I
AE
S
I
n
t
e
r
n
at
ion
al
Jou
r
n
al
of
Ar
t
if
icial
I
n
t
e
ll
ig
e
n
c
e
(
I
J
-
AI
)
Vol.
14
,
No.
4
,
Augus
t
2025
,
pp.
3109
~
3120
I
S
S
N:
2252
-
8938
,
DO
I
:
10
.
11591/i
jai
.
v
14
.i
4
.
pp
31
09
-
3120
3109
Jou
r
n
al
h
omepage
:
ht
tp:
//
ij
ai
.
iaes
c
or
e
.
c
om
Fe
d
e
r
at
e
d
d
e
e
p
l
e
ar
n
in
g
in
t
r
u
si
on
d
e
t
e
c
t
io
n
syste
m
on
sof
t
w
ar
e
d
e
f
i
n
e
d
-
n
e
t
w
or
k
b
ase
d
in
t
e
r
n
e
t
of
t
h
in
gs
Heba
Dhi
r
ar
,
Al
i
H
.
Ha
m
ad
D
e
pa
r
tm
e
nt
of
I
nf
or
ma
ti
on
a
nd
C
omm
uni
c
a
ti
on
s
E
ngi
ne
e
r
in
g,
Al
-
K
hw
a
r
iz
mi
C
ol
le
ge
of
E
ngi
ne
e
r
in
g
,
U
ni
ve
r
s
it
y of
B
a
ghda
d
,
B
a
ghda
d,
I
r
a
q
Ar
t
icle
I
n
f
o
AB
S
T
RA
CT
A
r
ti
c
le
h
is
tor
y
:
R
e
c
e
ived
Oc
t
4,
2024
R
e
vis
e
d
J
a
n
29,
2025
Ac
c
e
pted
M
a
r
15,
2025
The
i
n
t
ern
e
t
of
t
h
i
n
g
s
(I
o
T
)
a
n
d
s
o
ft
w
are
-
d
ef
i
n
e
d
n
e
t
w
o
r
k
s
(S
D
N
)
p
l
ay
a
s
i
g
n
i
f
i
ca
n
t
ro
l
e
in
en
h
an
c
i
n
g
effi
ci
e
n
cy
an
d
p
ro
d
u
c
t
i
v
i
t
y
.
H
o
w
ev
er,
t
h
ey
en
co
u
n
t
er
p
o
s
s
i
b
l
e
ri
s
k
s
.
A
r
t
i
f
i
ci
a
l
i
n
t
e
l
l
i
g
e
n
ce
(A
I)
h
as
recen
t
l
y
b
een
emp
l
o
y
e
d
in
i
n
t
ru
s
i
o
n
d
e
t
ect
i
o
n
s
y
s
t
ems
(ID
S
s
),
s
erv
i
n
g
as
an
i
m
p
o
r
t
an
t
i
n
s
t
ru
m
en
t
fo
r
i
mp
r
o
v
i
n
g
s
ecu
r
i
t
y
.
N
e
v
ert
h
el
e
s
s
,
t
h
e
n
e
ces
s
i
t
y
to
s
t
o
re
d
a
t
a
on
a
ce
n
t
ra
l
i
ze
d
s
er
v
er
p
o
s
es
a
p
o
t
en
t
i
a
l
t
h
rea
t
.
Fed
erat
ed
l
earn
i
n
g
(FL
)
ad
d
re
s
s
e
s
t
h
i
s
p
r
o
b
l
em
by
t
rai
n
i
n
g
mo
d
el
s
l
o
ca
l
l
y
.
In
t
h
i
s
w
o
r
k
,
a
n
et
w
o
rk
i
n
t
ru
s
i
o
n
d
e
t
ect
i
o
n
s
y
s
t
em
(N
I
D
S)
is
i
mp
l
eme
n
t
e
d
on
m
u
l
t
i
-
c
o
n
t
ro
l
l
er
SD
N
-
b
as
e
d
Io
T
n
e
t
w
o
rk
s
.
The
i
n
t
er
p
l
a
n
et
ar
y
fi
l
e
s
y
s
t
em
(
IPFS)
FL
h
as
b
een
emp
l
o
y
e
d
to
s
h
are
an
d
t
rai
n
d
ee
p
l
ear
n
i
n
g
(D
L
)
mo
d
el
s
.
Sev
eral
cl
i
en
t
s
p
art
i
ci
p
at
e
d
in
the
t
rai
n
i
n
g
p
r
o
ces
s
u
s
i
n
g
c
u
s
t
o
m
g
e
n
era
t
ed
d
at
a
s
et
Io
T
-
SD
N
by
t
ra
i
n
i
n
g
t
h
e
mo
d
el
l
o
ca
l
l
y
an
d
s
h
ari
n
g
t
h
e
p
arame
t
ers
in
an
e
n
cry
p
t
e
d
fo
rmat
,
i
m
p
ro
v
i
n
g
t
h
e
o
v
eral
l
effect
i
v
e
n
es
s
,
s
afe
t
y
,
an
d
s
ec
u
ri
t
y
of
t
h
e
n
et
w
o
r
k
.
The
mo
d
el
h
as
s
u
cces
s
fu
l
l
y
i
d
en
t
i
f
i
ed
s
ev
er
al
t
y
p
es
of
at
t
ac
k
s
,
i
n
c
l
u
d
i
n
g
d
i
s
t
ri
b
u
t
ed
d
e
n
i
a
l
of
s
erv
i
ce
(D
D
o
S),
d
en
i
al
o
f
s
erv
i
ce
(D
o
S)
,
b
o
t
n
e
t
,
b
ru
t
e
f
o
rce,
ex
p
l
o
i
t
a
t
i
o
n
,
mal
w
are,
p
ro
b
e,
w
eb
-
b
a
s
ed
,
s
p
o
o
f
i
n
g
,
reco
n
,
an
d
ach
i
e
v
i
n
g
an
accu
rac
y
of
9
9
.
8
9
%
an
d
a
l
o
s
s
of
0
.
0
0
5
.
K
e
y
w
o
r
d
s
:
F
e
de
r
a
ted
de
e
p
lea
r
ning
I
nter
ne
t
of
thi
ngs
I
nter
plane
tar
y
f
il
e
s
ys
tem
I
ntr
us
ion
de
tec
ti
on
s
ys
tem
S
of
twa
r
e
-
de
f
ined
ne
twor
k
Th
i
s
is
an
o
p
en
a
c
ces
s
a
r
t
i
c
l
e
u
n
d
e
r
the
CC
BY
-
SA
l
i
ce
n
s
e.
C
or
r
e
s
pon
din
g
A
u
th
or
:
He
ba
Dh
i
r
a
r
D
e
p
a
r
t
men
t
of
I
n
f
o
r
mat
i
on
a
nd
C
o
mm
un
ica
t
io
n
s
E
n
g
ine
e
r
i
ng
,
Al
-
K
hw
a
r
iz
m
i
C
o
ll
e
g
e
o
f
E
n
g
ine
e
r
i
ng
U
n
ive
r
s
it
y
o
f
B
a
g
hd
a
d
J
a
dr
iaa
,
B
a
ghda
d,
I
r
a
q
E
mail:
he
ba
.
d@ke
c
bu.
uoba
ghda
d.
e
du
.
iq
1.
I
NT
RODU
C
T
I
ON
T
he
ter
m
"
int
e
r
ne
t
of
thi
ng
s
(
I
o
T
)
"
r
e
f
e
r
s
to
c
onn
e
c
ti
ng
e
mbedde
d
de
vice
s
to
the
int
e
r
ne
t
.
T
he
idea
be
hind
the
I
oT
is
to
e
na
ble
e
ve
r
yda
y
i
tems
to
be
c
onne
c
ted
ove
r
the
ne
twor
k
a
nd
ga
the
r
va
s
t
a
mount
s
of
da
ta
f
r
om
de
vice
s
with
dif
f
e
r
e
nt
powe
r
s
a
nd
li
mi
ted
r
e
s
our
c
e
s
;
he
nc
e
,
e
nf
or
c
ing
s
e
c
ur
it
y
a
nd
pr
otec
ti
o
n
can
be
c
ha
ll
e
nging
[
1]
.
Ne
two
r
k
tr
a
f
f
ic
a
na
lys
is
a
nd
a
bnor
mal
a
c
ti
vit
y
identif
ica
ti
on
a
r
e
r
e
s
our
c
e
-
int
e
ns
ive
tas
ks
.
Ove
r
the
las
t
s
e
ve
r
a
l
ye
a
r
s
,
s
e
ve
r
a
l
li
gh
twe
ight
a
ppr
oa
c
he
s
f
or
im
pr
oving
I
o
T
s
e
c
ur
it
y
ha
ve
be
e
n
c
r
e
a
ted
[
2]
,
[
3]
,
but
thes
e
s
ys
tems
a
r
e
una
ble
to
ha
ndle
the
s
igni
f
ica
nt
s
e
c
ur
it
y
r
is
ks
that
ha
ve
be
e
n
dis
c
ove
r
e
d
late
ly.
He
nc
e
,
it
is
im
pe
r
a
ti
ve
to
de
s
ign
e
f
f
e
c
ti
ve
in
tr
us
i
on
de
tec
ti
on
to
e
f
f
icie
ntl
y
de
f
e
nd
a
ga
in
st
va
r
ious
f
or
ms
of
a
tt
a
c
ks
.
I
ntr
us
ion
de
tec
ti
on
s
ys
tem
(
I
DS)
pe
r
f
or
m
s
an
e
s
s
e
nti
a
l
pa
r
t
as
the
pr
im
a
r
y
de
f
e
ns
e
mec
h
a
nis
m
[
4]
whic
h
e
mpl
oys
many
a
ppr
oa
c
he
s
to
identif
y
a
nd
f
lag
a
bnor
malit
ies
.
S
ign
if
ica
nt
a
dva
nc
e
ments
ha
ve
be
e
n
a
c
hieve
d
us
ing
mac
hine
lea
r
ning
(
M
L
)
a
nd
de
e
p
lea
r
ning
(
DL
)
in
r
e
c
e
nt
ye
a
r
s
,
r
e
s
ult
ing
in
wide
s
pr
e
a
d
us
e
a
c
r
os
s
s
e
ve
r
a
l
domains
.
It
can
of
f
e
r
tec
hniques
to
identif
y
va
r
ious
f
or
ms
of
a
tt
a
c
k
without
the
ne
e
d
f
or
s
igni
f
ica
nt
human
invol
ve
ment
.
W
hil
e
thes
e
methods
ha
ve
pr
ove
n
e
f
f
e
c
ti
ve
f
or
I
DS
,
they
of
ten
ne
e
d
a
c
e
ntr
a
li
z
e
d
s
e
r
ve
r
to
a
na
lyze
the
da
ta
ga
ther
e
d
f
r
o
m
a
ll
ne
twor
k
us
e
r
s
.
F
e
de
r
a
ted
lea
r
ning
(
F
L
)
is
a
mea
ns
to
im
pleme
nt
on
-
de
vice
lea
r
ning
while
pr
e
s
e
r
ving
da
t
a
pr
ivac
y
[
5
]
–
[
7]
.
FL
is
an
it
e
r
a
ti
ve
p
r
oc
e
dur
e
in
w
hich
the
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
310
9
-
3120
3110
e
nti
r
e
model
may
be
e
nha
nc
e
d
in
each
r
ound
by
tr
a
ini
ng
the
model
on
many
de
vice
s
a
nd
us
ing
th
e
ir
da
ta
ac
r
os
s
numer
ous
it
e
r
a
ti
ons
without
e
xc
ha
nging
da
ta
with
a
c
e
ntr
a
li
z
e
d
s
e
r
ve
r
a
c
hieving
pr
ivac
y
pr
e
s
e
r
va
ti
on
a
nd
c
os
t
r
e
duc
ti
on,
as
e
xpe
c
ted
in
c
onve
nti
ona
l
c
e
ntr
a
li
z
e
d
a
ppr
oa
c
he
s
[
8]
.
S
of
twa
r
e
-
de
f
ined
ne
t
wor
king
(
S
DN
)
is
an
innovative
a
r
c
hit
e
c
tur
e
that
s
e
pa
r
a
tes
ne
twor
k
c
ontr
ol
f
r
om
f
or
wa
r
ding
f
unc
ti
ons
,
e
na
bli
ng
dir
e
c
t
pr
ogr
a
mm
a
bil
it
y
of
ne
twor
k
mana
ge
ment
a
nd
e
n
ha
nc
ing
ope
r
a
ti
ona
l
e
f
f
icie
nc
y.
