Hybrid CNN–LSTM Framework for DDoS Detection in 5G-Enabled IoT Environments
DOI:
https://doi.org/10.31185/wjps.907Keywords:
DDoS detection,, 5G-enabled IoT, CNN–LSTM, deep learning, intrusion detectionAbstract
The increasing deployment of 5G-based Internet of Things (IoT) infrastructure brings about unparalleled opportunities and the exacerbated threat of malicious Distributed Denial-of-Service (DDoS) attacks. Conventional signature-based or static rule-based intrusion detection systems are still inadequate for the dynamic and high-volume traffic in such systems. In order to address these issues, in this paper, we propose a hybrid model with CNN and LSTM. The network features spatial correlations, which are captured by the CNN layers, and the LSTM units learn sequential dependencies for detecting attack behavior evolution. Experimental evaluations performed on the CICDDoS2019 and BoT-IoT datasets show how each module helps, leading to an overall detection accuracy of more than 99% and low false positive rates, and classification latency in real time, 19.5 ms for CICDDoS2019 and 13.6 ms for BoT-IoT), comparisons to relevant existing machine and deep learning baselines establish the trade-off made between accuracy, scalability and practical deployment efficiency. The results show that the proposed model is a suitable and practical choice for protecting 5G-enabled IoT systems against DDoS attacks.
References
[1] J. Azevedo and M. J. C. S. Reis, “Addressing Cybersecurity Challenges in 5G-Enabled IoT Networks: Solutions and Future Directions,” in Proc. 4th Int. Conf. Innovations in Computing Research (ICR’25), K. Daimi and A. Alsadoon, Eds., Lecture Notes in Networks and Systems, vol. 1487. Cham, Switzerland: Springer, 2025. DOI: https://doi.org/10.1007/978-3-031-95652-2_15
[2] R. Alqura’n, M. AlJamal, I. Al-Aiash, A. Alsarhan, B. Khassawneh, M. Aljaidi, and R. Alanazi, “Advancing XSS Detection in IoT over 5G: A Cutting-Edge Artificial Neural Network Approach,” IoT, vol. 5, no. 3, pp. 478–508, 2024. doi: 10.3390/iot5030022 DOI: https://doi.org/10.3390/iot5030022
[3] H. Asad, S. Adhikari, and I. Gashi, “A perspective–retrospective analysis of diversity in signature-based open-source network intrusion detection systems,” Int. J. Inf. Secur., vol. 23, pp. 1331–1346, 2024. doi: 10.1007/s10207-023-00794-9 DOI: https://doi.org/10.1007/s10207-023-00794-9
[4] H. Sadia et al., "Intrusion Detection System for Wireless Sensor Networks: A Machine Learning Based Approach," in IEEE Access, vol. 12, pp. 52565-52582, 2024, doi: 10.1109/ACCESS.2024.3380014. DOI: https://doi.org/10.1109/ACCESS.2024.3380014
[5] S. Alsudani, H. Nasrawi, M. Shattawi, and A. Ghazikhani, “Enhancing Spam Detection: A Crow-Optimized FFNN with LSTM for Email Security”, WJCMS, vol. 3, no. 1, pp. 28–39, Mar. 2024, doi: 10.31185/wjcms.199. DOI: https://doi.org/10.31185/wjcms.199
[6] A. Momand, S. U. Jan, and N. Ramzan, “ABCNN-IDS: Attention-Based Convolutional Neural Network for Intrusion Detection in IoT Networks,” Wireless Pers. Commun., vol. 136, pp. 1981–2003, 2024. doi: 10.1007/s11277-024-11260-7 DOI: https://doi.org/10.1007/s11277-024-11260-7
[7] A. K. B. Arnob, M. F. Mridha, M. Safran, et al., “An Enhanced LSTM Approach for Detecting IoT-Based DDoS Attacks Using Honeypot Data,” Int. J. Comput. Intell. Syst., vol. 18, p. 19, 2025. doi: 10.1007/s44196-025-00741-7 DOI: https://doi.org/10.1007/s44196-025-00741-7
[8] M. Ali, M. Shahroz, M. F. Mushtaq, S. Alfarhood, M. Safran and I. Ashraf, "Hybrid Machine Learning Model for Efficient Botnet Attack Detection in IoT Environment," in IEEE Access, vol. 12, pp. 40682-40699, 2024, doi: 10.1109/ACCESS.2024.3376400. DOI: https://doi.org/10.1109/ACCESS.2024.3376400
[9] S. W. A. Alsudani and Ghassan Khudair Saud, “Recurrent Neural Network Optimized by Grasshopper for Accurate Audio Data-Based Diagnosis of Parkinson’s Disease”, wjps, vol. 4, no. 2, pp. 56–75, Jun. 2025, doi: 10.31185/wjps.766. DOI: https://doi.org/10.31185/wjps.766
