{"id":"fdb0d573-2079-4e6b-adfe-aadb59abfa5f","arxiv_id":"2501.18549","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"CryptoDNA is a Random Forest based DDoS detector for healthcare IoT, inspired by cryptojacking detection, claiming 96.8% accuracy on a mix of CICDDoS2019 and synthetic data.","lead":"This paper describes CryptoDNA, a machine learning framework that borrows behavioral features from cryptojacking detection to spot DDoS attacks on healthcare IoT devices. The authors report 96.8% accuracy and a 2.1% false positive rate, but provide no code, dataset, or experimental protocol to verify these numbers.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 96.8% accuracy and 2.1% FPR claims rest on an unreleased, unvalidated synthetic healthcare dataset; without code or data, the central result cannot be checked.","rationale":"I agree with the reader's REJECT. The single most load-bearing issue is not that a cryptojacking-inspired method is conceptually implausible, but that the evidence for the headline performance is inaccessible. The synthetic dataset is the only link between the method and healthcare IoT, and its generation is described only as a test scenario with 100 Raspberry Pi and Arduino devices; no validation, release, or feature-level statistics are provided. Even the public CICDDoS2019 evaluation lacks a protocol: there is no documented split, no hyperparameter list, and no code. The incorrect F1 formula in Eq. (4) adds concrete reason to suspect the metric computation itself, although it does not directly affect the reported accuracy or FPR. Because the paper's central claim is empirical, the absence of artifacts prevents verification, not merely reduces confidence. I did not identify a separate internal mathematical inconsistency, and the broad idea of lightweight behavioral monitoring for medical IoT is reasonable; the failure is one of evidence. Therefore my read does not change the reader's verdict.","tokens_in":6591,"tokens_out":3596,"duration_ms":41487,"concrete_test":"Obtain from the authors the CryptoDNA repository and the synthetic-data generator with its configuration; reproduce Table 1 row 1 on the exact train/test partition of CICDDoS2019 and recompute the synthetic-data metrics from the released 10k-event set. If the reproduced accuracy or FPR differs by more than 1 percentage point, the headline result is not robust. If the artifacts are not provided, the central performance claim should remain unverified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central quantitative claim — 96.8% accuracy, 97.3% detection rate, 2.1% FPR, 12 ms latency in Table 1 — is not falsifiable as presented. The healthcare-specific evidence is a self-generated 10,000-event synthetic dataset produced by a simulated 100-device facility (Methodology, Testing), with no validation against real healthcare IoT traffic, no data release, and no working GitHub link. CICDDoS2019, the only public dataset, is not healthcare-specific, so it cannot independently support the healthcare claim. In addition, the paper gives no train/test split, hyperparameters, or random seed, and Eq. (4) defines F1-Score as Precision × Recall / (Precision + Recall), missing the factor of 2. Individually these gaps could be fixed; together they mean that even a correct implementation could not be distinguished from one with arbitrary results. The problem is not that the approach is impossible, but that its main evidence is unavailable.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes CryptoDNA, a machine-learning DDoS detection framework for healthcare IoT that adapts behavioral features from cryptojacking detection, including packet entropy, request frequency, CPU/memory usage, and time-series deviations. The primary classifier is a Random Forest with pruning and quantization, plus an autoencoder anomaly-detection variant. The evaluation uses CICDDoS2019 and a self-generated synthetic dataset of 10,000 events from a simulated 100-device healthcare facility. The paper reports 96.8% accuracy, 97.3% detection rate, 2.1% FPR, and 12 ms average latency, and compares these against two baselines (S1, S2) in Table 1, concluding that CryptoDNA outperforms existing DDoS detection models.","tokens_in":6762,"tokens_out":3806,"duration_ms":36497,"significance":"If the reported performance were reproducible, the work would be a useful contribution to lightweight DDoS detection in healthcare IoT, particularly the cross-domain transfer from cryptojacking detection. The claimed 35% model-size reduction and 12 ms inference latency are relevant to resource-constrained devices. However, the paper currently provides no code, no dataset, no hyperparameters, no train/test split, and an incorrect F1-score formula, so the central quantitative claims cannot be verified. The interdisciplinary framing is conceptually interesting but is not backed by evidence at the standard required for a journal publication.","major_comments":[{"comment":"Equation (4) defines F1-score as Precision × Recall / (Precision + Recall), missing the factor of 2. The correct harmonic mean is 2 × Precision × Recall / (Precision + Recall). If the reported F1 values were computed with Eq. (4), they are systematically half the true value, which directly affects the