T
he
S
DN
ne
twor
k
uti
li
z
e
s
thes
e
a
tt
r
ibut
e
s
to
c
r
e
a
te
a
pr
oa
c
ti
ve
s
ys
tem
f
or
de
tec
ti
ng
int
r
us
ions
in
I
oT
ne
twor
ks
,
making
it
a
s
upe
r
ior
c
hoice
f
or
ove
r
c
omi
ng
the
c
ha
ll
e
nge
s
f
a
c
e
d
in
the
e
f
f
icie
nt
ope
r
a
ti
on
of
I
oT
due
to
its
pr
ogr
a
m
mabili
ty
a
nd
c
ompr
e
he
ns
ive
pe
r
s
pe
c
ti
ve
[
9]
,
[
10]
.
T
he
ne
twor
k
-
ba
s
e
d
I
DS,
r
e
f
e
r
r
e
d
to
as
ne
twor
k
i
ntr
us
ion
de
tec
ti
on
s
ys
tem
(
NI
DS
)
,
is
de
s
igned
to
de
ter
mi
ne
whe
ther
IP
tr
a
f
f
ic
is
c
ompr
o
mi
s
e
d
by
th
r
e
a
ds
.
T
he
p
r
oc
e
s
s
c
ons
is
ts
of
a
t
r
a
ini
ng
pha
s
e
uti
li
z
ing
an
a
c
c
ur
a
te
r
e
pr
e
s
e
ntation
of
r
e
c
ognize
d
a
c
ti
vit
ies
,
f
o
ll
owe
d
by
an
ope
r
a
ti
ona
l
c
las
s
if
ica
ti
on
a
nd
de
c
is
ion
pha
s
e
.
T
he
tr
a
ini
ng
a
nd
c
las
s
if
ica
ti
on
pha
s
e
s
r
e
ly
on
the
de
f
ini
ti
on
a
nd
e
xtr
a
c
ti
on
of
a
s
e
t
of
s
tatis
ti
c
a
l
pa
r
a
mete
r
s
a
s
s
oc
iate
d
with
e
a
c
h
IP
f
low,
whic
h
c
ons
ti
tut
e
th
e
s
tatis
ti
c
a
l
f
inger
pr
int
of
the
f
low
,
a
nd
on
DL
c
las
s
if
ier
s
de
s
igned
to
dif
f
e
r
e
nti
a
te
be
twe
e
n
nor
mal
a
nd
malicious
tr
a
f
f
ic.
In
thi
s
s
tudy,
FL
wa
s
uti
li
z
e
d
to
c
oope
r
a
ti
ve
ly
tr
a
in
DL
models
to
im
p
leme
nt
a
nomaly
-
ba
s
e
d
I
DS
on
a
mul
t
i
-
c
ontr
oll
e
r
S
DN
-
ba
s
e
d
I
oT
that
leve
r
a
ge
s
the
c
ha
r
a
c
ter
is
ti
c
s
of
S
DN
to
e
s
tablis
h
a
p
r
oa
c
ti
ve
s
ys
tem
f
or
de
tec
ti
ng
int
r
us
ions
in
I
o
T
ne
twor
ks
.
S
e
ve
r
a
l
c
li
e
nts
can
obtain
the
DL
model
f
r
om
the
in
ter
pl
a
ne
tar
y
f
il
e
s
ys
tem
(
I
P
F
S
)
ne
twor
k
a
nd
pa
r
ti
c
ipat
e
in
the
tr
a
ini
ng
pr
oc
e
s
s
by
tr
a
ini
ng
the
model
loca
ll
y
on
their
c
us
tom
-
ge
ne
r
a
ted
da
tas
e
t
a
nd
s
ha
r
ing
only
the
pa
r
a
mete
r
s
in
an
e
nc
r
ypted
f
or
m
us
ing
a
dva
nc
e
d
e
nc
r
ypti
on
s
tanda
r
ds
(
AE
S
)
a
lgor
it
hm.
T
his
pr
oc
e
s
s
e
nha
nc
e
s
the
ove
r
a
ll
e
f
f
icie
nc
y,
s
a
f
e
ty,
a
nd
s
e
c
ur
it
y.
T
he
model
ha
s
s
uc
c
e
s
s
f
ull
y
identif
ied
s
e
ve
r
a
l
types
of
a
tt
a
c
ks
a
c
hieving
an
a
c
c
ur
a
c
y
of
99.
89
%
a
nd
a
los
s
of
0.
005
.
T
he
r
e
s
t
of
the
pa
pe
r
is
or
ga
nize
d
a
s
f
oll
ows
:
s
e
c
t
ion
2
f
oc
us
e
s
on
I
DS
r
e
s
e
a
r
c
h
in
c
ontext
of
S
DN
a
nd
I
oT
ne
twor
ks
,
a
nd
s
e
c
ti
on
3
c
ontains
c
omp
r
e
he
ns
ive
ba
c
kgr
ound
a
na
lys
is
with
the
de
tails
of
our
c
us
tom
-
ge
ne
r
a
ted
da
tas
e
t
I
oT
-
S
DN
.
T
he
s
ugge
s
ted
methodology
is
dis
c
us
s
e
d
in
s
e
c
ti
on
4.
T
he
e
xpe
r
im
e
ntal
r
e
s
ult
s
a
nd
e
f
f
ica
c
y
of
pr
opos
e
d
method
a
r
e
pr
e
s
e
nted
in
s
e
c
ti
on
5,
whe
r
e
a
s
s
e
c
ti
on
6
ou
tl
ines
the
wor
k's
c
on
c
lus
ion.
2.
RE
L
AT
E
D
WORK
T
he
s
ubs
tantial
a
mount
of
da
ta
a
nd
the
diver
s
it
y
of
de
vice
s
make
the
s
e
c
ur
it
y
of
the
I
oT
a
s
igni
f
ica
nt
pr
oblem.
I
DSs
ha
ve
be
e
n
de
ve
loped
e
mpl
oying
v
a
r
ious
methodologi
e
s
a
nd
s
tr
a
tegie
s
to
s
e
c
ur
e
a
n
d
de
f
e
nd
I
oT
ne
twor
ks
.
S
e
ve
r
a
l
p
r
omi
ne
nt
int
r
us
ion
de
te
c
ti
on
a
lgor
it
hms
r
e
c
e
ntl
y
de
ve
loped
to
a
ddr
e
s
s
s
e
c
ur
it
y
c
ha
ll
e
nge
s
in
S
DN
a
nd
I
oT
ne
twor
ks
a
r
e
outl
ined
in
T
a
ble
1
whic
h
pr
ovides
a
s
umm
a
r
y
of
the
r
e
s
e
a
r
c
he
r
s
who
ha
ve
c
onc
e
ntr
a
ted
on
im
pleme
nti
ng
I
DS
on
th
e
S
DN
ne
twor
k.
T
a
ble
1.
S
ur
ve
y
of
the
mos
t
r
e
late
d
wor
k
of
I
D
S
s
on
the
S
DN
a
nd
I
o
T
ne
twor
ks
R
e
f
e
r
e
n
c
e
Y
e
a
r
N
e
t
w
o
r
k
D
a
t
a
s
e
t
T
e
c
hn
i
qu
e
A
c
c
ur
a
c
y
(
%
)
T
a
n
g
e
t
a
l
.
[
11]
2016
S
D
N
N
S
L
-
K
D
D
D
e
e
p
ne
u
r
a
l
ne
t
w
or
k
(
D
N
N
)
75.
7
5
A
j
a
e
i
y
a
e
t
a
l
.
[
12]
2017
S
D
N
C
us
t
o
m
R
a
ndo
m
f
o
r
e
s
t
(
R
F
)
85.
4
Ye
e
t
al
.
[
1
3]
2018
S
D
N
C
us
t
o
m
S
uppo
r
t
ve
c
t
or
m
a
c
hi
n
e
(
S
V
M
)
95.
2
4
L
a
t
a
h
a
nd
T
oke
r
[
14]
2018
S
D
N
N
S
L
-
K
D
D
D
e
c
i
s
i
o
n
t
r
e
e
71
T
a
n
g
e
t
a
l
.
[
15]
2019
S
D
N
N
S
L
-
K
D
D
G
a
t
e
r
e
c
ur
r
e
n
t
un
i
t
(
G
R
U
)
-
r
e
c
u
r
r
e
n
t
ne
u
r
a
l
n
e
t
w
or
k
(
R
N
N
)
89
B
o
p
p
a
n
a
e
t
al
.
[
16]
2019
S
D
N
N
S
L
-
K
D
D
RF
81.
9
5
H
a
n
n
a
c
h
e
a
n
d
B
a
t
o
u
c
h
e
[
1
7
]
2020
S
D
N
C
us
t
o
m
DNN
96.
1
3
L
i
m
e
t
a
l
.
[
18]
2020
S
D
N
-
I
oT
N
.
A
.
FL
-
R
F
w
i
t
h
a
c
t
o
r
-
c
r
i
t
i
c
P
P
O
N
.
A
E
l
S
a
y
e
d
e
t
a
l
.
[
19]
2021
S
D
N
I
nS
D
N
[
20]
C
onvo
l
ut
i
on
a
l
ne
ur
a
l
ne
t
w
or
ks
(
C
N
N
)
+
R
F
99.
2
8
H
a
de
m
e
t
a
l
.
[
21]
2021
S
D
N
N
S
L
-
K
D
D
S
V
M
95.
9
8
A
l
z
a
h
r
a
ni
a
n
d
A
l
e
n
a
z
i
[
22]
2021
S
D
N
N
S
L
-
K
D
D
X
G
B
oos
t
D
e
t
e
c
t
i
on
:
95
.
5
,
C
l
a
s
s
i
f
i
c
a
t
i
on:
95
.
9
5
W
a
n
i
e
t
a
l
.
[
23]
2021
S
D
N
C
S
E
-
C
I
C
-
I
D
S
20
18
I
D
S
I
oT
-
S
D
L
99.
0
5
M
oh
s
i
n
a
nd
H
a
m
a
d
[
24]
2022
S
D
N
C
us
t
o
m
RF
K
N
N
N
a
i
ve
B
a
ye
s
(
N
B
)
L
ogi
s
t
i
c
r
e
gr
e
s
s
i
o
n
(
L
R
)
R
F
:
100
K
N
N
:
99
.
9
9
-
1
00
N
B
:
7
2.
1
1
-
8
3.
5
L
R
:
59.
44
-
92
.
74
R
a
vi
e
t
al
.
[
25]
2022
S
D
N
-
I
oT
S
D
N
-
I
oT
[
26]
G
R
U
f
e
a
t
ur
e
f
us
i
on
D
e
t
e
c
t
i
on
:
99
C
l
a
s
s
i
f
i
c
a
t
i
on:
98
J
os
e
a
nd
J
o
s
e
[
2
7]
2023
I
oT
C
I
C
-
I
D
S
2017
D
N
N
;
L
S
T
M
;
C
N
N
94.
6
1;
97
.
67
;
98
.
61
L
oge
s
w
a
r
i
e
t
a
l
.
[
28]
2023
S
D
N
N
S
L
-
K
D
D
H
F
S
-
L
G
B
M
98.
7
2
C
ha
ga
n
t
i
e
t
a
l
.
[
29]
2023
S
D
N
-
I
oT
S
D
N
I
oT
-
f
oc
u
s
e
d
L
S
T
M
97.
1
M
a
d
du
a
nd
R
a
o
[
30]
2023
S
D
N
I
nS
D
N
e
dg
e
I
I
oT
DL
99.
6
5
E
l
s
a
ye
d
e
t
al
.
[
3
1]
2023
S
D
N
-
I
oT
T
oN
-
I
oT
I
nS
D
N
L
S
T
M
96.
3
5;
99
.
73
V
i
dhy
a
a
nd
N
a
g
a
r
a
j
a
n
[
32]
2024
S
D
N
-
I
oT
C
S
E
-
C
I
C
-
I
D
S
2018
;
S
D
N
-
I
oT
B
i
L
S
T
M
-
b
a
s
e
d
W
N
I
D
S
99.
9
7
-
9
9.
96
95.
1
3
-
9
2.
90
N
i
kna
m
i
a
nd
W
u
[
33]
2024
S
D
N
N
S
L
-
K
D
D
;
K
D
D
99
D
e
e
pI
D
P
S
(
C
N
N
-
L
S
T
M
+
A
M
)
92.
2
-
95
.
4
;
95
.
26
-
97
.
42
O
ur
w
o
r
k
2024
S
D
N
-
I
oT
I
oT
-
S
D
N
[
34]
FL
-
DL
99.
8
9
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
F
e
de
r
ated
de
e
p
lear
ning
int
r
us
ion
de
tec
ti
on
s
y
s
te
m
on
s
oft
w
ar
e
de
fi
ne
d
-
ne
tw
or
k
…
(
He
ba
Dhir
ar
)
3111
Aja
e
iya
et
al.
