{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T20:41:02Z","timestamp":1780605662327,"version":"3.54.1"},"reference-count":40,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T00:00:00Z","timestamp":1651104000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"FRIDA (Fondo Regional para la Innovaci\u00f3n Digital en Am\u00e9rica Latina y el Caribe)","award":["519RT0580"],"award-info":[{"award-number":["519RT0580"]}]},{"DOI":"10.13039\/501100008441","name":"Red tem\u00e1tica Ciencia y Tecnolog\u00eda para el Desarrollo (CYTED)","doi-asserted-by":"publisher","award":["519RT0580"],"award-info":[{"award-number":["519RT0580"]}],"id":[{"id":"10.13039\/501100008441","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Ibero-American Science and Technology Program for Development CYTED","award":["519RT0580"],"award-info":[{"award-number":["519RT0580"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>From smart homes to industrial environments, the IoT is an ally to easing daily activities, where some of them are critical. More and more devices are connected to and through the Internet, which, given the large amount of different manufacturers, may lead to a lack of security standards. Denial of service attacks (DDoS, DoS) represent the most common and critical attack against and from these networks, and in the third quarter of 2021, there was an increase of 31% (compared to the same period of 2020) in the total number of advanced DDoS targeted attacks. This work uses the Bot-IoT dataset, addressing its class imbalance problem, to build a novel Intrusion Detection System based on Machine Learning and Deep Learning models. In order to evaluate how the records timestamps affect the predictions, we used three different feature sets for binary and multiclass classifications; this helped us avoid feature dependencies, as produced by the Argus flow data generator, whilst achieving an average accuracy &gt;99%. Then, we conducted comprehensive experimentation, including time performance evaluation, matching and exceeding the results of the current state-of-the-art for identifying denial of service attacks, where the Decision Tree and Multi-layer Perceptron models were the best performing methods to identify DDoS and DoS attacks over IoT networks.<\/jats:p>","DOI":"10.3390\/s22093367","type":"journal-article","created":{"date-parts":[[2022,4,28]],"date-time":"2022-04-28T22:20:06Z","timestamp":1651184406000},"page":"3367","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":112,"title":["Transport and Application Layer DDoS Attacks Detection to IoT Devices by Using Machine Learning and Deep Learning Models"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8343-4530","authenticated-orcid":false,"given":"Josue Genaro","family":"Almaraz-Rivera","sequence":"first","affiliation":[{"name":"Tecnologico de Monterrey, School of Engineering and Sciences, Monterrey 64849, Nuevo Leon, Mexico"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7678-5487","authenticated-orcid":false,"given":"Jesus Arturo","family":"Perez-Diaz","sequence":"additional","affiliation":[{"name":"Tecnologico de Monterrey, School of Engineering and Sciences, Monterrey 64849, Nuevo Leon, Mexico"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5597-939X","authenticated-orcid":false,"given":"Jose Antonio","family":"Cantoral-Ceballos","sequence":"additional","affiliation":[{"name":"Tecnologico de Monterrey, School of Engineering and Sciences, Monterrey 64849, Nuevo Leon, Mexico"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,4,28]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"108495","DOI":"10.1109\/ACCESS.2021.3101650","article-title":"SDN-Based Architecture for Transport and Application Layer DDoS Attack Detection by Using Machine and Deep Learning","volume":"9","year":"2021","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"43920","DOI":"10.1109\/ACCESS.2020.2976609","article-title":"Low-Rate DoS Attacks, Detection, Defense, and Challenges: A Survey","volume":"8","author":"Zhijun","year":"2020","journal-title":"IEEE Access"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"3417","DOI":"10.1016\/j.comnet.2012.07.003","article-title":"Flow level detection and filtering of low-rate DDoS","volume":"56","author":"Zhang","year":"2012","journal-title":"Comput. Netw."