[10] A. Hirsi, L. Audah, A. Salh, M. A. Alhartomi and S. Ahmed, "Detecting DDoS Threats Using Supervised Machine Learning for Traffic Classification in Software Defined Networking," in IEEE Access, vol. 12, pp. 166675-166702, 2024, doi: 10.1109/ACCESS.2024.3486034. DOI: https://doi.org/10.1109/ACCESS.2024.3486034
[11] C. Hamroun, A. Fladenmuller, M. Pariente and G. Pujolle, "Intrusion Detection in 5G and Wi-Fi Networks: A Survey of Current Methods, Challenges, and Perspectives," in IEEE Access, vol. 13, pp. 40950-40976, 2025, doi: 10.1109/ACCESS.2025.3546338. DOI: https://doi.org/10.1109/ACCESS.2025.3546338
[12] M. AlJamal, R. Alquran, A. Alsarhan, M. Aljaidi, M. Alhmmad, W. Q. Al-Jamal, and N. Albalawi, “A Robust Machine Learning Model for Detecting XSS Attacks on IoT over 5G Networks,” Future Internet, vol. 16, no. 12, p. 482, 2024. doi: 10.3390/fi16120482 DOI: https://doi.org/10.3390/fi16120482
[13] A. Kaissar, A. B. Nassif, B. Soudan, and M. Injadat, “Enhancing CNN-based network intrusion detection through hyperparameter optimization,” Intelligent Systems with Applications, vol. 26, p. 200528, 2025. doi: 10.1016/j.iswa.2025.200528 DOI: https://doi.org/10.1016/j.iswa.2025.200528
[14] S. Alsudani and M. Nafea Saeea, “Enhancing Thyroid Disease Diagnosis through Emperor Penguin Optimization Algorithm”, wjps, vol. 2, no. 4, pp. 66–79, Dec. 2023, doi: 10.31185/wjps.230. DOI: https://doi.org/10.31185/wjps.230
[15] B. Assadhan, A. Bashaiwth and H. Binsalleeh, "Enhancing Explanation of LSTM-Based DDoS Attack Classification Using SHAP With Pattern Dependency," in IEEE Access, vol. 12, pp. 90707-90725, 2024, doi: 10.1109/ACCESS.2024.3421299. DOI: https://doi.org/10.1109/ACCESS.2024.3421299
[16] N. U. Ain, M. Sardaraz, M. Tahir, M. W. Abo Elsoud, and A. Alourani, “Securing IoT Networks Against DDoS Attacks: A Hybrid Deep Learning Approach,” Sensors, vol. 25, no. 5, p. 1346, 2025. doi: 10.3390/s25051346 DOI: https://doi.org/10.3390/s25051346
[17] S. W. A. Alsudani, M.-R. Feizi-Derakhshi, W. G. Mutasher, H. A. M. Nasrawi, M. A. Aswad, A. S. K. Al-Shammari, M. Saleh, M. N. Saeea, K. A. F. Al Hilfi, and S. M. Albkhati, “Enhancing IoT intrusion detection through a hybrid deep learning model with dragonfly-based feature and ensemble optimization,” Int. J. Commun. Netw. Inf. Secur., vol. 17, no. 5, pp. 1–15, May 2025.
[18] A. Abualhassan, I. Rashid, F. Binbeshr and M. Imam, "DDoS Attack Detection in IoT: A Comparative Resource and Performance Analysis of Deep Learning and Machine Learning Models," in IEEE Access, vol. 13, pp. 116529-116547, 2025, doi: 10.1109/ACCESS.2025.3583855. DOI: https://doi.org/10.1109/ACCESS.2025.3583855
[19] S. N. Rasool, V. G. G, S. Chutke, P. K. Lendale, E. N. V. P. C. Rao and M. Akku, "A Hybrid CNN-LSTM Deep Learning Model for Next-Generation OFDM Channel Estimation in Wireless Networks," 2025 3rd International Conference on Self Sustainable Artificial Intelligence Systems (ICSSAS), Erode, India, 2025, pp. 430-436, doi: 10.1109/ICSSAS66150.2025.11081069. DOI: https://doi.org/10.1109/ICSSAS66150.2025.11081069
[20] H. A. Sakr, M. I. El-Afifi, M. A. El-Mowafy, et al., “Detecting DDoS threats in IoT-driven 6G-energy hubs networks using machine learning algorithms,” Discov. Appl. Sci., vol. 7, p. 1002, 2025. doi: 10.1007/s42452-025-06716-9 DOI: https://doi.org/10.1007/s42452-025-06716-9
[21] S. Cheekati, C. R. Borra, P. K. Pareek, R. V. Rayala, S. S. N. Kowsalya and J. Selvam, "Cybersecurity Threat Detection Using OpCyNet and DBRA: A Deep Learning Approach for DDoS Attack Mitigation on CICDDoS2019," 2025 13th International Conference on Smart Grid (icSmartGrid), Glasgow, United Kingdom, 2025, pp. 782-788, doi: 10.1109/icSmartGrid66138.2025.11071797. DOI: https://doi.org/10.1109/icSmartGrid66138.2025.11071797
[22] J. Ashraf, G. M. Raza, B.-S. Kim, A. Wahid, and H.-Y. Kim, “Making a Real-Time IoT Network Intrusion-Detection System (INIDS) Using a Realistic BoT–IoT Dataset with Multiple Machine-Learning Classifiers,” Applied Sciences, vol. 15, no. 4, p. 2043, 2025. doi: 10.3390/app15042043 DOI: https://doi.org/10.3390/app15042043