[
12]
int
r
oduc
e
d
RF
ba
s
e
d
I
DS
f
or
i
de
nti
f
ying
ne
twor
k
thr
e
a
ts
in
S
DN
.
T
he
ne
twor
k
f
e
a
tur
e
s
us
e
d
to
tr
a
in
the
model
a
nd
pr
e
dict
ne
twor
k
a
tt
a
c
ks
c
ons
is
ted
of
tupl
e
-
5,
pa
c
ke
t
c
ount,
byte
c
ount,
a
nd
pa
c
ke
t
int
e
r
a
r
r
ival
ti
me.
T
he
de
tec
ti
on
metho
d
wa
s
tes
ted
a
ga
in
s
t
many
types
of
a
tt
a
c
ks
,
including
br
ute
f
or
c
ing,
por
t
s
c
a
nning,
a
nd
f
loodi
ng
a
tt
a
c
ks
.
W
hil
e
the
r
e
s
ult
s
indi
c
a
ted
a
high
leve
l
of
a
c
c
ur
a
c
y
in
de
tec
ti
ng
a
tt
a
c
ks
us
ing
the
RF
method,
ther
e
is
a
lac
k
of
de
tailed
inf
or
mation
on
the
s
e
lec
ti
on
of
the
da
tas
e
t
f
or
a
tt
a
c
k
tr
a
f
f
ic.
T
he
r
e
f
or
e
,
thes
e
r
e
s
ult
s
may
be
s
olely
r
e
leva
nt
to
non
-
I
oT
tr
a
f
f
ic.
Ye
et
al
.
[
13]
int
r
oduc
e
d
a
dis
tr
ibut
e
d
de
nial
of
s
e
r
vice
(
DD
oS
)
a
tt
a
c
k
de
tec
ti
on
s
ys
tem
in
S
DN
that
uti
li
z
e
d
S
VM
.
T
he
f
e
a
tur
e
s
e
t
us
e
d
f
or
pr
e
dictin
g
f
loodi
ng
a
tt
a
c
ks
c
ons
is
ted
of
the
6
-
tupl
e
ne
tw
or
k
f
low
c
ha
r
a
c
ter
is
ti
c
s
.
T
he
a
uthor
s
s
tate
that
they
a
c
hi
e
ve
d
an
a
ve
r
a
ge
de
tec
ti
on
a
c
c
ur
a
c
y
r
a
te
of
95
.
24%
in
de
tec
ti
ng
us
e
r
da
tagr
a
m
pr
otocol
(
UD
P
)
f
loodi
ng
a
tt
a
c
ks
.
How
e
ve
r
,
the
a
tt
a
c
k
tr
a
f
f
ic
c
r
e
a
ted
with
th
e
hping3
tool
is
not
s
uit
a
ble
f
or
ge
ne
r
a
ti
ng
I
o
T
tr
a
f
f
ic.
L
a
tah
a
nd
T
oke
r
[
14]
c
onduc
ted
a
c
ompar
is
on
of
s
e
ve
r
a
l
s
upe
r
vis
e
d
ML
methods
f
or
a
nomaly
-
ba
s
e
d
int
r
us
ion
de
tec
ti
on
in
S
DN
s
.
T
he
a
uthor
s
s
tate
d
that
the
de
c
is
ion
tr
e
e
a
lgor
it
hm
ob
taine
d
a
higher
a
c
c
ur
a
c
y
of
99.
7
%
whe
n
the
ne
twor
k
s
e
c
ur
it
y
labor
a
to
r
y
(
N
S
L
)
-
KDD
da
tas
e
t
c
ha
r
a
c
ter
is
ti
c
s
we
r
e
uti
li
z
e
d
as
i
nput
f
or
c
ompar
ing
ML
de
tec
ti
on
models
.
How
e
ve
r
,
the
dis
ti
nc
ti
ve
c
ha
r
a
c
ter
is
ti
c
s
of
S
DN
f
o
r
de
tec
ti
ng
a
nomalies
s
hould
be
take
n
int
o
a
c
c
ount.
Ne
ve
r
thele
s
s
,
the
NSL
-
KDD
da
ta
s
e
t
wa
s
s
pe
c
if
ica
ll
y
c
r
e
a
ted
to
a
s
s
e
s
s
a
nd
identif
y
tr
a
dit
ional
ne
twor
k
tr
a
f
f
ic,
r
a
ther
than
f
oc
us
ing
on
the
c
a
pa
bil
it
ies
of
S
DN
.
B
oppa
na
et
al
.
[
16]
c
onduc
ted
a
c
ompar
is
on
of
ML
a
lgor
it
hms
us
ing
va
r
ious
f
e
a
tur
e
s
e
lec
ti
on
methods
in
the
S
DN
a
nomaly
de
tec
ti
on
modu
le.
T
he
NSL
-
KDD
da
tas
e
t
wa
s
uti
li
z
e
d
to
a
s
s
e
s
s
the
e
f
f
e
c
ti
ve
ne
s
s
of
va
r
ious
f
e
a
tur
e
a
nd
ML
model
c
ombi
na
ti
ons
in
the
c
ontext
of
S
DN
.
How
e
ve
r
,
th
e
a
uthor
s
a
c
knowle
dge
that
c
onduc
ti
ng
tes
ts
on
a
r
e
a
l
-
time
S
DN
tes
tbed
is
a
potential
f
utu
r
e
goa
l
to
ve
r
if
y
th
e
va
li
dit
y
of
their
f
indi
ngs
.
Ha
de
m
et
al
.
[
21]
ut
il
ize
d
an
S
VM
a
nd
s
e
lec
ti
ve
loggi
ng
with
IP
t
r
a
c
e
ba
c
k
to
a
c
c
ur
a
tely
identi
f
y
a
tt
a
c
ks
in
S
DN
us
ing
an
I
DS
whic
h
a
ls
o
he
lped
c
ons
e
r
ve
memor
y
r
e
s
our
c
e
s
.
T
he
NSL
-
KDD
da
tas
e
t
uti
li
z
e
d
yielde
d
a
de
tec
ti
on
a
c
c
ur
a
c
y
of
87.
74%
.
How
e
ve
r
,
the
da
tas
e
t
is
not
s
our
c
e
d
f
r
o
m
non
-
I
oT
ne
two
r
ks
,
a
nd
ther
e
is
s
ti
ll
potential
f
or
e
nha
nc
ing
a
c
c
ur
a
c
y.
Alz
a
hr
a
ni
a
nd
Ale
na
z
i
[
22
]
pr
e
s
e
nted
a
NI
DS
f
o
r
S
DN
s
that
us
e
s
the
e
xtr
e
me
gr
a
dient
boos
ti
ng
(
XG
B
oos
t)
model
to
a
c
c
ur
a
tely
c
a
tegor
ize
ne
tw
or
k
int
r
us
ions
.
F
ive
f
e
a
tur
e
s
we
r
e
c
hos
e
n
f
r
om
41
in
the
NSL
-
KDD
da
tas
e
t.
T
he
given
f
ind
ings
indi
c
a
te
a
c
las
s
if
ica
ti
on
a
c
c
ur
a
c
y
of
95
.
5%
f
o
r
XG
B
oos
t.
Additi
ona
ll
y,
the
a
uthor
s
e
mphas
ize
that
their
a
ppr
oa
c
h
may
be
us
e
d
f
or
S
DN
.
M
ohs
in
a
nd
Ha
mad
[
24]
inves
ti
ga
ted
the
e
f
f
e
c
ti
ve
ne
s
s
of
va
r
ious
s
upe
r
vis
e
d
ML
a
lgor
it
hms
f
or
de
tec
ti
ng
DD
oS
a
tt
a
c
ks
a
c
r
os
s
dif
f
e
r
e
nt
S
DN
ne
twor
k
topo
logi
e
s
.
T
he
y
a
ppli
e
d
R
F
,
k
-
ne
a
r
e
s
t
n
e
ighbor
s
(
KN
N)
,
NB
,
a
nd
L
R
to
s
ingl
e
,
li
ne
a
r
,
a
nd
mul
ti
-
c
ontr
oll
e
r
a
r
c
hit
e
c
tur
e
s
.
T
he
i
r
r
e
s
ult
s
s
howe
d
that
while
R
F
a
nd
KN
N
a
c
hieve
d
s
tr
ong
de
tec
ti
on
pe
r
f
or
manc
e
,
NB
a
nd
LR
s
uf
f
e
r
e
d
f
r
om
low
a
c
c
ur
a
c
y
a
nd
a
hig
h
r
a
te
of
f
a
ls
e
pr
e
dictions
,
li
mi
t
ing
t
he
ir
s
uit
a
bil
it
y
f
or
pr
a
c
t
ica
l
de
ploym
e
nt.
J
os
e
a
nd
J
o
s
e
[
27]
inves
ti
ga
ted
the
e
f
f
ica
c
y
of
DNN,
c
onvolut
ional
ne
ur
a
l
ne
twor
ks
(
C
NN
)
,
a
n
d
long
s
hor
t
-
ter
m
memor
y
ne
twor
ks
(
L
S
T
M
)
in
I
o
T
e
nvi
r
onments
f
or
the
de
ploym
e
nt
of
I
DS
ut
il
i
z
ing
the
C
I
C
-
I
DS
2017
da
tas
e
t.
T
he
r
e
s
ult
s
indi
c
a
ted
that
DL
models
ou
tper
f
or
med
pr
e
vious
methods
us
e
d
in
I
o
T
-
ba
s
e
d
I
DS.
S
pe
c
if
ica
ll
y,
L
S
T
M
a
nd
C
NN
a
c
hieve
d
a
c
c
ur
a
c
ies
of
97.
67%
a
nd
98.
61%
,
r
e
s
pe
c
ti
ve
ly,
while
the
ove
r
a
ll
DL
a
ppr
oa
c
h
r
e
a
c
he
d
94.
61
%
a
c
c
ur
a
c
y.
T
he
a
f
o
r
e
mentioned
s
tudi
e
s
togethe
r
e
it
he
r
im
it
a
t
e
the
be
ha
vior
of
c
onve
nti
ona
l
ne
twor
k
tr
a
f
f
ic
or
e
mpl
oy
the
a
tt
r
ibut
e
s
of
pr
e
vious
ne
twor
k
tr
a
f
f
ic
da
ta
to
pe
r
f
or
m
tes
ti
ng.
T
he
e
xpe
r
im
e
nts
c
onf
ir
m
that
it
is
pos
s
ibl
e
to
int
e
gr
a
te
s
uc
h
e
nha
nc
e
ments
int
o
the
modul
e
that
is
in
c
ha
r
ge
of
de
tec
ti
ng
a
tt
a
c
ks
in
t
he
S
DN
c
ontr
oll
e
r
.
How
e
ve
r
,
I
o
T
ne
twor
k
t
r
a
f
f
ic
s
hould
be
c
ons
ider
e
d,
as
it
is
pr
oduc
e
d
thr
ough
the
uti
li
z
a
ti
on
of
I
o
T
de
vice
s
ins
ide
the
S
DN
f
r
a
mew
or
k,
or
by
c
ombi
ning
the
f
low
of
I
o
T
tr
a
f
f
ic
with
c
onve
nti
ona
l
ne
twor
k
tr
a
f
f
ic
to
e
va
luate
the
de
tec
ti
on
e
f
f
e
c
ti
ve
ne
s
s
of
ML
models
.
F
u
r
ther
mor
e
,
the
pe
r
f
o
r
manc
e
of
de
tec
ti
ng
or
c
las
s
if
ying
in
s
upe
r
vis
e
d
or
uns
upe
r
vis
e
d
ML
models
s
ti
ll
ne
e
ds
e
nha
nc
e
ment
in
the
S
DN
ne
twor
k.
Ne
ve
r
thele
s
s
,
s
ome
r
e
s
e
a
r
c
he
r
s
inves
ti
ga
t
e
d
f
ur
ther
the
uti
li
z
a
ti
on
of
ne
u
r
a
l
ne
twor
k
models
f
or
the
d
e
tec
ti
on
a
nd
c
a
tegor
iza
ti
on
of
ne
two
r
k
a
tt
a
c
ks
in
S
DN
s
uc
h
a
s
:
C
ha
ga
nti
e
t
al
[
29]
a
n
L
S
T
M
-
ba
s
e
d
a
r
c
hit
e
c
tur
e
f
or
int
r
us
ion
de
tec
ti
on
in
S
DN
-
e
na
bled
I
oT
ne
twor
ks
.
T
he
ir
mod
e
l
e
f
f
e
c
ti
ve
ly
identif
ied
a
nd
c
las
s
if
ied
va
r
ious
ne
twor
k
a
tt
a
c
ks
,
including
por
t
s
c
a
nning,
ope
r
a
ti
ng
s
ys
tem
f
inger
pr
in
ti
ng,
de
nial
of
s
e
r
vi
c
e
(
DoS)
,
a
nd
DD
oS
.
