{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T01:01:42Z","timestamp":1760058102708,"version":"build-2065373602"},"reference-count":48,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2025,3,11]],"date-time":"2025-03-11T00:00:00Z","timestamp":1741651200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>In the realm of cybersecurity, detecting Distributed Denial of Service (DDoS) attacks with high accuracy is a critical task. Traditional machine learning models often fall short in handling the complexity and high dimensionality of network traffic data. This study proposes a hybrid framework leveraging symmetry in feature distribution, network behavior, and model optimization for anomaly detection. A Tree Convolutional Neural Network (Tree-CNN) captures hierarchical symmetrical dependencies, while a deep autoencoder preserves latent symmetrical structures, reducing noise for better classification. A Leader-Guided Velocity-Based Spiral Optimization Algorithm is proposed to optimize the parameters of the system and achieve better performance. A Leader-Guided Velocity-Based Spiral Optimization Algorithm is introduced to maintain a symmetrical balance between exploration and exploitation, optimizing the autoencoder, Tree-CNN, and classification thresholds. Validation using three datasets\u2014UNSW-NB15, CIC-IDS 2017, and CIC-IDS 2018\u2014demonstrates the framework\u2019s superiority. The model achieves 96.02% accuracy on UNSW-NB15, 99.99% on CIC-IDS 2017, and 99.96% on CIC-IDS 2018, with near-perfect precision and recall. Despite a slightly higher computational cost, the symmetrically optimized framework ensures high efficiency and superior detection, making it ideal for real-time complex networks. These findings emphasize the critical role of symmetrical network patterns and feature selection strategies for enhancing intrusion detection performance.<\/jats:p>","DOI":"10.3390\/sym17030421","type":"journal-article","created":{"date-parts":[[2025,3,11]],"date-time":"2025-03-11T16:39:03Z","timestamp":1741711143000},"page":"421","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Hybrid Tree Convolutional Neural Network with Leader-Guided Spiral Optimization for Detecting Symmetric Patterns in Network Anomalies"],"prefix":"10.3390","volume":"17","author":[{"given":"Reem Talal Abdulhameed","family":"Al-Dulaimi","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, Institute of Graduate Studies, Alt\u0131nba\u015f University, Istanbul 34000, Turkey"}]},{"given":"Ay\u00e7a Kurnaz","family":"T\u00fcrkben","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, Institute of Graduate Studies, Alt\u0131nba\u015f University, Istanbul 34000, Turkey"}]}],"member":"1968","published-online":{"date-parts":[[2025,3,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Djenna, A., Harous, S., and Saidouni, D.E. (2021). Internet of things meet internet of threats: New concern cyber security issues of critical cyber infrastructure. Appl. Sci., 11.","DOI":"10.3390\/app11104580"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1080\/23742917.2016.1252211","article-title":"Review of cybersecurity issues in industrial critical infrastructure: Manufacturing in perspective","volume":"1","author":"Ani","year":"2017","journal-title":"J. Cyber Secur. Technol."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"5757164","DOI":"10.1155\/2022\/5757164","article-title":"Enhanced security against volumetric DDoS attacks using adversarial machine learning","volume":"2022","author":"Shroff","year":"2022","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Hassan, A.I., El Reheem, E.A., and Guirguis, S.K. (2024). An entropy and machine learning based approach for DDoS attacks detection in software defined networks. Sci. Rep., 14.","DOI":"10.1038\/s41598-024-67984-w"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Tang, K.H., Ghanem, M.C., Vassilev, V., Ouazzane, K., and Gasiorowski, P. (2025). Synchronization, Optimization, and Adaptation of Machine Learning Techniques for Computer Vision in Cyber-Physical Systems: A Comprehensive Analysis. Preprints, 2025010521.","DOI":"10.36227\/techrxiv.173937791.10304517\/v1"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"192618","DOI":"10.1109\/ACCESS.2024.3508028","article-title":"A Multi-Branched Hybrid Perceptron Network for DDoS Attack Detection Using Dynamic Feature Adaptation and Multi-Instance Learning","volume":"12","author":"Ucan","year":"2024","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"180","DOI":"10.5755\/j01.itc.51.1.29595","article-title":"A comprehensive review of deep learning techniques for the detection of (distributed) denial of service attacks","volume":"51","author":"Malliga","year":"2022","journal-title":"Inf. Technol. Control"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Gwassi, O.A.H., U\u00e7an, O.N., and Navarro, E.A. (2024). Cyber-XAI-Block: An end-to-end cyber threat detection & fl-based risk assessment framework for iot enabled smart organization using xai and blockchain technologies. Multimed. Tools Appl., 1\u201342.","DOI":"10.1007\/s11042-024-20059-4"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Alotaibi, A., and Rassam, M.A. (2023). Adversarial machine learning attacks against intrusion detection systems: A survey on strategies and defense. Future Internet, 