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"155859","DOI":"10.1109\/ACCESS.2020.3019330","article-title":"A Flexible SDN-Based Architecture for Identifying and Mitigating Low-Rate DDoS Attacks Using Machine Learning","volume":"8","author":"Valdovinos","year":"2020","journal-title":"IEEE Access"},{"key":"ref_5","unstructured":"Kupreev, O., Badovskaya, E., and Gutnikov, A. (2021, November 15). DDoS Attacks in Q2 2020|Securelist. Available online: https:\/\/securelist.com\/ddos-attacks-in-q2-2020\/98077\/."},{"key":"ref_6","unstructured":"Faro, C. (2021, November 15). DDoS Attacks in Q3 2021|Kaspersky. Available online: https:\/\/usa.kaspersky.com\/about\/press-releases\/2021_kaspersky-finds-ddos-attacks-in-q3-grow-by-24-become-more-sophisticated."},{"key":"ref_7","unstructured":"(2021, September 03). Understanding Denial-of-Service Attacks, Available online: https:\/\/us-cert.cisa.gov\/ncas\/tips\/ST04-015."},{"key":"ref_8","unstructured":"McMillen, D. (2021, December 17). Internet of Threats: IoT Botnets Drive Surge in Network Attacks. Available online: https:\/\/securityintelligence.com\/posts\/internet-of-threats-iot-botnets-network-attacks\/."},{"key":"ref_9","unstructured":"Sinha, S. (2022, January 07). State of IoT 2021. Available online: https:\/\/iot-analytics.com\/number-connected-iot-devices\/."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Li, H., Wei, F., and Hu, H. (2019, January 27). Enabling Dynamic Network Access Control with Anomaly-Based IDS and SDN. Proceedings of the SDN-NFVSec \u201919, ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, Richardson, TX, USA.","DOI":"10.1145\/3309194.3309199"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_12","first-page":"102419","article-title":"Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Xu, J., Wang, Z., Geng, R., Choo, K., Perez-Diaz, J., and Zhu, D. (2020, January 10\u201311). Efficient and Intelligent Attack Detection in Software Defined IoT Networks. Proceedings of the 2020 IEEE International Conference on Embedded Software and Systems (ICESS), Shanghai, China.","DOI":"10.1109\/ICESS49830.2020.9301591"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Ge, M., Fu, X., Syed, N., Baig, Z., Teo, G., and Robles-Kelly, A. (2019, January 1\u20133). Deep Learning-Based Intrusion Detection for IoT Networks. Proceedings of the 2019 IEEE 24th Pacific Rim International Symposium on Dependable Computing (PRDC), Kyoto, Japan.","DOI":"10.1109\/PRDC47002.2019.00056"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"3242","DOI":"10.1109\/JIOT.2020.3002255","article-title":"CorrAUC: A Malicious Bot-IoT Traffic Detection Method in IoT Network Using Machine-Learning Techniques","volume":"8","author":"Shafiq","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"24147","DOI":"10.1007\/s11042-021-10765-8","article-title":"Botnet traffic identification using neural networks","volume":"80","author":"Biswas","year":"2021","journal-title":"Multimed. Tools Appl."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Churcher, A., Ullah, R., Ahmad, J., ur Rehman, S., Masood, F., Gogate, M., Alqahtani, F., Nour, B., and Buchanan, W.J. (2021). An Experimental Analysis of Attack Classification Using Machine Learning in IoT Networks. Sensors, 21.","DOI":"10.3390\/s21020446"},{"key":"ref_18","unstructured":"(2021, November 05). GoldenEye Layer 7 (KeepAlive+NoCache) DoS Test Tool. Available online: https:\/\/github.com\/jseidl\/GoldenEye."},{"key":"ref_19","unstructured":"(2021, November 05). Hping. Available online: http:\/\/www.hping.org."},{"key":"ref_20","unstructured":"(2021, December 10). Argus. Available online: https:\/\/openargus.org."},{"key":"ref_21","unstructured":"Gutnikov, A., Kupreev, O., and Shmelev, Y. (2021, November 15). DDoS Attacks in Q3 2021|Securelist. Available online: https:\/\/securelist.com\/ddos-attacks-in-q3-2021\/104796\/."},{"key":"ref_22","unstructured":"(2021, January 26). The Bot-IoT Dataset. Available online: https:\/\/research.unsw.edu.au\/projects\/bot-iot-dataset."},{"key":"ref_23","unstructured":"Srinivasa Gopalan, S. (2021, August 19). Towards Effective Detection of Botnet Attacks Using BoT-IoT Dataset. Available online: https:\/\/scholarworks.rit.edu\/theses\/10698."