T
he
r
e
s
ult
s
highl
ight
the
model’
s
s
uit
a
bil
it
y
f
o
r
c
a
ptu
r
ing
tempor
a
l
pa
tt
e
r
ns
a
n
d
e
nha
nc
ing
de
tec
ti
on
a
c
c
ur
a
c
y
in
c
ompl
e
x
S
DN
-
I
oT
e
nvir
onments
.
E
ls
a
ye
d
et
al
.
[
31
]
c
onduc
ted
a
s
e
c
ur
e
d
a
utom
a
ti
c
two
-
leve
l
int
r
us
ion
de
tec
ti
on
s
ys
tem
(
S
AT
I
DS)
that
e
mpl
oye
d
an
e
nha
nc
e
d
L
S
T
M
ne
twor
k
a
nd
uti
li
z
e
d
T
oN
-
I
oT
a
nd
I
nS
DN
da
tas
e
ts
.
T
he
a
uthor
s
tate
d
that
the
pr
opos
e
d
s
ys
tem
e
f
f
e
c
ti
ve
ly
dis
ti
nguis
he
d
be
twe
e
n
malicious
a
nd
ha
r
ml
e
s
s
ne
twor
k
tr
a
f
f
ic,
a
c
c
ur
a
tely
c
a
tegor
ize
d
the
type
of
a
tt
a
c
k,
a
nd
pr
e
c
is
e
ly
identif
ied
the
s
pe
c
if
ic
s
ub
-
a
tt
a
c
k.
T
he
r
e
s
e
a
r
c
h
r
e
s
ult
s
de
mons
tr
a
ted
that
the
s
ugge
s
ted
s
ys
tem
s
ur
pa
s
s
e
s
other
s
in
identi
f
ying
a
wide
r
a
nge
of
a
tt
a
c
ks
.
How
e
ve
r
,
L
S
T
M
-
ba
s
e
d
models
ne
e
d
s
ubs
tantial
memor
y
c
a
pa
c
it
y
thr
oughout
the
tr
a
ini
ng
pr
oc
e
s
s
.
T
he
s
u
bs
tantial
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
310
9
-
3120
3112
memor
y
r
e
s
our
c
e
c
ons
umpt
ion
mi
ght
r
e
s
tr
ict
the
uti
li
z
a
ti
on
of
L
S
T
M
f
o
r
I
DS
in
S
DN
a
nd
I
o
T
n
e
twor
ks
.
Als
o,
in
a
c
ompl
e
x
I
o
T
ne
twor
k
,
the
s
ugge
s
ted
a
r
c
hit
e
c
tur
e
r
e
quir
e
s
s
igni
f
ica
nt
ti
me
to
tr
a
in
the
mod
e
l
due
to
the
pr
oc
e
s
s
of
s
e
lf
-
lea
r
ning
the
f
e
a
tur
e
s
a
nd
a
djus
ti
ng
the
model
we
ight
s
.
3.
T
E
CHNOL
OG
Y
B
AC
KG
ROUN
D
B
e
f
or
e
e
xa
mi
ning
the
p
r
opos
e
d
model,
it
is
e
s
s
e
nti
a
l
to
ge
t
an
unde
r
s
tanding
of
the
main
tec
hnique
a
nd
method
uti
l
ize
d
in
thi
s
s
tudy.
W
hich
wa
s
s
e
lec
ted
thr
ough
an
e
va
luation
of
the
p
r
ior
s
tudi
e
s
that
c
ons
ider
the
de
ve
lopm
e
nt
of
an
e
f
f
icie
nt
I
DS
s
ys
tem
a
nd
a
na
lyze
the
us
e
d
too
ls
.
T
his
s
e
c
ti
on
pr
ovides
an
ov
e
r
view
of
the
tec
hnologi
e
s
a
nd
methodologi
e
s
uti
li
z
e
d
to
im
p
leme
nt
NI
DS
on
an
S
DN
ne
twor
k
as
f
o
ll
ows
.
3
.
1.
S
o
f
t
war
e
d
e
f
i
n
e
d
n
e
t
wor
k
S
witche
s
a
nd
r
outer
s
we
r
e
uti
li
z
e
d
in
tr
a
dit
ional
ne
twor
ks
to
e
s
tablis
h
ne
twor
k
c
onne
c
ti
ons
a
nd
f
a
c
il
it
a
te
the
tr
a
ns
mi
s
s
ion
of
da
ta
th
r
oughout
the
n
e
twor
k.
T
his
ne
twor
king
tec
hnique
may
be
vulne
r
a
ble
to
a
lac
k
of
c
onf
identialit
y
a
nd
s
us
c
e
pti
ble
to
thi
r
d
-
pa
r
ty
a
tt
a
c
ks
.
S
DN
is
a
ne
twor
king
s
tr
a
tegy
that
e
nha
nc
e
s
the
e
f
f
icie
nc
y
of
a
c
e
nt
r
a
li
z
e
d
e
nvi
r
onment
by
s
e
p
a
r
a
ti
ng
da
ta
tr
a
ns
f
e
r
f
r
om
de
dica
ted
de
vice
s
[
3
5]
.
T
his
pa
r
a
digm
is
s
tr
uc
tur
e
d
a
r
ound
dis
ti
nc
t
plane
s
,
each
with
its
own
de
s
ignate
d
f
unc
ti
ons
,
i
)
d
a
t
a
plane
r
e
s
pons
ibl
e
f
or
the
f
or
wa
r
ding
of
pa
c
ke
ts
;
ii
)
t
he
c
ontr
ol
plane
de
ter
mi
ne
s
r
outi
ng
by
leve
r
a
ging
a
f
l
ow
table
that
pr
ovides
r
ules
f
or
e
f
f
icie
ntl
y
mana
ging
inco
mi
ng
pa
c
ke
ts
;
a
nd
T
he
a
ppli
c
a
ti
on
plan
c
ontains
a
r
a
nge
of
s
e
r
vice
s
that
a
r
e
of
f
e
r
e
d
to
us
e
r
s
.
How
e
ve
r
,
ne
w
vulner
a
bil
it
ies
may
a
ls
o
be
int
r
oduc
e
d
f
r
om
th
is
s
e
pa
r
a
ti
on.
F
o
r
e
xa
mpl
e
,
the
c
ontr
oll
e
r
can
be
il
lus
tr
a
ted
by
e
xha
us
ti
ng
the
c
o
mm
unica
ti
on
ba
ndwidth
be
twe
e
n
inf
r
a
s
tr
uc
tur
e
la
ye
r
s
s
uc
h
as
the
Ope
nF
low
s
witch
a
nd
S
DN
c
ontr
oll
e
r
.
Ne
ve
r
thele
s
s
,
S
DN
can
im
pr
ove
ne
twor
k
s
e
c
ur
it
y
d
ue
to
its
pr
ogr
a
mm
ing
c
a
pa
bil
it
ies
that
e
na
ble
the
c
r
e
a
ti
on
of
s
e
c
ur
it
y
a
ppli
c
a
ti
ons
s
uc
h
a
s
I
DS
that
de
tec
t
ne
twor
k
thr
e
a
ts
.
Als
o,
it
is
im
por
tant
to
mention
that
f
lo
w
r
ules
may
be
modi
f
ied
ba
s
e
d
on
r
e
quir
e
ments
[
36]
by
leve
r
a
ging
the
a
bil
it
y
to
pr
og
r
a
m
a
nd
c
ontr
ol
o
f
f
e
r
e
d
by
S
DN
in
c
ompar
is
on
to
tr
a
dit
ional
ne
t
wor
king
s
ys
tems
[
37]
.
F
igur
e
1
i
ll
us
tr
a
tes
the
typi
c
a
l
S
DN
a
r
c
hit
e
c
tur
e
.
F
igur
e
1.
S
DN
ne
two
r
k
a
r
c
hit
e
c
tur
e
3
.
2.
I
n
t
r
u
s
ion
d
e
t
e
c
t
ion
s
ys
t
e
m
s
I
DS
is
a
c
r
uc
ial
e
leme
nt
in
s
a
f
e
gua
r
ding
s
ys
tem
s
by
de
tec
ti
ng
a
nd
a
na
lyzing
ne
twor
k
tr
a
f
f
ic
to
identif
y
s
e
c
ur
it
y
b
r
e
a
c
he
s
a
nd
thr
e
a
ts
us
ing
one
of
the
f
oll
owing
tec
hniques
:
s
ignatur
e
-
ba
s
e
d
or
a
nomaly
-
ba
s
e
d.
T
he
f
ir
s
t
method
r
e
li
e
s
on
pr
e
de
ter
mi
ne
d
ne
twor
k
pa
tt
e
r
ns
a
nd
is
ther
e
f
or
e
una
ble
to
identif
y
ne
w
a
tt
a
c
ks
.
In
c
ontr
a
s
t,
the
latte
r
method
a
na
lyze
s
pa
r
ti
c
ular
c
ha
r
a
c
ter
is
ti
c
s
of
ne
twor
k
t
r
a
f
f
ic,
a
ll
o
wing
a
ny
diver
ge
nc
e
f
r
om
nor
mal
ne
two
r
k
a
c
ti
vit
y
to
be
r
e
c
ognize
d
as
a
potential
a
tt
a
c
k;
a
s
im
ple
c
ompar
is
on
be
twe
e
n
them
is
pr
e
s
e
nted
in
T
a
ble
2,
[
38]
.
Ne
ve
r
thele
s
s
,
s
ome
dr
a
wba
c
ks
we
r
e
a
ls
o
int
r
oduc
e
d,
s
uc
h
as
th
e
lac
k
of
identif
ica
ti
on
of
e
nc
r
ypted
pa
c
ke
ts
a
nd
,
the
incide
nc
e
of
f
a
ls
e
a
lar
ms
may
be
e
leva
ted,
lea
ding
to
the
ne
e
d
f
or
human
int
e
r
ve
nti
on
to
a
djus
t
the
a
nomaly
indi
c
a
tor
s
a
nd
ult
im
a
tely
r
e
s
ult
ing
in
an
inef
f
icie
nt
s
e
c
ur
it
y
s
olut
ion
[
39]
.
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
F
e
de
r
ated
de
e
p
lear
ning
int
r
us
ion
de
tec
ti
on
s
y
s
te
m
on
s
oft
w
ar
e
de
fi
ne
d
-
ne
tw
or
k
…
(
He
ba
Dhir
ar
)
3113
T
a
ble
2.
De
tec
ti
on
tec
hnique
c
ompar
is
on
F
a
c
to
r
D
e
te
c
ti
on
te
c
hni
que
S
ig
na
tu
r
e
A
noma
ly
A
la
r
m
r
a
te
L
ow
H
ig
h
S
pe
e
d
H
ig
ht
L
ow
F
le
xi
bi
li
ty
L
ow
H
ig
h
R
e
li
a
bi
li
ty
H
ig
h
M
ode
r
a
te
S
c
a
la
bi
li
ty
L
ow
H
ig
h
R
obus
tn
e
s
s
L
ow
H
ig
h
R
e
c
e
ntl
y,
s
e
ve
r
a
l
ML
a
ppr
oa
c
he
s
ha
ve
be
e
n
int
r
oduc
e
d
to
identif
y
int
r
us
ion
in
S
DN
a
nd
I
oT
[
15
]
,
[
16]
,
[
19
]
-
[
21]
.
Als
o,
the
DL
model
wa
s
p
r
opos
e
d
in
the
c
ontext
of
S
DN
a
nd
the
I
o
T
to
e
nha
nc
e
int
r
us
ion
a
tt
a
c
k
de
tec
ti
on
[
17]
,
[
22]
,
[
25
]
.
P
r
e
vious
r
e
s
e
a
r
c
h
on
int
r
us
ion
de
tec
ti
on
ha
s
de
mons
tr
a
ted
that
the
DL
model
pr
ovides
s
upe
r
ior
pe
r
f
or
manc
e
whe
n
a
ppli
e
d
to
lar
ge
-
s
c
a
le
ne
twor
k
da
ta
s
e
ts
[
22]
,
[
25]
.