15.","DOI":"10.3390\/fi15020062"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"24694","DOI":"10.1109\/ACCESS.2018.2831284","article-title":"A DDoS attack detection and mitigation with software-defined Internet of Things framework","volume":"6","author":"Yin","year":"2018","journal-title":"IEEE Access"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Khatri, A., and Khatri, R. (2023). DDoS Attack Detection Using Artificial Neural Network on IoT Devices in a Simulated Environment. International Conference on IoT, Intelligent Computing and Security: Select Proceedings of IICS 2021, Springer Nature.","DOI":"10.1007\/978-981-19-8136-4_19"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Parmar, A., and Lamkuche, H. (2023, January 27\u201328). Distributed Denial of Service Attack Detection Using Sequence-To-Sequence LSTM. Proceedings of the International Conference on Global Economic Revolutions, Sharjah, United Arab Emirates.","DOI":"10.1007\/978-3-031-50518-8_4"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Wang, J., Wang, L., and Wang, R. (2023). A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers. Entropy, 25.","DOI":"10.3390\/e25081210"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"100631","DOI":"10.1016\/j.cosrev.2024.100631","article-title":"AI techniques for IoT-based DDoS attack detection: Taxonomies, comprehensive review and research challenges","volume":"52","author":"Bala","year":"2024","journal-title":"Comput. Sci. Rev."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"103661","DOI":"10.1016\/j.cose.2023.103661","article-title":"DDoS attack detection and mitigation using deep neural network in SDN environment","volume":"138","author":"Hnamte","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"103962","DOI":"10.1016\/j.cose.2024.103962","article-title":"Robust DDoS attack detection with adaptive transfer learning","volume":"144","author":"Anley","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"136308","DOI":"10.1109\/ACCESS.2023.3334916","article-title":"CNN-AttBiLSTM Mechanism: A DDoS Attack Detection Method Based on Attention Mechanism and CNN-BiLSTM","volume":"11","author":"Zhao","year":"2023","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1654","DOI":"10.1109\/TSG.2024.3474039","article-title":"Spatio-Temporal Advanced Persistent Threat Detection and Correlation for Cyber-Physical Power Systems using Enhanced GC-LSTM","volume":"16","author":"Presekal","year":"2024","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Aktar, S., and Nur, A.Y. (2024, January 15\u201318). Robust Anomaly Detection in IoT Networks using Deep SVDD and Contractive Autoencoder. Proceedings of the 2024 IEEE International Systems Conference (SysCon), Montreal, QC, Canada.","DOI":"10.1109\/SysCon61195.2024.10553592"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Jiyad, Z.M., Al Maruf, A., Haque, M.M., Gupta, M.S., Ahad, A., and Aung, Z. (2024, January 18\u201320). DDoS Attack Classification Leveraging Data Balancing and Hyperparameter Tuning Approach Using Ensemble Machine Learning with XAI. Proceedings of the 2024 Third International Conference on Power, Control and Computing Technologies (ICPC2T), Raipur, India.","DOI":"10.1109\/ICPC2T60072.2024.10475035"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Qaddos, A., Yaseen, M.U., Al-Shamayleh, A.S., Imran, M., Akhunzada, A., and Alharthi, S.Z. (2024). A novel intrusion detection framework for optimizing IoT security. Sci. Rep., 14.","DOI":"10.1038\/s41598-024-72049-z"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1186\/s13677-024-00685-x","article-title":"Enhancing intrusion detection: A hybrid machine and deep learning approach","volume":"13","author":"Sajid","year":"2024","journal-title":"J. Cloud Comput."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"124","DOI":"10.1016\/j.future.2023.09.035","article-title":"An ensemble framework with improved hybrid breeding optimization-based feature selection for intrusion detection","volume":"151","author":"Ye","year":"2024","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"121912","DOI":"10.1016\/j.eswa.2023.121912","article-title":"Deep residual convolutional neural network: An efficient technique for intrusion detection system","volume":"238","author":"Kumar","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_26","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","volume":"1","author":"Sharafaldin","year":"2018","journal-title":"ICISSp"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"104","DOI":"10.1186\/s40537-020-00382-x","article-title":"A survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 big data","volume":"7","author":"Leevy","year":"2020","journal-title":"J. Big Data"},{"key":"ref_28","unstructured":"Duan, B. (1998). The Robustness of Trimming and Winsorization When the Population Distribution Is Skewed. [Ph.D. Dissertation, Tulane University]."