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"299","DOI":"10.1109\/TKDE.2005.50","article-title":"Using AUC and accuracy in evaluating learning algorithms","volume":"17","author":"Huang","year":"2005","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Thomas, R., and Pavithran, D. (2018, January 28\u201329). A Survey of Intrusion Detection Models based on NSL-KDD Data Set. Proceedings of the 2018 Fifth HCT Information Technology Trends (ITT), Dubai, United Arab Emirates.","DOI":"10.1109\/CTIT.2018.8649498"},{"key":"ref_26","first-page":"2825","article-title":"Scikit-learn: Machine Learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_27","unstructured":"Chollet, F. (2021, November 05). Keras. Available online: https:\/\/keras.io."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1613\/jair.953","article-title":"SMOTE: Synthetic Minority over-Sampling Technique","volume":"16","author":"Chawla","year":"2002","journal-title":"J. Artif. Intell. Res."},{"key":"ref_29","unstructured":"(2021, December 13). CICFlowMeter. Available online: https:\/\/github.com\/ahlashkari\/CICFlowMeter."},{"key":"ref_30","unstructured":"(2021, December 13). Flowtbag. Available online: https:\/\/github.com\/DanielArndt\/flowtbag."},{"key":"ref_31","unstructured":"Wallach, H., Larochelle, H., Beygelzimer, A., d\u2019Alch\u00e9-Buc, F., Fox, E., and Garnett, R. (2019, January 8\u201314). PyTorch: An Imperative Style, High-Performance Deep Learning Library. Proceedings of the Advances in Neural Information Processing Systems 32 (NeurIPS 2019), Vancouver, BC, Canada."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"102942","DOI":"10.1016\/j.jnca.2020.102942","article-title":"A GRU deep learning system against attacks in software defined networks","volume":"177","author":"Assis","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_33","unstructured":"(2022, April 09). Decision Trees\u2014Scikit-Learn. Available online: https:\/\/scikit-learn.org\/0.24\/modules\/tree.html."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1109\/JPROC.2014.2371999","article-title":"Software-Defined Networking: A Comprehensive Survey","volume":"103","author":"Kreutz","year":"2015","journal-title":"Proc. IEEE"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Muthanna, A., Ateya, A.A., Khakimov, A., Gudkova, I., Abuarqoub, A., Samouylov, K., and Koucheryavy, A. (2019). Secure and Reliable IoT Networks Using Fog Computing with Software-Defined Networking and Blockchain. J. Sens. Actuator Netw., 8.","DOI":"10.3390\/jsan8010015"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"333","DOI":"10.1109\/COMST.2017.2782482","article-title":"Distributed SDN Control: Survey, Taxonomy, and Challenges","volume":"20","author":"Bannour","year":"2018","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_37","unstructured":"Berde, P., Gerola, M., Hart, J., Higuchi, Y., Kobayashi, M., Koide, T., Lantz, B., O\u2019Connor, B., Radoslavov, P., and Snow, W. (2014, January 22). ONOS: Towards an Open, Distributed SDN OS. Proceedings of the HotSDN \u201914, Third Workshop on Hot Topics in Software Defined Networking, Chicago, IL, USA."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1016\/j.inffus.2018.11.010","article-title":"Short-long term anomaly detection in wireless sensor networks based on machine learning and multi-parameterized edit distance","volume":"52","author":"Cauteruccio","year":"2019","journal-title":"Inf. Fusion"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"322","DOI":"10.1016\/j.future.2020.08.010","article-title":"A framework for anomaly detection and classification in Multiple IoT scenarios","volume":"114","author":"Cauteruccio","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1016\/j.future.2018.09.015","article-title":"The MIoT paradigm: Main features and an \u201cad-hoc\u201d crawler","volume":"92","author":"Baldassarre","year":"2019","journal-title":"Future Gener. Comput. Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/9\/3367\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:02:30Z","timestamp":1760137350000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/9\/3367"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,4,28]]},"references-count":40,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2022,5]]}},"alternative-id":["s22093367"],"URL":"https:\/\/doi.org\/10.3390\/s22093367","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,4,28]]}}}