De
s
pit
e
the
s
ubs
tantial
im
pa
c
t
of
ML
a
nd
DL
on
pr
a
c
ti
c
a
l
pr
oblem
-
s
olvi
ng,
they
a
r
e
s
ubjec
t
to
many
li
mi
tations
,
including:
i
)
u
s
e
r
s
mus
t
pr
ov
ide
thei
r
da
ta
to
a
c
e
ntr
a
li
z
e
d
s
e
r
ve
r
to
tr
a
in
the
model;
ii
)
w
he
n
ne
twor
k
s
ize
incr
e
a
s
e
s
,
the
pe
r
f
or
manc
e
dim
ini
s
he
s
a
nd
ther
e
is
a
r
is
k
of
a
s
ingl
e
poin
t
of
f
a
il
u
r
e
that
m
ight
unde
r
mi
ne
the
int
e
gr
it
y
a
nd
qua
li
ty
of
s
e
r
vice
s
(
QoS
)
;
ii
i)
I
DS
ne
e
ds
r
a
pid
a
na
lys
is
,
howe
ve
r
,
c
e
ntr
a
li
z
e
d
pr
oc
e
s
s
ing
is
a
time
-
c
ons
umi
ng
pr
oc
e
s
s
;
a
nd
iv)
I
oT
de
vice
s
f
r
e
que
ntl
y
ga
ther
da
ta
f
r
om
e
nd
-
us
e
r
s
,
potentially
e
xpos
ing
their
s
e
ns
it
ive
inf
or
mation.
To
tac
kle
thes
e
pr
oblems
,
it
’s
ne
c
e
s
s
a
r
y
to
us
e
method
s
that
invol
ve
on
-
de
vice
lea
r
ning.
3
.
3.
F
e
d
e
r
at
e
d
lear
n
in
g
Google
int
r
oduc
e
d
the
c
onc
e
pt
of
FL
to
p
r
e
s
e
r
ve
da
ta
pr
ivac
y
on
de
vice
s
[
5]
‒
[
7]
by
a
ll
owing
node
s
to
lea
r
n
c
oll
a
bo
r
a
ti
ve
ly
without
s
ha
r
ing
da
ta
with
a
c
e
ntr
a
li
z
e
d
s
e
r
ve
r
.
FL
is
an
it
e
r
a
ti
ve
p
r
oc
e
dur
e
in
whic
h
the
e
nti
r
e
model
is
e
nha
nc
e
d
in
each
r
ound
unti
l
a
s
pe
c
if
ic
number
ha
s
be
e
n
r
e
a
c
he
d
or
the
r
e
quir
e
d
leve
l
of
pe
r
f
or
manc
e
is
a
tt
a
ined.
In
the
be
ginni
ng
,
the
FL
s
e
r
ve
r
s
e
lec
ts
a
dis
ti
nc
t
gr
oup
of
c
li
e
nts
to
pa
r
ti
c
ipate
in
the
tr
a
ini
ng
pr
oc
e
s
s
a
nd
dis
tr
ibut
e
s
its
global
model
to
them
[
7]
.
Onc
e
the
global
model
is
obtaine
d,
e
a
c
h
c
li
e
nt
e
mpl
oys
its
da
ta
f
o
r
loca
l
tr
a
ini
ng
a
nd
tr
a
ns
mi
ts
th
e
ir
a
c
quir
e
d
pa
r
a
mete
r
s
ba
c
k
to
the
s
e
r
ve
r
,
as
il
lus
tr
a
ted
in
Fi
gur
e
2.
It
of
f
e
r
s
a
pr
ivac
y
pr
otec
ti
on
tec
hnique
that
e
f
f
icie
ntl
y
uti
li
z
e
s
the
pr
oc
e
s
s
ing
r
e
s
our
c
e
s
of
the
pa
r
it
y
de
vice
f
or
model
t
r
a
ini
ng,
ther
e
by
pr
e
ve
nti
ng
t
he
lea
ka
ge
of
pr
ivate
in
f
or
mation
dur
ing
da
ta
tr
a
ns
f
e
r
.
C
ons
ider
ing
the
e
nor
mous
number
of
de
vice
s
,
the
r
e
a
r
e
a
lar
ge
number
of
r
e
leva
nt
da
tas
e
t
r
e
s
our
c
e
s
that
can
be
e
f
f
e
c
ti
ve
ly
uti
li
z
e
d
.
F
igur
e
2.
F
L
ove
r
view
Ge
ne
r
a
ll
y,
FL
may
be
c
a
tegor
ize
d
int
o
th
r
e
e
types
ba
s
e
d
on
the
dis
tr
ibut
ion
of
c
li
e
nts
'
da
ta:
ve
r
ti
c
a
l,
hor
izonta
l,
a
nd
t
r
a
ns
f
e
r
FL
.
He
r
ts
f
o
r
lea
r
ning
(
H
F
L
)
is
an
FL
tec
hnique
in
whic
h
the
da
tas
e
ts
on
t
he
c
li
e
nts
s
ha
r
e
the
s
a
me
f
e
a
tur
e
but
ha
ve
s
e
pa
r
a
te
obs
e
r
va
ti
ons
.
Ve
r
ti
c
a
l
f
e
de
r
a
ted
lea
r
ning
(
VFL
)
,
o
f
ten
r
e
f
e
r
r
e
d
to
as
f
e
a
tur
e
s
-
ba
s
e
d
F
L
,
in
whic
h
da
ta
f
r
om
s
e
ve
r
a
l
do
mains
is
uti
li
z
e
d
to
tr
a
in
a
global
model.
In
thi
s
c
ontext,
the
c
li
e
nt
da
tas
e
t
may
c
ontain
identica
l
obs
e
r
va
ti
ons
b
ut
with
va
r
ying
c
ha
r
a
c
ter
is
ti
c
s
.
As
ide
f
r
om
HFL
a
nd
VFL
,
ther
e
is
a
ls
o
the
f
e
de
r
a
ted
tr
a
ns
f
e
r
lea
r
ning
(
F
T
L
)
a
r
c
hit
e
c
tur
e
pr
e
s
e
nted
in
[
40]
,
whic
h
is
a
ppli
c
a
ble
whe
n
the
da
tas
e
ts
on
the
de
vice
s
dif
f
e
r
not
only
in
oc
c
ur
r
e
n
c
e
s
but
a
ls
o
in
c
ha
r
a
c
ter
is
ti
c
s
.
How
e
ve
r
,
to
e
ns
ur
e
pr
ivac
y,
s
ome
pr
oblems
mus
t
be
a
ddr
e
s
s
e
d
in
the
im
ple
menta
ti
on
of
F
L
:
i
)
it
is
im
pe
r
a
ti
ve
to
gua
r
a
ntee
that
the
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
310
9
-
3120
3114
tr
a
ini
ng
model
us
e
d
doe
s
not
dis
c
los
e
us
e
r
s
'
c
onf
i
de
nti
a
l
inf
or
mation
;
ii
)
s
ince
the
tr
a
ini
ng
pr
oc
e
s
s
pr
oc
e
e
ds
loca
ll
y
at
each
e
nti
ty
us
ing
its
da
tas
e
t.
T
he
r
e
f
o
r
e
,
it
is
c
r
uc
ial
to
gua
r
a
ntee
that
only
a
ll
owe
d
e
nti
ti
e
s
pa
r
ti
c
ipate
in
the
t
r
a
ini
ng
p
r
oc
e
s
s
a
nd
the
r
e
c
e
ived
model
upda
tes
ha
ve
be
e
n
tr
a
ns
mi
tt
e
d
by
th
e
m;
ii
i)
tr
a
dit
ional
ML
models
r
e
quir
e
a
s
ubs
tantial
a
moun
t
of
da
ta
to
a
c
hieve
outs
tanding
pe
r
f
or
manc
e
.
How
e
ve
r
,
in
a
dis
pe
r
s
e
d
c
ontext,
the
a
c
c
e
s
s
ibl
e
da
ta
on
each
de
vice
is
mi
nim
a
l
.
C
onve
r
s
e
ly,
c
ons
oli
da
t
ing
a
ll
da
ta
in
a
c
e
ntr
a
li
z
e
d
wa
y
mi
ght
lea
d
to
s
igni
f
ica
nt
c
os
ts
;
a
nd
iv)
the
da
ta
s
tor
e
d
on
s
uc
h
de
vice
s
may
no
t
e
xhibi
t
dis
ti
nc
t
a
nd
s
ymm
e
tr
ica
l
dis
tr
ibut
ion
(
non
-
I
I
D)
c
ha
r
a
c
ter
is
ti
c
s
;
tr
a
ini
ng
thes
e
da
ta
s
e
ts
pos
e
s
a
s
u
bs
tantial
c
ha
ll
e
nge
.
3
.
4.
I
oT
-
S
DN
d
a
t
as
e
t
T
he
r
e
is
a
lac
k
of
publi
c
ly
a
c
c
e
s
s
ibl
e
da
tas
e
ts
that
a
r
e
e
xpli
c
it
ly
de
s
igned
f
o
r
int
r
us
ion
de
tec
ti
on
in
S
DN
-
ba
s
e
d
I
oT
.
F
or
thi
s
wo
r
k,
a
c
us
tom
-
ge
ne
r
a
ted
da
tas
e
t
wa
s
uti
li
z
e
d.
T
he
da
tas
e
t
c
omp
r
is
e
s
e
ight
y
-
s
ix
a
tt
r
ibut
e
s
withi
n
a
s
ize
of
(
2.
7
GB
)
c
oll
e
c
ted
f
r
om
s
im
ulate
d
S
DN
-
ba
s
e
d
I
oT
ne
twor
ks
withi
n
t
wo
f
low
pr
of
il
e
s
:
nor
mal
a
nd
a
tt
a
c
k
tr
a
f
f
ic
s
uc
h
as
botnet,
br
ute
f
or
c
e
,
DoS
,
DD
oS
,
e
xploi
tation
,
malwa
r
e
,
M
I
R
AI
,
pr
obe
,
R
2L
,
UR
2,
we
b
-
ba
s
e
d,
s
poof
ing,
a
nd
r
e
c
on,
e
mpl
oye
d
us
ing
M
e
tas
ploi
t.
T
a
ble
3
pr
e
s
e
nts
the
c
oll
e
c
ted
tr
a
f
f
ic
c
a
tegor
ies
togethe
r
with
their
c
or
r
e
s
ponding
r
e
c
or
d
number
s
.
T
he
ne
twor
k
topol
ogy
is
im
pleme
nted
us
ing
M
ini
ne
t
Wi
F
i
on
the
Ubuntu
20.
04
L
T
S
ope
r
a
ti
ng
s
ys
tem
c
ons
e
nt
of
two
R
yu
c
ontr
oll
e
r
s
who
we
r
e
r
e
s
pons
ibl
e
f
or
mana
ging
the
ope
r
a
ti
on
of
the
f
o
ur
Ope
nF
low
s
witche
s
that
c
onne
c
ted
to
f
our
s
ubdomains
.
E
a
c
h
s
ubdomain
c
ompr
is
e
s
a
pa
i
r
of
hos
ts
a
s
ingl
e
a
c
c
e
s
s
point
,
a
nd
thr
e
e
wi
r
e
les
s
s
tations
.
T
he
f
ir
s
t
two
s
ubdomains
e
nc
ompas
s
a
va
r
iety
of
s
e
r
vice
s
,
s
u
c
h
as
HT
T
P
a
nd
F
T
P
s
e
r
ve
r
s
.
In
c
ontr
a
s
t,
the
las
t
two
c
ompr
is
e
many
wi
r
e
les
s
s
e
ns
or
de
vice
s
.
T
he
ne
twor
k
t
r
a
f
f
ic
is
c
a
ptur
e
d
us
ing
W
i
r
e
s
ha
r
k
a
nd
c
las
s
if
ied
a
c
c
or
ding
to
its
f
e
a
tur
e
s
e
xtr
a
c
ted
us
ing
C
I
C
F
low
M
e
ter
.
T
a
ble
3.
Da
ta
r
e
c
or
ds
number
f
o
r
each
tr
a
f
f
ic
g
r
ou
p
G
r
oup
T
r
a
f
f
ic
t
ype
R
e
c
or
ds
N
or
ma
l
H
T
T
P
S
,
H
T
T
P
,
F
T
P
,
D
N
S
,
ma
il
,
br
ow
s
in
g,
a
nd
Y
ou
T
ube
367,396
A
tt
a
c
k
D
oS
,
D
D
oS
,
R
2L
,
B
r
ut
e
-
F
or
c
e
,
E
xpl
oi
ta
ti
on,
Web
-
B
a
s
e
d,
B
ot
ne
t
P
r
obe
,
R
e
c
on,
S
poof
in
g,
M
a
lwa
r
e
5,878,336
(
367,396
f
or
e
a
c
h)
4.
P
ROP
OS
E
D
M
E
T
HO
DOL
OG
Y
T
he
tec
hnique
e
mpl
oys
a
s
ys
t
e
matic
a
ppr
oa
c
h
tha
t
s
tar
ts
with
the
pr
e
c
is
e
de
f
ini
ti
on
of
the
r
e
s
e
a
r
c
h
is
s
ue
.
T
he
c
ombi
na
ti
on
of
FL
with
DL
tec
hniques
f
or
a
nomaly
incur
s
ion
de
tec
ti
on
in
S
DN
-
ba
s
e
d
I
oT
ne
twor
ks
is
e
mer
ging
as
a
potentially
unique
a
p
pr
oa
c
h.
