A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks

• URL: http://arxiv.org/abs/2608.16769v1
• Date: Mon, 17 Aug 2026 16:18:15 GMT
• Title: A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks
• Abstract summary: This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in resource-constrained environments.<n>The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component.<n>The hybrid model is evaluated on three real-world benchmark DDoS datasets.
• Score: 1.202468381202799
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Operational technology (OT) environments, including programmable logic controllers (PLCs), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems, are increasingly targeted by distributed denial-of-service (DDoS) attacks. This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments. The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component. The symbolic component alone provides a compact, interpretable rule set, while the fusion combines the strengths of both paradigms. The hybrid model is evaluated on three real-world benchmark DDoS datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. A unified comprehensive preprocessing pipeline including label mapping, numerical feature selection, robust scaling, and class balancing is applied. The fusion weight alpha and decision threshold are jointly optimised on validation data to maximise F1-score. The hybrid model attains 99.04% accuracy (MCC 0.97) on CIC-DDoS2019 and 98.61% accuracy (MCC 0.76) on CICIoT23, in both cases reducing the FNR below that of the pure-neural and pure-symbolic baselines; on the linearly separable Edge-IIoTset the shallow decision tree alone already reaches 100%, so this benchmark validates the preprocessing pipeline rather than the fusion. The principal gain of the fusion is a lower FNR at a controlled false-positive cost, which matters in operational technology, where a missed attack is more damaging than a false alarm. Model-only inference latency is sub-millisecond (0.58-0.79 milliseconds per sample) on a standard central processing unit; including on-device flow-feature extraction, the end-to-end path remains within a single-digit-millisecond budget, which is compatible with OT control-loop timing.