evaluation claims in the Results section.","section":"Evaluation Metrics, Eq. (4)"},{"comment":"The evaluation is not reproducible. The paper states that the model was trained over 50 epochs and that code is publicly available on GitHub under the CryptoDNA Project, but no repository URL, random seed, hyperparameters, cross-validation folds, or train/test split are given. For a Random Forest, 'epochs' is not a meaningful training quantity, which suggests the training protocol is not described accurately. Without these details, the reported 96.8% accuracy and 2.1% FPR cannot be independently checked.","section":"Methodology, Machine Learning Model"},{"comment":"The synthetic healthcare dataset is not validated and not released. The dataset is described only as 10,000 events generated from a simulated 100-device facility using Raspberry Pi and Arduino boards, limited to text-based TCP/UDP traffic. No comparison against real healthcare IoT traffic or any statistical validation is provided. Since CICDDoS2019 is not healthcare-specific, the healthcare-IoT claim rests entirely on this unvalidated synthetic set.","section":"Methodology, Testing"},{"comment":"Table 1's baseline comparison lacks a protocol. It is unclear whether S1 (Almiani et al. 2020) and S2 (Mothukuri et al. 2021) were re-implemented, re-run on the same data, or whether their numbers were copied from the original papers. No confidence intervals, standard deviations, or experimental conditions are reported. The 'Model Size Reduction (%)' row compares against a baseline that is not defined. Consequently, the claim that CryptoDNA 'outperformed existing DDoS detection models' is not supported.","section":"Results, Table 1"},{"comment":"The adaptability claim for zero-day attacks is not substantiated. The Results section reports a recall of 94.6% for 'synthetic zero-day attack patterns' but does not describe how these patterns were generated, how they differ from the training attack types, or how the threshold adaptation works. This is load-bearing for the paper's claim of resilience against emerging attack vectors.","section":"Results, Result Compression"}],"minor_comments":[{"comment":"There are multiple typos, e.g., 'P ercision' in Eq. (2) text, 'Healthare IoT' in a section heading, 'crypto jacking' in the title and abstract, and 'Fig1' without a space.","section":"Throughout"},{"comment":"The reference Mollah, Shovon, and Roy (2024) is cited for a blockchain-based healthcare IoT architecture, but the listed title is about cyclone Remal vulnerability in Bangladesh; this citation appears mismatched.","section":"References"},{"comment":"Figure 8 (confusion matrix) is not described in the text and its entries are not reported, so the reader cannot derive accuracy, precision, recall, or FPR from it.","section":"Results, Figure 8"},{"comment":"The '29.3 attacks per day in 2024' statistic in the Introduction is not sourced.","section":"Introduction, Figure 1"},{"comment":"The equations are referred to as (1)-(4) in the text but are displayed without equation numbers.","section":"Evaluation Metrics"}],"recommendation":"reject","confidential_remarks":"The manuscript would need a substantially revised evaluation with released code and data, a corrected F1 formula, and validated synthetic data before I could consider it for publication. I also note the mismatched Mollah et al. reference and the unexplained '50 epochs' for a Random Forest, which raise concerns about the care with which the experiments were reported. The paper may be better positioned as a short position paper if the authors cannot provide the full evaluation artifacts."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this paper has a reasonable idea and no verifiable evidence. The cross-domain move—borrowing cryptojacking detection's resource-behavior monitoring for DDoS in healthcare IoT—is worth a look. The paper does a decent job of motivating the healthcare-specific constraints and proposing a lightweight Random Forest with pruning and quantization. That is a legitimate direction, and the authors clearly know the related work on cryptojacking detection.\n\nWhat's new is the framing, not the algorithm. The feature set (packet entropy, request frequency, bandwidth, CPU/memory, time-series deviations) is standard fare for anomaly-based DDoS detection. The 'cryptojacking-inspired' label doesn't introduce a new detection signal or a new model family. So the novelty is modest.\n\nThe soft spots are where the reader and stress-test land, and they're right. The central claims—96.8% accuracy, 97.3% detection rate, 2.1% FPR, 12ms latency—rest on an unreleased synthetic dataset and a public dataset (CICDDoS2019) that isn't healthcare-specific. There's no code, no hyperparameters, no train/test split, no random seed. The GitHub link is stated but not verified. The synthetic data is described as 10,000 events from a simulated 100-device facility, but there's no validation that this resembles real healthcare traffic. Equation (4) has an incorrect F1 formula (missing the factor of 2). Table 1's baseline numbers have no reproduction protocol. Individually these are fixable; together they make the result unfalsifiable. Even a correct implementation couldn't be distinguished from one with arbitrary numbers.