T
his
s
e
c
ti
on
de
li
ne
a
tes
the
pr
ojec
ted
a
r
c
hit
e
c
tur
e
il
lus
tr
a
ted
in
F
igu
r
e
3
whic
h
ha
s
be
e
n
e
xe
c
uted
in
t
wo
pr
incipa
l
pha
s
e
s
as
f
oll
ows
.
F
igur
e
3.
S
DN
-
ba
s
e
d
I
oT
p
r
opos
e
d
s
ys
tem
a
r
c
hit
e
c
tur
e
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
F
e
de
r
ated
de
e
p
lear
ning
int
r
us
ion
de
tec
ti
on
s
y
s
te
m
on
s
oft
w
ar
e
de
fi
ne
d
-
ne
tw
or
k
…
(
He
ba
Dhir
ar
)
3115
4
.
1.
De
p
loyi
n
g
an
S
DN
in
f
r
as
t
r
u
c
t
u
r
e
f
or
a
n
I
o
T
n
e
t
wor
k
One
of
the
s
igni
f
ica
nt
vulner
a
bil
i
ti
e
s
is
the
S
D
N
ne
twor
k
whe
n
the
c
ontr
oll
e
r
is
e
xploi
ted
by
ove
r
whe
lm
ing
the
c
omm
unic
a
ti
on
c
a
pa
c
it
y
with
e
xc
e
s
s
iv
e
a
nd
unde
s
ir
e
d
tr
a
f
f
ic,
lea
ding
to
a
DD
o
S
a
tt
a
c
k.
How
e
ve
r
,
ne
twor
k
s
e
c
ur
it
y
can
be
e
nha
nc
e
d
by
its
pr
ogr
a
mm
ing
c
a
pa
bil
it
ies
,
whic
h
a
ll
ow
f
or
the
de
ve
lopm
e
nt
of
s
e
c
ur
it
y
a
ppli
c
a
ti
ons
s
uc
h
as
I
DS
that
can
identi
f
y
ne
twor
k
th
r
e
a
ts
.
Our
s
ugge
s
ted
a
r
c
hit
e
c
tur
e
c
ompr
is
e
s
numer
ous
objec
ti
ve
s
,
whi
c
h
a
r
e
i)
a
mul
ti
-
c
ontr
oll
e
r
S
DN
ne
twor
k
wa
s
e
s
tablis
he
d
uti
li
z
ing
Z
ooke
e
pe
r
a
nd
R
e
dis
.
Z
ooKe
e
pe
r
will
p
r
ompt
ly
o
r
ga
nize
a
nd
c
oo
r
dinate
the
c
ha
nge
of
c
ontr
oll
e
r
r
ole,
whe
r
e
a
s
a
ba
c
kup
c
opy
f
r
om
the
f
low
table
w
il
l
be
s
tor
e
d
in
R
e
dis
s
tor
a
ge
.
T
his
s
e
tup
s
e
r
ve
s
as
a
r
obus
t
f
r
a
mew
or
k
to
p
r
e
ve
nt
ne
two
r
k
f
a
il
ur
e
.
If
the
mas
ter
c
ontr
o
ll
e
r
be
c
omes
inac
ti
ve
,
the
other
c
ontr
oll
e
r
r
e
tr
ieve
s
the
f
low
e
ntr
ies
f
r
om
R
e
dis
s
tor
a
ge
a
nd
s
moot
hly
c
onti
nue
s
ne
twor
k
ope
r
a
ti
ons
,
F
igu
r
e
4
de
mons
tr
a
tes
the
mul
ti
-
c
ontr
oll
e
r
im
pleme
ntation
s
teps
;
ii
)
ing
r
e
s
s
a
nd
e
gr
e
s
s
poli
c
ies
we
r
e
e
mpl
oye
d
to
mana
ge
a
n
d
c
ontr
ol
ne
twor
k
tr
a
f
f
ic;
i
ii
)
a
ll
pa
c
ke
ts
r
e
c
e
ived
by
the
c
ontr
oll
e
r
will
be
ini
t
ially
s
e
nt
to
the
I
DS
s
e
r
ve
r
to
pr
e
dict
whe
ther
the
tr
a
f
f
ic
r
e
c
e
ived
is
an
a
tt
a
c
k
or
nor
mal
tr
a
f
f
ic.
How
e
ve
r
,
by
f
lood
ing
the
c
ontr
oll
e
r
,
the
I
D
S
s
e
r
ve
r
will
a
ls
o
be
f
looded.
To
pr
e
ve
nt
thi
s
,
DoS
a
nd
D
DoS
a
tt
a
c
ks
a
r
e
mi
ti
ga
ted
onc
e
a
thr
e
s
hold
is
r
e
a
c
he
d;
a
nd
iv)
the
s
lave
c
ontr
oll
e
r
is
uti
li
z
e
d
to
e
f
f
icie
ntl
y
mana
ge
the
huge
a
mount
of
da
ta
r
e
c
e
ived
on
th
e
mas
ter
c
ontr
oll
e
r
by
e
na
bli
ng
P
us
hba
c
k
pol
ice
.
M
ini
ne
t
W
iF
i
us
e
d
to
c
ons
tr
uc
t
a
tr
e
e
topol
ogy
il
lus
tr
a
ted
in
F
igu
r
e
4
c
ons
is
ts
of
f
our
domains
.
E
a
c
h
domain
is
c
ompos
e
d
of
two
hos
ts
,
an
a
c
c
e
s
s
point
,
thr
e
e
s
tations
,
a
nd
thr
e
e
wir
e
les
s
s
e
n
s
or
s
.
I
oT
de
vice
s
may
e
xpe
r
ienc
e
c
omm
unica
ti
on
r
e
s
our
c
e
li
mi
ts
that
pr
e
ve
nt
the
m
f
r
om
int
e
r
a
c
ti
ng
with
a
c
e
ntr
a
l
ba
s
e
s
tation
due
to
the
li
mi
tations
in
c
omm
unica
ti
on
r
e
s
our
c
e
s
.
F
igur
e
4.
Z
ooKe
e
pe
r
a
nd
R
e
dis
c
oor
dination
s
ys
tem
4
.
2.
De
p
loyi
n
g
an
om
aly
-
b
as
e
d
n
e
t
wor
k
in
t
r
u
s
io
n
d
e
t
e
c
t
ion
s
ys
t
e
m
I
nit
ially
,
the
c
oor
dinator
s
e
r
ve
r
uploads
the
global
model
pr
e
s
e
nted
in
T
a
ble
4,
to
the
IP
F
S
ne
twor
k
whic
h
is
uti
li
z
e
d
to
e
nha
nc
e
s
e
c
ur
e
model
a
ggr
e
ga
ti
on,
e
ns
ur
ing
that
only
a
uthor
ize
d
c
li
e
nts
invol
v
e
d
in
the
tr
a
ini
ng
pr
oc
e
s
s
can
a
c
c
e
s
s
a
nd
downloa
d
the
gl
oba
l
model
ba
s
e
d
on
a
s
pe
c
if
ic
ha
s
h
identi
f
ier
.
I
P
F
S
is
a
de
c
e
ntr
a
li
z
e
d
f
r
a
mew
or
k
invol
ving
pr
o
tocols
,
pa
c
ka
ge
s
,
a
nd
c
ompos
a
ble
s
pe
c
if
ica
ll
y
de
s
igned
to
ha
ndle,
dir
e
c
t,
a
nd
tr
a
ns
mi
t
c
ontent
-
a
ddr
e
s
s
e
d
da
ta.
T
he
s
ys
tem
is
both
r
e
s
our
c
e
-
e
f
f
icie
nt
a
nd
r
e
li
a
bly
c
onve
r
ge
s
to
c
e
ntr
a
li
z
e
d
FL
f
r
a
mew
or
ks
with
a
dr
op
of
les
s
than
1%
[
41]
.
T
he
model
c
ons
is
ts
of
f
our
de
ns
e
laye
r
s
with
256,
128
,
64
,
a
nd
32
ne
u
r
ons
,
r
e
s
pe
c
ti
ve
ly
in
a
ddi
ti
on
to
the
input
a
nd
ou
tput
laye
r
s
.
E
a
c
h
laye
r
is
f
oll
owe
d
by
a
ba
tch
nor
maliza
ti
on
laye
r
a
nd
a
dr
opou
t
r
a
te
of
0.
5
.
T
he
r
e
a
s
on
f
or
a
dding
thes
e
laye
r
s
is
to
im
pr
ove
the
pe
r
f
or
manc
e
a
nd
ge
ne
r
a
li
z
a
ti
on
of
the
ne
twor
k.
T
he
ba
tch
nor
maliza
ti
on
s
tabili
z
e
s
the
lea
r
ning
p
r
oc
e
s
s
by
nor
malizing
the
a
c
ti
va
ti
ons
of
the
p
r
e
c
e
ding
laye
r
.
T
he
dr
opout
laye
r
is
uti
li
z
e
d
to
mi
ti
ga
te
ove
r
f
it
ti
n
g
in
the
model
by
e
nha
nc
ing
its
a
bil
it
y
to
ge
ne
r
a
li
z
e
to
n
e
w
da
ta
a
nd
incr
e
a
s
ing
its
ove
r
a
ll
r
e
s
il
ienc
e
.
T
he
r
e
c
ti
f
ied
li
ne
a
r
unit
(
R
e
L
U
)
a
c
ti
va
ti
on
f
unc
ti
on
wa
s
us
e
d
in
a
ll
the
De
ns
e
laye
r
s
due
to
its
s
im
pli
c
it
y,
e
f
f
icie
nc
y,
a
nd
a
bil
it
y
to
a
ddr
e
s
s
the
va
nis
hing
gr
a
dient
pr
oblem
.
S
of
tM
a
x
a
c
ti
va
ti
on
f
unc
ti
on
wa
s
us
e
d
in
the
out
put
laye
r
f
or
mul
ti
-
c
las
s
c
las
s
if
ica
ti
on
tas
ks
to
ge
ne
r
a
te
a
pr
oba
bil
it
y
dis
tr
ibut
ion
a
c
r
os
s
dif
f
e
r
e
nt
c
las
s
e
s
.
T
a
ble
4.
DL
tr
a
ini
ng
model
A
lg
or
it
hm
L
a
ye
r
s
N
e
ur
on
DNN
4
D
e
ns
e
,
in
a
ddi
ti
on
to
in
put
a
nd
out
put
la
ye
r
256,
128,
64,
32
4
B
a
tc
h
N
or
ma
li
z
a
ti
on
la
ye
r
4
D
r
opout
la
ye
r
A
c
ti
va
ti
on
f
unc
ti
on
Re
L
U
,
S
of
tM
a
x
L
os
s
f
unc
ti
on
C
a
te
gor
ic
a
l
c
r
os
s
-
e
nt
r
opy
O
pt
im
iz
e
r
A
da
m
B
a
tc
h
-
s
iz
e
256
T
a
ble
5
il
lus
tr
a
tes
the
c
las
s
if
ica
ti
on
r
e
por
t
of
de
tec
ti
ng
e
a
c
h
a
tt
a
c
k
type
a
f
ter
tr
a
ini
ng
the
model.
All
of
the
metr
ics
de
mons
tr
a
te
a
s
upe
r
ior
de
gr
e
e
o
f
e
f
f
e
c
ti
ve
ne
s
s
in
a
ll
types
of
t
r
a
f
f
ic,
with
a
notable
e
xc
e
pti
on
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
310
9
-
3120
3116
be
ing
the
us
e
r
to
r
oot
(
U2R
)
c
a
tegor
y
whic
h
c
a
n
be
e
xplaine
d
by
the
f
a
c
t
that
other
c
a
tegor
ies
f
r
e
que
ntl
y
dis
play
mor
e
dis
s
im
il
a
r
it
y
in
c
ompar
is
on
to
no
r
ma
l
tr
a
f
f
ic
pa
tt
e
r
ns
.
I
n
c
ont
r
a
s
t,
the
U2R
a
tt
a
c
king
c
l
a
s
s
ha
s
a
notable
s
im
il
a
r
it
y
to
the
s
tanda
r
d
da
ta
tr
a
f
f
ic.
T
he
I
D
S
model
is
de
ployed
on
a
de
dica
ted
s
e
r
ve
r
to
pe
r
f
or
m
int
r
us
ion
de
tec
ti
on
to
the
c
ompl
e
te
ne
twor
k,
whic
h
o
f
f
e
r
s
s
ubs
tantial
a
dva
ntage
s
in
ter
ms
of
pe
r
f
or
manc
e
,
s
c
a
labili
ty,
s
e
c
ur
it
y,
a
nd
mai
ntena
nc
e
.