},{"key":"ref_29","first-page":"105","article-title":"Log-transformation and its implications for data analysis","volume":"26","author":"Feng","year":"2014","journal-title":"Shanghai Arch. Psychiatry"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"385","DOI":"10.1016\/0305-0483(96)00010-2","article-title":"Effect of data standardization on neural network training","volume":"24","author":"Shanker","year":"1996","journal-title":"Omega"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Patro, S.G., and Sahu, K.K. (2015). Normalization: A preprocessing stage. arXiv.","DOI":"10.17148\/IARJSET.2015.2305"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Biswas, B., Ghosh, S.K., and Ghosh, A. (2020). DVAE: Deep variational auto-encoders for denoising retinal fundus image. Hybrid Machine Intelligence for Medical Image Analysis, Springer Nature.","DOI":"10.1007\/978-981-13-8930-6_10"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"1945","DOI":"10.1109\/CEC.1999.785511","article-title":"Empirical study of particle swarm optimization","volume":"Volume 3","author":"Shi","year":"1999","journal-title":"Proceedings of the 1999 Congress on Evolutionary Computation-CEC99 (Cat. No. 99TH8406)"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Trojovsk\u00fd, P., and Dehghani, M. (2022). Pelican optimization algorithm: A novel nature-inspired algorithm for engineering applications. Sensors, 22.","DOI":"10.3390\/s22030855"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"182","DOI":"10.17694\/bajece.502156","article-title":"A meta-ensemble classifier approach: Random rotation forest","volume":"7","year":"2019","journal-title":"Balkan J. Electr. Comput. Eng."},{"key":"ref_36","first-page":"25","article-title":"SVMlight: Support vector machine","volume":"19","author":"Joachims","year":"1999","journal-title":"SVM-Light Support Vector Mach."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"2277","DOI":"10.1007\/s00500-020-05297-6","article-title":"Naive Bayes: Applications, variations and vulnerabilities: A review of literature with code snippets for implementation","volume":"25","author":"Wickramasinghe","year":"2021","journal-title":"Soft Comput."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"69","DOI":"10.58496\/BJML\/2024\/007","article-title":"Random forest algorithm overview","volume":"2024","author":"Salman","year":"2024","journal-title":"Babylonian J. Mach. Learn."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Yadav, S., and Shukla, S. (2016, January 27\u201328). Analysis of k-fold cross-validation over hold-out validation on colossal datasets for quality classification. Proceedings of the 2016 IEEE 6th International Conference on Advanced Computing (IACC), Bhimavaram, India.","DOI":"10.1109\/IACC.2016.25"},{"key":"ref_40","unstructured":"Susmaga, R. (2004). Confusion Matrix Visualization. Intelligent Information Processing and Web Mining: Proceedings of the International IIS: IIPWM \u201804 Conference Held in Zakopane, Poland, 17\u201320 May 2004, Springer."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1002\/(SICI)1097-4571(199401)45:1<12::AID-ASI2>3.0.CO;2-L","article-title":"The relationship between recall and precision","volume":"45","author":"Buckland","year":"1994","journal-title":"J. Am. Soc. Inf. Sci."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"1009","DOI":"10.1109\/TFUZZ.2024.3504486","article-title":"Time series fore casting based on improved multi-linear trend fuzzy information granules for convolutional neural networks","volume":"33","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"102158","DOI":"10.1016\/j.cose.2020.102158","article-title":"An effective intrusion detection approach using SVM with na\u00efve Bayes feature embedding","volume":"103","author":"Gu","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"3855","DOI":"10.1109\/TITS.2024.3510678","article-title":"GRNN Model with Feedback Mechanism Incorporating kkk-Nearest Neighbor and Modified Gray Wolf Optimization Algorithm in Intelligent Transportation","volume":"26","author":"Wu","year":"2024","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1186\/s40537-024-00886-w","article-title":"Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction","volume":"11","author":"Talukder","year":"2024","journal-title":"J. Big Data"},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Cai, M., Zhan, J., Zhang, C., and Liu, Q. (2024). Fusion k-means clustering and multi-head self-attention mechanism for a multivariate time prediction model with feature selection. Int. J. Mach. Learn. Cybern., 1\u201319.","DOI":"10.1007\/s13042-024-02490-z"},{"key":"ref_47","first-page":"125705","article-title":"Long-term multivariate time series forecasting model based on Gaussian fuzzy information granules","volume":"263","author":"Zhu","year":"2024","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"125705","DOI":"10.1016\/j.eswa.2024.125705","article-title":"A cost-minimized two-stage three-way dynamic consensus mechanism for social network-large scale group decision-making: Utilizing K-nearest neighbors for incomplete fuzzy preference relations","volume":"263","author":"Zhan","year":"2025","journal-title":"Expert Syst. Appl."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/3\/421\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:50:50Z","timestamp":1760028650000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/3\/421"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,11]]},"references-count":48,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2025,3]]}},"alternative-id":["sym17030421"],"URL":"https:\/\/doi.org\/10.3390\/sym17030421","relation":{},"ISSN":["2073-8994"],"issn-type":[{"type":"electronic","value":"2073-8994"}],"subject":[],"published":{"date-parts":[[2025,3,11]]}}}