[23] R. Dwi Prayogo, N. Hamid and H. Nambo, "Hybrid CNN-Based Transfer Learning Enhances Brain Tumor Classification on MRI Images," in IEEE Access, vol. 13, pp. 116654-116668, 2025, doi: 10.1109/ACCESS.2025.3584376. DOI: https://doi.org/10.1109/ACCESS.2025.3584376
[24] A. Singh, H. Kaur, and N. Kaur, “A novel DDoS detection and mitigation technique using hybrid machine learning model and redirect illegitimate traffic in SDN network,” Cluster Comput., vol. 27, pp. 3537–3557, 2024. doi: 10.1007/s10586-023-04152-1 DOI: https://doi.org/10.1007/s10586-023-04152-1
[25] A. A. Alshdadi, A. A. Almazroi, N. Ayub, M. D. Lytras, E. Alsolami, and F. S. Alsubaei, “Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection,” Future Internet, vol. 16, no. 12, p. 458, 2024. doi: 10.3390/fi16120458 DOI: https://doi.org/10.3390/fi16120458
[26] M. F. Saiyed and I. Al-Anbagi, "A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks," in IEEE Access, vol. 12, pp. 25623-25641, 2024, doi: 10.1109/ACCESS.2024.3367357. DOI: https://doi.org/10.1109/ACCESS.2024.3367357
[27] Y. Alhasawi and S. Alghamdi, "Federated Learning for Decentralized DDoS Attack Detection in IoT Networks," in IEEE Access, vol. 12, pp. 42357-42368, 2024, doi: 10.1109/ACCESS.2024.3378727. DOI: https://doi.org/10.1109/ACCESS.2024.3378727
[28] M. H. Ali, M. M. Jaber, S. K. Abd, A. Rehman, M. J. Awan, R. Damaševičius, and S. A. Bahaj, “Threat analysis and distributed denial of service (DDoS) attack recognition in the Internet of Things (IoT),” Electronics, vol. 11, no. 3, p. 494, Feb. 2022. DOI: https://doi.org/10.3390/electronics11030494
[29] I. Ortega-Fernandez, M. Sestelo, J. C. Burguillo, et al., “Network intrusion detection system for DDoS attacks in ICS using deep autoencoders,” Wireless Netw., vol. 30, pp. 5059–5075, 2024. doi: 10.1007/s11276-022-03214-3 DOI: https://doi.org/10.1007/s11276-022-03214-3
[30] R. F. Kapourchali, R. Mohammadi, and M. Nassiri, “P4httpGuard: detection and prevention of slow-rate DDoS attacks using machine learning techniques in P4 switch,” Cluster Comput., vol. 27, pp. 8047–8064, 2024. doi: 10.1007/s10586-024-04407-5 DOI: https://doi.org/10.1007/s10586-024-04407-5
[31] S. A. Abdulkareem, C. Heng Foh, M. Shojafar, F. Carrez and K. Moessner, "Network Intrusion Detection: An IoT and Non IoT-Related Survey," in IEEE Access, vol. 12, pp. 147167-147191, 2024, doi: 10.1109/ACCESS.2024.3473289. DOI: https://doi.org/10.1109/ACCESS.2024.3473289
[32] H. A. Sakr, M. M. Fouda, A. F. Ashour, A. Abdelhafeez, M. I. El-Afifi, and M. R. Abdellah, “Machine learning-based detection of DDoS attacks on IoT devices in multi-energy systems,” Egyptian Informatics Journal, vol. 28, p. 100540, 2024. doi: 10.1016/j.eij.2024.100540 DOI: https://doi.org/10.1016/j.eij.2024.100540
[33] O. Polat, A. Ayid Ahmad, S. Oyucu, E. Algül, F. Doğan and A. Aksöz, "Temporal-Spatial Feature Extraction in IoT-Based SCADA System Security: Hybrid CNN-LSTM and Attention-Based Architectures for Malware Classification and Attack Detection," in IEEE Access, vol. 13, pp. 102109-102132, 2025, doi: 10.1109/ACCESS.2025.3577761. DOI: https://doi.org/10.1109/ACCESS.2025.3577761
[34] Saif Wali Ali Alsudani and Adel Ghazikhani, “Enhancing Intrusion Detection with LSTM Recurrent Neural Network Optimized by Emperor Penguin Algorithm”, WJCMS, vol. 2, no. 3, pp. 69–80, Sep. 2023, doi: 10.31185/wjcms.166. DOI: https://doi.org/10.31185/wjcms.166
[35] O. Adeniyi, A. S. Sadiq, P. Pillai, M. Aljaidi, and O. Kaiwartya, “Securing Mobile Edge Computing Using Hybrid Deep Learning Method,” Computers, vol. 13, no. 1, p. 25, 2024. doi: 10.3390/computers13010025 DOI: https://doi.org/10.3390/computers13010025
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Noor Alyassiri, Mohammed Mahdi Salih Altufaili, Fatima Adel Nama
This work is licensed under a Creative Commons Attribution 4.0 International License.