I
t
gua
r
a
ntee
s
that
the
c
ontr
oll
e
r
c
a
n
c
onc
e
ntr
a
te
o
n
it
s
pr
im
a
ry
ope
r
a
ti
ons
,
while
the
I
DS
s
e
r
ve
r
is
f
i
ne
-
tuned
a
nd
e
xpa
nde
d
e
xpr
e
s
s
ly
f
or
e
f
f
icie
nt
int
r
us
ion
d
e
tec
ti
on.
In
an
S
DN
,
the
pr
oc
e
s
s
of
pa
c
ke
t
f
or
w
a
r
ding
is
ha
ndled
dif
f
e
r
e
ntl
y,
whe
n
a
hos
t
s
e
nds
a
r
e
que
s
t
to
a
nother
hos
t,
it
is
f
ir
s
t
f
o
r
wa
r
de
d
to
the
Ope
n
vS
witch
(
OVS
)
s
witch.
T
he
s
witch
c
he
c
ks
if
ther
e
is
a
ny
in
s
tr
uc
ti
on
to
pr
oc
e
e
d
with.
If
not,
the
pa
c
ke
t
is
f
o
r
w
a
r
de
d
to
the
c
ontr
oll
e
r
to
identi
f
y
the
opti
mal
pa
th
.
In
ou
r
wor
k,
the
mas
ter
c
ontr
oll
e
r
s
e
nds
the
pa
c
ke
t
to
the
NI
DS
s
e
r
ve
r
,
whic
h
c
ontains
the
tr
a
ined
model.
T
his
m
ode
l
pr
e
dicts
whe
ther
the
pa
c
ke
t
is
nor
mal
or
int
r
us
ion.
In
the
c
a
s
e
of
nor
mal
tr
a
f
f
ic,
the
c
ontr
oll
e
r
identif
ies
the
opti
mal
pa
th
to
f
o
r
wa
r
d
it
to
the
de
s
ti
na
ti
on,
s
e
nds
the
ins
tr
uc
ti
on
ba
c
k
to
the
s
witch,
a
nd
a
dds
a
ne
w
f
l
ow
e
ntr
y
in
R
e
dis
s
tor
a
ge
.
If
it
is
an
int
r
us
ion
t
r
a
f
f
ic
the
c
ontr
oll
e
r
a
dds
a
f
low
e
ntr
y
to
block
the
s
our
c
e
ho
s
t.
T
a
ble
5.
DNN
tr
a
ini
ng
model
T
r
a
f
f
ic
T
ype
P
r
e
c
is
io
n
R
e
c
a
ll
F1
-
s
c
or
e
B
ot
ne
t
0.9984
0.9936
0.9960
B
r
ut
e
-
F
or
c
e
0.9993
0.9815
0.9903
D
D
oS
-
I
C
M
P
1.0
1.0
1.0
D
D
oS
-
UDP
0.9991
0.9994
0.9992
D
oS
-
S
Y
N
1.0
1.0
1.0
D
oS
-
UDP
1.0
0.9998
0.9999
E
xpl
oi
ta
ti
on
0.9936
0.9975
0.9956
M
a
lwa
r
e
0.9987
0.9944
0.9966
M
ir
a
i
0.9999
0.9989
0.9994
N
or
ma
l
0.9994
0.9975
0.9985
P
r
obe
1.0
0.9991
0.9995
R
2L
-
I
M
A
P
1.0
1.0
1.0
R
e
c
on
-
P
in
gS
w
e
e
p
0.9936
0.9984
0.9960
R
e
c
on
-
S
ni
f
f
in
g
0.9983
1.0
0.9991
S
poof
in
g
1.0
1.0
1.0
U
2R
0.9893
1.0
0.9946
Web
-
A
tt
a
c
k
0.9908
1.0
0.9953
5.
RE
S
UL
T
S
AND
DI
S
CU
S
S
I
ON
T
he
s
ys
tema
ti
c
r
e
view
pr
e
s
e
nts
a
thor
ough
s
tudy
of
many
r
e
s
e
a
r
c
h
s
our
c
e
s
to
a
s
s
e
s
s
a
nd
s
ynthe
s
ize
inf
or
mation
a
bout
f
e
de
r
a
ted
DL
a
nomaly
int
r
us
ion
de
tec
ti
on
in
S
DN
-
ba
s
e
d
I
oT
.
T
he
f
ind
ings
c
oll
e
c
ted
indi
c
a
te
a
va
r
iety
of
tec
hniques
a
nd
pr
a
c
ti
c
e
s
in
the
e
xe
c
uti
on
of
the
pr
opos
e
d
methodology.
T
his
s
e
c
ti
on
e
xplains
the
r
e
s
e
a
r
c
h
f
indi
ngs
,
whic
h
of
f
e
r
a
s
umm
a
r
y
of
the
pr
e
s
e
nt
s
tudy.
5.
1.
S
t
at
is
t
ical
m
e
t
r
ics
S
e
ve
r
a
l
pe
r
f
o
r
manc
e
indi
c
a
tor
s
ha
ve
be
e
n
de
f
ined
f
or
the
mul
ti
-
c
las
s
c
onf
us
ion
matr
ix
to
e
va
luate
the
e
f
f
e
c
ti
ve
ne
s
s
of
the
model
.
T
he
mul
ti
-
c
las
s
c
onf
us
ion
matr
ix
is
an
N×
N
matr
ix,
whe
r
e
N
r
e
pr
e
s
e
nts
the
number
of
unique
c
las
s
labe
ls
(
C
0,
C
1,
...,
C
N)
.
M
a
tr
ix
c
e
ll
s
a
r
e
de
ter
mi
ne
d
by
the
output
c
ons
is
ti
ng
of
the
pr
e
dicte
d
labe
l,
whic
h
may
be
e
it
he
r
pos
it
ive
or
ne
ga
ti
ve
,
that
c
omes
out
of
c
ompar
ing
the
pr
e
dic
ted
labe
l
with
the
a
c
tual
c
las
s
labe
l,
whic
h
can
be
e
it
he
r
no
r
mal
or
a
tt
a
c
k
[
42]
.
As
a
r
e
s
ult
,
the
tr
a
dit
ional
c
las
s
if
ica
ti
on
of
tr
ue
pos
it
ive
(
T
P
)
,
tr
ue
ne
ga
ti
ve
(
T
N)
,
f
a
ls
e
pos
it
ive
(
F
P
)
,
a
nd
f
a
ls
e
ne
ga
ti
ve
(
F
N)
c
a
s
e
s
be
c
omes
ir
r
e
leva
nt.
Al
ter
na
ti
ve
ly,
a
mo
r
e
a
ppr
opr
iate
a
pp
r
oa
c
h
e
ntails
f
oc
us
ing
on
c
e
r
tain
c
las
s
e
s
.
T
his
t
e
c
hnique
a
ll
ows
f
or
the
f
o
r
mul
a
ti
on
of
c
las
s
-
s
pe
c
if
ic
metr
ics
.
By
a
de
ptl
y
mer
ging
thes
e
mea
s
ur
e
ments
that
a
r
e
dis
ti
nc
t
to
each
c
las
s
,
a
c
ompr
e
he
ns
ive
c
oll
e
c
ti
on
of
metr
ics
f
or
the
whole
c
onf
us
ion
matr
ix
can
be
obt
a
ined,
as
e
xe
mpl
if
ied
in
(
1)
to
(
5
)
[
43]
.
=
∑
(
)
=
1
∑
∑
,
=
1
=
1
(
1)
1
(
)
=
2
(
)
(
)
(
)
+
(
)
(
2)
(
)
=
(
)
(
)
+
(
)
(
3)
Evaluation Warning : The document was created with Spire.PDF for Python.
I
nt
J
Ar
ti
f
I
ntell
I
S
S
N:
2252
-
8938
F
e
de
r
ated
de
e
p
lear
ning
int
r
us
ion
de
tec
ti
on
s
y
s
te
m
on
s
oft
w
ar
e
de
fi
ne
d
-
ne
tw
or
k
…
(
He
ba
Dhir
ar
)
3117
(
)
=
(
1
+
2
)
(
)
(
)
2
(
)
+
(
)
(
4)
(
)
=
(
)
(
)
+
(
)
(
5)
5.
2.
E
xp
e
r
im
e
n
t
al
r
e
s
u
lt
s
T
he
im
p
leme
ntation
of
the
DL
model
uti
li
z
e
d
T
e
ns
or
F
low
,
Ke
r
a
s
,
a
nd
S
c
iki
t
-
L
e
a
r
n
as
the
unde
r
lyi
ng
tec
hnology
a
nd
wa
s
e
xe
c
uted
unde
r
th
e
gr
a
phics
pr
oc
e
s
s
ing
unit
(
GPU
)
T4
x2
e
nvir
onm
e
nt.
T
he
pr
oc
e
s
s
of
FL
wa
s
e
xa
mi
ne
d
f
or
20
r
ounds
the
e
va
luation
pa
r
a
mete
r
s
f
o
r
each
r
ound
a
r
e
il
lus
t
r
a
ted
in
T
a
ble
6.
In
the
f
ir
s
t
r
ound,
only
one
c
li
e
nt
wa
s
us
e
d
whic
h
obs
e
r
ve
d
a
h
igh
de
tec
ti
on
los
s
,
r
e
a
c
hing
2.
8321
a
nd
an
a
c
c
ur
a
c
y
of
0
.
0841.
T
h
is
can
be
a
tt
r
ibut
e
d
to
the
li
mi
ted
dive
r
s
it
y
a
nd
ins
uf
f
icie
nt
tr
a
in
i
ng
da
ta.
C
ompar
a
ti
ve
ly,
r
unning
the
model
us
ing
thr
e
e
c
li
e
nts
f
or
jus
t
one
r
ound,
de
c
r
e
a
s
e
d
the
los
s
to
0
.
0
987,
a
nd
incr
e
a
s
e
d
the
a
c
c
ur
a
c
y
to
0.
9749
.
F
or
both
s
c
e
na
r
ios
,
the
tes
ts
we
r
e
c
onduc
ted
f
or
50
e
poc
hs
,
wi
th
a
ba
tch
s
ize
of
250
a
nd
Ada
m
opti
m
ize
r
due
to
i
ts
a
da
pti
v
e
lea
r
ning
r
a
te
f
e
a
tur
e
s
a
nd
dur
a
bil
it
y
.
Af
ter
c
ompl
e
ti
ng
the
20
tr
a
ini
ng
r
ounds
,
ther
e
is
a
s
igni
f
ica
nt
e
nha
nc
e
ment
in
a
c
c
ur
a
c
y,
r
is
ing
f
r
om
99.
76
to
99
.
89%
.
In
a
d
dit
ion,
a
notable
r
e
duc
ti
on
de
mons
tr
a
ted
in
los
s
de
c
r
e
a
s
e
d
f
r
om
0.
01
in
the
s
tanda
r
d
c
e
ntr
a
li
z
e
d
tr
a
ini
ng
pr
oc
e
dur
e
to
0.
005
in
the
f
e
de
r
a
ted
DL
s
c
e
na
r
io.
F
igur
e
5
il
lus
t
r
a
tes
the
r
e
s
ult
s
of
each
c
yc
le,
with
F
igur
e
5
(
a
)
s
h
owing
an
im
pr
ove
ment
in
e
nha
nc
e
ment
a
nd
F
igur
e
5
(
b)
indi
c
a
ti
ng
a
los
s
r
e
duc
ti
on.
T
a
ble
6.
F
e
de
r
a
ted
DL
tr
a
ini
ng
r
e
s
ult
s
R
ound
C
li
e
nt
1
C
li
e
nt
2
C
li
e
nt
3
F
e
dA
vg
A
c
c
ur
a
c
y
L
os
s
A
c
c
ur
a
c
y
L
os
s
A
c
c
ur
a
c
y
L
os
s
A
c
c
ur
a
c
y
L
os
s
1
0.9745
0.0986
0.9751
0.0984
0.9750
0.0984
0.9749
0.0987
2
0.9964
0.0131
0.9955
0.0142
0.9959
0.0136
0.9959
0.0139
3
0.9980
0.0093
0.9979
0.0093
0.9980
0.0093
0.9978
0.0094
4
0.9982
0.0090
0.9981
0.0089
0.9981
0.0090
0.9980
0.0091
5
0.9981
0.0089
0.9981
0.0086
0.9981
0.0088
0.9980
0.0088
6
0.9984
0.0078
0.9984
0.0077
0.9984
0.0078
0.9983
0.0079
7
0.9983
0.0079
0.9984
0.0077
0.9983
0.0079
0.9982
0.0079
8
0.9987
0.0068
0.9987
0.0068
0.9987
0.0069
0.9986
0.0069
9
0.9984
0.0073
0.9984
0.0071
0.9984
0.0072
0.9983
0.0073
10
0.9987
0.0069
0.9987
0.0069
0.9987
0.0070
0.9986
0.0070
11
0.9988
0.0064
0.9988
0.0064
0.9988
0.0064
0.9987
0.0065
12
0.9987
0.0066
0.9987
0.0066
0.9987
0.0066
0.9986
0.0067
13
0.9988
0.0060
0.9988
0.0060
0.9988
0.0060
0.9987
0.0061
14
0.9987
0.0067
0.9987
0.0068
0.9987
0.0068
0.9986
0.0069
15
0.9988
0.0060
0.9989
0.0061
0.9988
0.0061
0.9988
0.0061
16
0.9989
0.0057
0.9989
0.0057
0.9989
0.0058
0.9988
0.0058
17
0.9989
0.0056
0.9989
0.0056
0.9989
0.0057
0.9988
0.0057
18
0.9989
0.0059
0.9989
0.0059
0.9989
0.0059
0.9988
0.0060
19
0.9989
0.0059
0.9989
0.0059
0.9989
0.0059
0.9988
0.0060
20
0.9989
0.0057
0.9989
0.0057
0.9989
0.0057
0.9988
0.0057
(
a
)
(
b)
F
igur
e
5.
