","unstructured":"oneM2M (2019). TS-0001: Functional Architecture, oneM2M."},{"key":"ref_30","unstructured":"Fielding, R.T. (2000). Architectural Styles and the Design of Network-Based Software Architectures. [Ph.D. Thesis, University of California]."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Wazzan, M., Algazzawi, D., Bamasaq, O., Albeshri, A., and Cheng, L. (2021). Internet of Things botnet detection approaches: Analysis and recommendations for future research. Appl. Sci., 11.","DOI":"10.3390\/app11125713"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"28","DOI":"10.1016\/j.cose.2019.05.019","article-title":"Issues and challenges in DNS-based botnet detection: A survey","volume":"86","author":"Singh","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_33","unstructured":"Wallarm Cybersecurity Center (2025, August 31). UDP Flood Attack. Available online: https:\/\/www.wallarm.com\/what\/udp-flood-attack."},{"key":"ref_34","unstructured":"zaheernew (2025, August 31). The Overview of ICMP\u2014PART 03. Available online: https:\/\/forum.huawei.com\/enterprise\/en\/the-overview-of-icmp-part-03\/thread\/807857-867?page=2."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"94371","DOI":"10.1109\/ACCESS.2023.3309601","article-title":"Short-term traffic prediction using deep learning long short-term memory: Taxonomy, applications, challenges, and future trends","volume":"11","author":"Khan","year":"2023","journal-title":"IEEE Access"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"7184","DOI":"10.1109\/TAP.2024.3437241","article-title":"A long short-term memory approach to incorporating multifrequency data into deep-learning-based microwave imaging","volume":"72","author":"Martin","year":"2024","journal-title":"IEEE Trans. Antennas Propag."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/9\/411\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:42:06Z","timestamp":1760035326000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/9\/411"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9,8]]},"references-count":36,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["fi17090411"],"URL":"https:\/\/doi.org\/10.3390\/fi17090411","relation":{},"ISSN":["1999-5903"],"issn-type":[{"type":"electronic","value":"1999-5903"}],"subject":[],"published":{"date-parts":[[2025,9,8]]}}}