{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T05:31:08Z","timestamp":1777440668088,"version":"3.51.4"},"reference-count":0,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T00:00:00Z","timestamp":1777161600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Industrial Internet of Things (IIoT) and SCADA-connected networks are increasingly vulnerable to Distributed Denial of Service (DDoS) attacks, which can disrupt time-sensitive industrial processes and compromise operational continuity. Effective mitigation requires accurate and low-latency attack detection at the network edge, where industrial gateways operate under strict constraints in computation, memory, and energy. This study investigates Deep Reinforcement Learning (DRL) for real-time binary DDoS detection and proposes a detector based on Proximal Policy Optimisation (PPO) for deployment in resource-constrained IIoT environments. Four DRL agents, namely Deep Q-Network (DQN), Double DQN, Dueling DQN, and PPO, are trained and evaluated within a unified experimental pipeline incorporating automatic label mapping, numerical feature selection, robust scaling, and class balancing. Experiments are conducted on three representative benchmark datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. Performance is assessed using accuracy, precision, recall, F1-score, false positive rate, false negative rate, and CPU inference latency. The reward function is asymmetric: +1 for correct classification, \u22121 for false positive, and \u22122 for false negative, penalising missed attacks more heavily for IIoT safety. The results show that PPO provides a competitive accuracy\u2013latency tradeoff across all three datasets, achieving the highest mean accuracy of 97.65% and ranking first on CIC-DDoS2019 with a score of 95.92%, while remaining competitive on Edge-IIoTset (99.11%) and CICIoT23 (97.92%). PPO also converges faster than the value-based baselines. Inference latency is below 0.8 ms per sample on a standard CPU (Intel i7-11800H), confirming real-time feasibility. To support practical deployment, the trained PPO policies are exported to ONNX format (\u22489 KB per model), enabling lightweight and PyTorch-independent inference on industrial edge gateways.<\/jats:p>","DOI":"10.3390\/info17050412","type":"journal-article","created":{"date-parts":[[2026,4,28]],"date-time":"2026-04-28T11:33:37Z","timestamp":1777376017000},"page":"412","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Low-Latency DDoS Detection for IIoT and SCADA Networks Using Proximal Policy Optimisation and Deep Reinforcement Learning"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-1180-6188","authenticated-orcid":false,"given":"Mikiyas","family":"Alemayehu","sequence":"first","affiliation":[{"name":"School of Computer Science and Mathematics, Keele University, Keele ST5 5BG, UK"},{"name":"Cybersecurity Institute, School of Computer Science and Informatics, University of Liverpool, Liverpool L69 3BX, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7067-7848","authenticated-orcid":false,"given":"Mohamed Chahine","family":"Ghanem","sequence":"additional","affiliation":[{"name":"School of Computer Science and Mathematics, Keele University, Keele ST5 5BG, UK"},{"name":"Cybersecurity Institute, School of Computer Science and Informatics, University of Liverpool, Liverpool L69 3BX, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9532-2453","authenticated-orcid":false,"given":"Hamza","family":"Kheddar","sequence":"additional","affiliation":[{"name":"LSEA Laboratory, Department of Electrical Engineering, University of Medea, Medea 26000, Algeria"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-7376-0477","authenticated-orcid":false,"given":"Dipo","family":"Dunsin","sequence":"additional","affiliation":[{"name":"Department of Computing IICL, University of Wales Trinity Saint David, London E14 4HA, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9990-519X","authenticated-orcid":false,"given":"Chaker Abdelaziz","family":"Kerrache","sequence":"additional","affiliation":[{"name":"Laboratoire d\u2019Informatique et de Math\u00e9matiques, University Amar Telidji Laghouat, Laghouat 03000, Algeria"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4761-1912","authenticated-orcid":false,"given":"Geetanjali","family":"Rathee","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Netaji Subhas University of Technology, New Delhi 110078, India"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,26]]},"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/5\/412\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,28]],"date-time":"2026-04-28T12:12:16Z","timestamp":1777378336000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/5\/412"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,26]]},"references-count":0,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["info17050412"],"URL":"https:\/\/doi.org\/10.3390\/info17050412","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,26]]}}}