C
li
e
nt
t
r
a
ini
ng
met
r
ics
r
e
s
ult
s
f
or
(
a
)
mo
de
l
a
c
c
ur
a
c
y
metr
ic
f
o
r
the
c
li
e
nts
a
nd
F
e
dAvg
a
nd
(
b)
model
los
s
metr
ic
f
or
the
c
li
e
nts
a
nd
F
e
dAvg
Evaluation Warning : The document was created with Spire.PDF for Python.
I
S
S
N
:
2252
-
8938
I
nt
J
Ar
ti
f
I
ntell
,
Vol.
14,
No.
4,
Augus
t
2025
:
310
9
-
3120
3118
6.
CONC
L
USI
ON
T
his
wor
k
pr
e
s
e
nts
a
f
e
de
r
a
ted
DL
f
or
NI
DS
in
an
I
oT
c
ontext
in
a
mul
ti
-
c
ontr
oll
e
r
S
DN
ne
twor
k,
us
ing
I
P
F
S
as
the
unde
r
ly
ing
tec
hnology
a
nd
the
AE
S
e
nc
r
ypt
ion
a
lgo
r
it
hm
to
he
lp
im
pr
ove
the
s
e
c
ur
it
y
of
the
a
ggr
e
ga
ti
on
a
nd
tr
a
ini
ng
.
A
c
us
tom
-
ge
ne
r
a
ted
da
tas
e
t
of
in
tr
a
-
a
nd
int
e
r
-
a
tt
a
c
ks
wa
s
uti
li
z
e
d
to
e
xtr
a
c
t
int
e
r
na
l
f
e
a
tur
e
r
e
p
r
e
s
e
ntations
to
de
tec
t
a
nd
c
las
s
if
y
a
tt
a
c
ks
.
T
he
pr
opos
e
d
a
r
c
hit
e
c
tur
e
s
uc
c
e
s
s
f
ull
y
mi
ti
ga
tes
DoS
a
nd
DD
oS
a
tt
a
c
ks
onc
e
the
a
tt
a
c
k
t
hr
e
s
hold
is
r
e
a
c
he
d
on
the
c
ontr
oll
e
r
to
a
void
f
loo
ding
the
I
DS
s
e
r
ve
r
,
whe
r
e
the
s
ugge
s
ted
model
pos
s
e
s
s
e
s
an
a
c
c
ur
a
c
y
of
99.
89%
in
identif
ying
s
e
ve
r
a
l
a
tt
a
c
k
types
de
mons
tr
a
ted
s
upe
r
ior
pe
r
f
or
manc
e
in
both
the
d
e
tec
ti
on
a
nd
c
las
s
if
ica
ti
on
of
a
tt
a
c
ks
u
s
ing
F
L
,
s
ur
pa
s
s
ing
c
onve
nti
ona
l
DL
f
or
the
s
a
me
model
.
T
he
r
e
s
ult
s
hows
a
dr
op
in
los
s
f
r
om
0.
01
in
the
s
tanda
r
d
c
e
ntr
a
li
z
e
d
tr
a
ini
ng
pr
oc
e
dur
e
that
u
ti
li
z
e
s
the
DL
model
to
0.
005
in
the
f
e
de
r
a
ted
DL
s
c
e
na
r
io.
In
a
ddi
ti
on,
t
he
r
e
is
a
s
igni
f
ica
nt
e
nha
nc
e
ment
in
a
c
c
ur
a
c
y,
r
is
ing
f
r
om
99.
76
to
99.
89
%
.
T
he
s
ugge
s
ted
tec
hnique
can
a
p
ply
to
a
wide
r
a
nge
of
s
it
ua
ti
ons
a
nd
may
be
include
d
as
a
c
omponent
in
a
r
e
a
l
-
time
S
DN
-
I
oT
e
nvi
r
on
ment.
I
ts
pur
pos
e
is
to
de
tec
t
a
ny
a
tt
a
c
ks
a
nd
c
las
s
if
y
them
int
o
c
e
r
tain
types
,
c
a
us
ing
an
a
lar
m
.
T
he
c
ur
r
e
nt
wor
k
is
s
ubopti
mal.
I
ns
tea
d
of
us
ing
a
method
that
s
e
lec
ts
a
ll
the
c
ha
r
a
c
ter
is
ti
c
s
,
it
would
be
mor
e
e
f
f
e
c
ti
ve
to
a
pply
ke
r
ne
l
-
ba
s
e
d
m
e
thods
to
c
hoos
e
the
idea
l
f
e
a
tur
e
s
.
T
his
may
s
igni
f
ica
ntl
y
e
nha
nc
e
the
e
f
f
e
c
ti
ve
ne
s
s
of
the
S
DN
-
I
oT
I
DS
.
In
a
ddit
ion,
doing
a
tho
r
ough
e
xa
mi
na
ti
on
a
nd
e
va
luation
of
the
model
a
nd
a
nothe
r
model
ins
ide
the
e
nvir
onment
is
c
r
uc
ial,
as
the
major
it
y
of
ML
a
nd
DL
models
a
r
e
s
us
c
e
pti
ble
to
a
dve
r
s
a
r
ial
a
tt
a
c
ks
.
F
UN
DI
NG
I
NF
ORM
AT
I
ON
Author
s
s
tate
no
f
unding
invol
ve
d.
AU
T
HO
R
CONT
RI
B
U
T
I
ONS
S
T
AT
E
M
E
N
T
T
his
jour
na
l
us
e
s
the
C
ontr
ibut
o
r
R
oles
T
a
xo
nomy
(
C
R
e
diT
)
to
r
e
c
ognize
indi
vidual
a
uthor
c
ontr
ibut
ions
,
r
e
duc
e
a
utho
r
s
hip
dis
putes
,
a
nd
f
a
c
il
it
a
te
c
oll
a
bor
a
ti
on.
Nam
e
of
Au
t
h
or
C
M
So
Va
Fo
I
R
D
O
E
Vi
Su
P
Fu
He
ba
Dhir
a
r
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
Ali
H
.
Ha
mad
✓
✓
✓
✓
✓
✓
✓
C
:
C
onc
e
pt
ua
li
z
a
ti
on
M
:
M
e
th
odol
ogy
So
:
So
f
twa
r
e
Va
:
Va
li
da
ti
on
Fo
:
Fo
r
ma
l
a
na
ly
s
is
I
:
I
nve
s
ti
ga
ti
on
R
:
R
e
s
our
c
e
s
D
:
D
a
ta
C
ur
a
ti
on
O
:
W
r
it
in
g
-
O
r
ig
in
a
l
D
r
a
f
t
E
:
W
r
it
in
g
-
R
e
vi
e
w
&
E
di
ti
ng
Vi
:
Vi
s
ua
li
z
a
ti
on
Su
:
Su
pe
r
vi
s
io
n
P
:
P
r
oj
e
c
t
a
dmi
ni
s
tr
a
ti
on
Fu
:
Fu
ndi
ng a
c
qui
s
it
io
n
CONF
L
I
CT
OF
I
NT
E
RE
S
T
S
T
AT
E
M
E
N
T
T
he
a
uthor
s
de
c
lar
e
that
they
ha
ve
no
c
onf
li
c
ts
of
i
nter
e
s
t
r
e
late
d
to
th
is
wor
k.
DA
T
A
AV
AI
L
A
B
I
L
I
T
Y
T
he
da
ta
that
s
uppor
t
the
f
indi
ngs
of
thi
s
s
tudy
a
r
e
ope
nly
a
va
il
a
ble
on
Ka
ggle
a
t
htt
ps
:/
/www
.
ka
ggle.
c
om/
da
tas
e
ts
/heba
dhir
a
r
/s
dn
-
i
ot,
unde
r
the
ti
tl
e
S
DN
-
I
oT
I
ntr
us
ion
De
tec
ti
on
Da
tas
e
t.
RE
F
E
RE
NC
E
S
[
1]
A.
A
lr
a
w
a
is
,
A.
A
lh
ot
ha
il
y,
C.
H
u,
a
nd
X.
C
he
ng,
“
F
og
c
omput
in
g
f
or
th
e
in
te
r
ne
t
of
th
in
gs
:
s
e
c
ur
it
y
a
nd
pr
iv
a
c
y
is
s
ue
s
,”
I
E
E
E
I
nt
e
r
ne
t
C
om
put
in
g
,
vol
.
21,
no.
2,
pp.
34
–
42,
M
a
r
.
2017,
doi
:
10.1109/M
I
C
.2017.37.
[
2]
L.
L
iu
,
B.
X
u,
X.
Z
ha
ng,
a
nd
X.
W
u,
“
A
n
in
tr
us
io
n
de
t
e
c
ti
on
me
th
od
f
or
in
te
r
ne
t
of
th
in
gs
ba
s
e
d
on
s
uppr
e
s
s
e
d
f
uz
z
y
c
lu
s
te
r
in
g,”
E
ur
as
ip
J
our
nal
on
W
ir
e
le
s
s
C
o
m
m
uni
c
at
io
ns
and
N
e
tw
or
k
in
g
,
vol
.
2018,
no.
1,
2018,
doi
:
10.1186/s
13638
-
018
-
1128
-
z.
[
3]
H.
Q
us
ht
om
a
nd
K.
R
a
ba
ya
’
h,
“
E
nha
nc
in
g
th
e
Q
oS
of
I
oT
ne
twor
ks
w
it
h
li
ght
w
e
ig
ht
s
e
c
ur
it
y
pr
ot
oc
ol
us
in
g
C
ont
ik
i
O
S
,”
I
nt
e
r
nat
io
nal
J
our
nal
of
C
om
put
e
r
N
e
tw
o
r
k
and
I
nf
or
m
at
io
n
Se
c
u
r
it
y
,
vol
.
9,
no.
11,
pp.
27
–
35,
20
17,
doi
:
10.5815/i
jc
ni
s
.2017.11.03.
[
4]
Y.
L
i,
R.
M
a
,
a
nd
R.
J
ia
o,
“A
hybr
id
ma
li
c
io
us
c
ode
de
te
c
ti
on
me
th
od
ba
s
e
d
on
de
e
p
le
a
r
ni
ng,”
I
nt
e
r
nat
io
nal
J
our
nal
of
Se
c
ur
it
y
and
its
A
ppl
ic
at
io
ns
,
vol
.
9,
no.
5,
pp.
205
–
216,
2015,
doi
:
10.14257/i
js
ia
.2015.9.5.21.
[
5]
J.
K
one
č
ný,
H.
B.
M
c
M
a
ha
n,
F.
X.
Y
u,
P.
R
ic
ht
á
r
ik
,
A.
T.
S
u
r
e
s
h,
a
nd
D.
B
a
c
on,
“
F
e
d
e
r
a
te
d
le
a
r
ni
ng:
s
tr
a
te
gi
e
s
f
or
im
pr
ovi
ng
c
omm
uni
c
a
ti
on
e
f
f
ic
ie
nc
y,”
ar
X
iv
-
C
om
put
e
r
S
c
ie
nc
e
, pp. 1
-
10,
2016
.
[
6]
P.
B
ooba
la
n
et
al
.
,
“
F
us
io
n
of
f
e
de
r
a
te
d
le
a
r
ni
ng
a
nd
in
dus
tr
ia
l
in
te
r
ne
t
of
th
in
gs
:
a
s
ur
ve
y,”
C
om
put
e
r
N
e
tw
or
k
s
,
vol
.
212,
2022,
doi
:
10.1016/j
.c
omne
t.
2022.109048.
Evaluation Warning : The document was created with Spire.PDF for Python.