\n\nThe limitations section only mentions labeled-data dependence, not the missing artifacts, which is a notable omission. The paper is not incoherent—the idea is plausible, and the authors are honest about the broad limitations—but the evidence isn't there.\n\nWho is this for? Someone working on IoT DDoS detection might find the cross-domain framing a useful pointer, but they can't build on the reported results. I'd send it to peer review only with an explicit demand for the artifacts and a proper ablation; otherwise, it's a desk reject on reproducibility grounds. A serious referee could help the authors turn this into a publishable empirical study, but the current version is not one.","headline":"Sensible idea, missing evidence—the paper's central results cannot be checked.","tokens_in":7301,"tokens_out":2350,"would_cite":false,"duration_ms":23786,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The CryptoDNA framework transfers cryptojacking-detection clues—traffic entropy, resource-use spikes, time-series deviations—to catch DDoS attacks on hospital IoT devices with 96.8% accuracy at 12 ms per inference.","keywords":["DDoS detection","healthcare IoT","Internet of Medical Things","cryptojacking-inspired features","Random Forest","behavioral analytics","entropy-based traffic analysis","anomaly detection"],"falsifier":"Run the exact feature set and training pipeline on an independent, labeled traffic log from a working hospital IoT network or a publicly available healthcare IoT dataset, and compare accuracy, detection rate, FPR, and latency to the reported 96.8%, 97.3%, 2.1%, and 12 ms; if performance drops materially, the representativeness assumption fails. A smaller first check is to regenerate the synthetic trace from the described 100-device scenario, hold it out, and see whether the model's zero-day recall stays near 94.6%.","tokens_in":6373,"feed_emoji":"🛡️","tokens_out":12880,"duration_ms":122890,"temperature":0.7,"pith_summary":"The paper argues that distributed denial-of-service (DDoS) attacks on healthcare Internet-of-Things devices can be caught with the same behavioral clues used to detect cryptojacking—unauthorized cryptocurrency mining on a victim's machine—namely abnormal CPU and memory use, traffic entropy, and time-series deviations from normal device behavior. It packages those clues into CryptoDNA, a lightweight Random Forest classifier with an autoencoder variant for novel attacks, and tests it on a public DDoS benchmark plus a synthetic 10,000-event trace modeled on a 100-device facility. The reported result is 96.8% accuracy, a 97.3% detection rate, a 2.1% false positive rate, and 12 ms average inference latency after pruning and quantization. If those numbers transfer to live hospitals, the payoff is real-time DDoS screening on low-power medical devices without a cloud round-trip.","feed_headline":"CryptoDNA catches hospital IoT DDoS via miner-style behavior clues","feed_subtitle":"A lightweight Random Forest plus entropy features reports 96.8% accuracy at 12 ms for constrained medical devices.","key_machinery":"The carrying mechanism is a cross-domain feature transfer: DDoS detection is reframed as a resource-behavior anomaly problem, the way cryptojacking detection is framed. The feature set watches packet entropy, request frequency, bandwidth utilization, CPU and memory usage, system-call patterns, time-series deviations, and communication-graph metrics. A Random Forest classifier (an ensemble of decision trees) makes the normal-versus-attack decision on those features, and pruning plus quantization shrink the model by 35% and cut latency by 40%; an autoencoder variant flags patterns that deviate from learned normal behavior, giving the claimed 94.6% recall on synthetic zero-day patterns. The entropy and time-series features are the part carried over from cryptojacking detection, and they are what give the detector its sensitivity to subtle anomalies.","core_discovery":"The paper's central claim is that the behavioral signals used to detect cryptojacking also separate DDoS traffic from normal healthcare IoT traffic. It packages those signals into CryptoDNA, whose primary detector is a pruned and quantized Random Forest and whose auxiliary detector is an autoencoder for zero-day anomalies. Evaluated on a public DDoS benchmark and a synthetic 10,000-event trace modeled on a 100-device facility, the framework reports 96.8% accuracy, a detection rate above 97.3%, a false positive rate of 2.1%, and an average inference latency of 12 ms, beating the two comparison systems on every reported column.","pith_inferences":["If the behavioral transfer generalizes, the same entropy-and-resource feature set could be applied to other critical IoT sectors—power, water, transport—where low-rate DDoS and strict device resource limits coincide.","The 94.6% recall on synthetic zero-day patterns suggests a concrete testable path: retrain the autoencoder variant on unlabeled real traffic and measure whether unsupervised detection approaches the supervised 96.8% accuracy.","Because inference runs in about 12 ms on the compressed model, a practical extension is an on-device confirmation loop that flags an alert only when anomalous readings persist over several ticks, trading a small latency