Related papers

• Privacy-Preserving Federated Temporal Graph Learning with Digital Twin--Guided Adaptive Deception for Cyber-Resilient IoMT [0.6095710009266794]
  This paper presents the Federated Temporal Graph Convolutional Network with Advantage Actor-Critic (Federated TGCN-A2C)<n>The framework achieves 99.48% and 99.61% test accuracy with weighted-F1 scores of 0.9948 and 0.9961, converging within 25 and 10 federated rounds, outperforming Fed-Inforce-Fusion by 0.21 percentage points while covering three additional attack categories.<n>Post-hoc explainability via SHAP, LIME, Grad-CAM, and counterfactual analysis confirms decisions are grounded in semantically meaningful flow features, supporting regulatory accountability in clinical deployments.
  arXiv  Detail & Related papers  (2026-06-19T15:09:38Z)
• A Task-Agnostic Algebraic Integrity Metric for Event-Camera Streams Toward SOTIF-Compliant Perception using Pearson Correlation Coefficient [0.0]
  Event cameras offer low-latency sensing for safety-critical perception in automated driving systems.<n>No task-agnostic quality metric currently operates directly on the asynchronous event stream.<n>This work proposes a unified framework that lifts the Pearson Correlation Coefficient (PCC) to the three standard event representations.
  arXiv  Detail & Related papers  (2026-05-08T12:54:23Z)
• Towards Trustworthy 6G Network Digital Twins: A Framework for Validating Counterfactual What-If Analysis in Edge Computing Resources [0.5921052011710383]
  Network Digital Twins (NDTs) enable safe what-if analysis for 6G cloud-edge infrastructures.<n>We present a data-driven NDT framework that extends 6G-TWIN with a scalable pipeline for cloud-edge telemetry aggregation.
  arXiv  Detail & Related papers  (2026-04-16T08:49:32Z)
• Cloud-OpsBench: A Reproducible Benchmark for Agentic Root Cause Analysis in Cloud Systems [51.2882705779387]
  Cloud-OpsBench is a large-scale benchmark that employs a State Snapshot Paradigm to construct a deterministic digital twin of the cloud.<n>It features 452 distinct fault cases across 40 root cause types spanning the full stack.
  arXiv  Detail & Related papers  (2026-02-28T05:04:42Z)
• Decentralized Multi-Agent Swarms for Autonomous Grid Security in Industrial IoT: A Consensus-based Approach [0.0]
  DMAS agents communicate via a lightweight peer-to-peer protocol to cooperatively detect anomalous behavior.<n>Agents vote on the threat level of an identified threat, enabling instant quarantine of a compromised node or nodes.<n> DMAS demonstrated sub-millisecond response times, 97.3% accuracy in detecting malicious activity under high load, and 87% accuracy in detecting zero-day attacks.
  arXiv  Detail & Related papers  (2026-01-24T04:25:36Z)
• SKANet: A Cognitive Dual-Stream Framework with Adaptive Modality Fusion for Robust Compound GNSS Interference Classification [47.20483076887704]
  Global Navigation Satellite Systems (GNSS) face growing threats from sophisticated jamming interference.<n>We propose a cognitive deep learning framework built upon a dual-stream architecture that integrates Time-Frequency Images (TFIs) and Power Spectral Density (PSD)<n>We show that SKANet achieves an overall accuracy of 96.99%, exhibiting superior robustness for compound jamming classification.
  arXiv  Detail & Related papers  (2026-01-19T07:42:45Z)
• HiFiNet: Hierarchical Fault Identification in Wireless Sensor Networks via Edge-Based Classification and Graph Aggregation [11.108171977551619]
  HiFiNet is a hierarchical fault identification framework for wireless networks.<n>It produces more accurate predictions by capturing both local temporal patterns and network-wide spatial dependencies.<n>It significantly outperforms existing methods in accuracy, F1-score, and precision.
  arXiv  Detail & Related papers  (2025-11-06T16:15:19Z)
• Targeted Deep Architectures: A TMLE-Based Framework for Robust Causal Inference in Neural Networks [41.07059178065932]
  We propose Targeted Deep Architectures (TDA), a new framework that embeds Targeted Likelihood Estimation (TMLE) directly into the network's parameter space.<n>TDA partitions model parameters and iteratively updates them along a targeting gradient.<n>This procedure yields plug-in estimates that remove first-order bias and produce valid confidence intervals.
  arXiv  Detail & Related papers  (2025-07-16T17:24:06Z)
• VAE-based Feature Disentanglement for Data Augmentation and Compression in Generalized GNSS Interference Classification [42.14439854721613]
  We propose variational autoencoders (VAEs) for disentanglement to extract essential latent features that enable accurate classification of interferences.<n>Our proposed VAE achieves a data compression rate ranging from 512 to 8,192 and achieves an accuracy up to 99.92%.
  arXiv  Detail & Related papers  (2025-04-14T13:38:00Z)
• 10K is Enough: An Ultra-Lightweight Binarized Network for Infrared Small-Target Detection [48.074211420276605]
  Binarized neural networks (BNNs) are distinguished by their exceptional efficiency in model compression.<n>We propose the Binarized Infrared Small-Target Detection Network (BiisNet)<n>BiisNet preserves the core operations of binarized convolutions while integrating full-precision features into the network's information flow.
  arXiv  Detail & Related papers  (2025-03-04T14:25:51Z)
• End-to-End Convolutional Activation Anomaly Analysis for Anomaly Detection [41.94295877935867]
  End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) We propose an End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) It is a significant extension of A$3$ anomaly detection approach proposed by Sperl, Schulze and B"ottinger.
  arXiv  Detail & Related papers  (2024-11-21T10:22:50Z)
• Higher Performance Visual Tracking with Dual-Modal Localization [106.91097443275035]
  Visual Object Tracking (VOT) has synchronous needs for both robustness and accuracy. We propose a dual-modal framework for target localization, consisting of robust localization suppressingors via ONR and the accurate localization attending to the target center precisely via OFC.
  arXiv  Detail & Related papers  (2021-03-18T08:47:56Z)
• Adaptive Subcarrier, Parameter, and Power Allocation for Partitioned Edge Learning Over Broadband Channels [69.18343801164741]
  partitioned edge learning (PARTEL) implements parameter-server training, a well known distributed learning method, in wireless network. We consider the case of deep neural network (DNN) models which can be trained using PARTEL by introducing some auxiliary variables.
  arXiv  Detail & Related papers  (2020-10-08T15:27:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.