increase for even fewer false positives."],"forward_implications":["If the reported numbers hold, hospitals could run continuous DDoS screening on the low-power devices already on the network, with each decision taking about 12 ms.","A false positive rate near 2% means far fewer spurious alerts than conventional anomaly systems, which matters in an ICU where alarms already compete for attention.","Because the features are behavioral rather than signature-based, the same detector should recognize both high-rate floods (SYN, HTTP) and slow, low-rate attacks that never match a known pattern.","The 35% model-size and 40% latency reductions from pruning and quantization make the model fit edge deployment without a cloud round-trip.","The autoencoder variant offers a path to zero-day DDoS detection in environments where labeled attack data is scarce, with 94.6% recall on the synthetic novel-attack test."],"supporting_citations":[{"why":"It frames healthcare IoT as critical infrastructure and motivates the need for DDoS defense, which is the problem the framework targets.","marker":"Djenna, Harous, and Saidouni 2021"},{"why":"It provides the deep-learning DDoS detection baseline that CryptoDNA is compared against in the results table.","marker":"Almiani et al. 2020"},{"why":"It provides the federated-learning anomaly detection baseline used in the comparative results table.","marker":"Mothukuri et al. 2021"},{"why":"It supplies a cryptojacking covert-attack detection method whose behavioral features serve as the conceptual template for CryptoDNA's feature transfer.","marker":"Xu et al. 2023"},{"why":"It grounds the behavior-based cryptojacking detection approach that motivates monitoring resource usage and network behavior.","marker":"Tanana 2020"},{"why":"It supports entropy-based and time-series methods for detecting cryptojacking on edge and IoT devices, justifying the lightweight feature set.","marker":"Kumar et al. 2024"},{"why":"It is among the cited cryptojacking-detection systems that CryptoDNA adapts to DDoS detection.","marker":"Almurshid et al. 2024"}],"fun_headline_variants":["CryptoDNA: DDoS shield for health IoT, rooted in cryptojacking","Miner-style clues spot DDoS in hospital IoT with 96% accuracy","Healthcare IoT DDoS caught by cryptojacking-derived AI","CryptoDNA: 96.8% DDoS detection for medical devices","Lightweight AI thwarts DDoS in hospital IoT using miner patterns"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire performance story rests on the assumption that the synthetic 10,000-event trace from a simulated 100-device facility behaves enough like real healthcare IoT traffic that the reported accuracy, false-positive rate, and latency carry over to actual hospitals; the paper offers no independent validation of that representativeness.","fun_headline_variants_meta":{"raw":{"variants":["CryptoDNA: DDoS shield for health IoT, rooted in cryptojacking","Miner-style clues spot DDoS in hospital IoT with 96% accuracy","Healthcare IoT DDoS caught by cryptojacking-derived AI","CryptoDNA: 96.8% DDoS detection for medical devices","Lightweight AI thwarts DDoS in hospital IoT using miner patterns"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000613,"raw_usage":{"total_tokens":2836,"prompt_tokens":914,"completion_tokens":1922,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":530,"completion_tokens_details":{"reasoning_tokens":1826}},"tokens_in":530,"tokens_out":1922,"duration_ms":15280,"temperature":1.0,"reasoning_tokens":1826,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T23:01:29.103547+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the exact feature set and training pipeline on an independent, labeled traffic log from a working hospital IoT network or a publicly available healthcare IoT dataset, and compare accuracy, detection rate, FPR, and latency to the reported 96.8%, 97.3%, 2.1%, and 12 ms; if performance drops materially, the representativeness assumption fails. A smaller first check is to regenerate the synthetic trace from the described 100-device scenario, hold it out, and see whether the model's zero-day recall stays near 94.6%.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It frames healthcare IoT as critical infrastructure and motivates the need for DDoS defense, which is the problem the framework targets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It provides the deep-learning DDoS detection baseline that CryptoDNA is compared against in the results table."},{"cited_title":"M.; Pouriyeh, S.; Dehghantanha, A.; and Srivastava, G","cited_arxiv_id":null,"evidence_quote":"It provides the federated-learning anomaly detection baseline used in the comparative results table."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It grounds the behavior-based cryptojacking detection approach that motivates monitoring resource usage and network behavior."},{"cited_title":"J.; Kumar, S.; and Sharma, H","cited_arxiv_id":null,"evidence_quote":"It supports entropy-based and time-series methods for detecting cryptojacking on edge and IoT devices, justifying the lightweight feature set."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It is among the cited cryptojacking-detection systems that CryptoDNA adapts to DDoS detection."}],"review_version":1}