Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models

Afrah Gueriani; Ahmed Cherif Mazari; Hamza Kheddar

REVIEW 4 major objections 3 minor 31 references

Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models

T0 review · 4 major / 3 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LSTM-CNN-Attention reports perfect binary and 99.04% multiclass attack detection on Edge-IIoTset.

desk verdict Routine LSTM-CNN-attention benchmark paper whose 100%/99% results rest on an ambiguous SMOTE/split protocol and a validation set, not a clean held-out test; the empirical claim is unsupported as written. read the letter →

arxiv 2501.13962 v1 pith:RY6BJSV5 submitted 2025-01-21 cs.CR cs.AIcs.LGcs.SYeess.SY

Afrah Gueriani , Hamza Kheddar , Ahmed Cherif Mazari This is my paper · ORCID

classification cs.CRcs.AIcs.LGcs.SYeess.SY

keywords intrusiondetectionsystemindustrialIoTLSTMCNNattentionmechanismSMOTEEdge-IIoTsetcyber-attack

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes a hybrid deep learning model that combines LSTM, CNN, and attention mechanisms to detect and classify cyber-attacks in industrial IoT (IIoT) networks. Using the Edge-IIoTset dataset, the authors report that their best architecture achieves 100% accuracy and a 0% false positive rate in binary classification, and 99.04% accuracy with a 0.002% false positive rate in six-class multiclass classification. They systematically compare nine architecture variants and find that adding attention and dropout to an LSTM-CNN base improves performance, outperforming several prior state-of-the-art methods on the same benchmark. The central claim is that this architecture is a highly accurate and fast intrusion detection solution suitable for real-time IIoT security.

What carries the argument

The core object is a dual-branch neural architecture: a CNN branch with two Conv1D layers, batch normalization, and dropout extracts local spatial features, while an LSTM branch with two LSTM layers and batchnorm captures temporal dependencies. An attention mechanism is applied in both branches to weight the most relevant parts of the input. The branch outputs are concatenated and passed through two dense layers for classification. SMOTE (Synthetic Minority Over-sampling Technique) is applied to rebalance the class distribution before training, which the paper claims improves learning from underrepresented attack types.

What would settle it

Train the same LSTM-CNN-Attention architecture on Edge-IIoTset with SMOTE applied only to the training fold, then evaluate on the untouched test partition; if multiclass accuracy or F1 drops materially below 99.04% or binary accuracy falls below 100%, the original metrics are inflated by leakage.

Watch

Extended reading notes

Core claim

The paper's central claim is that a hybrid LSTM-CNN-Attention architecture (model variant #9) outperforms both simpler deep learning models and existing state-of-the-art approaches on the Edge-IIoTset dataset. The model combines two Conv1D layers for local feature extraction with two LSTM layers for temporal modeling, merges the branches, and applies an attention mechanism before dense layers, with dropout regularization. In binary classification it achieves perfect accuracy, precision, recall, F1-score, and a 0% false positive rate; in multiclass classification it reaches 99.04% accuracy and F1-score with a false positive rate of 0.002%, correctly distinguishing normal traffic from DDoS, information gathering, MITM, injection, and malware attacks. The authors attribute this performance to the complementary strengths of CNN, LSTM, and attention, and to the use of SMOTE to balance the training classes.

Load-bearing premise

The reported performance depends on the assumption that no information from the training set leaks into the validation or test set; the paper does not state clearly whether SMOTE is applied only to the training split, so synthetic samples could appear in evaluation data and inflate the results.

Editorial extensions

If this is right

If the reported results are reproducible, the LSTM-CNN-Attention architecture offers a high-accuracy template for IIoT intrusion detection with near-zero false alarms.
The inference time of 0.0001 seconds per instance would make the model suitable for real-time, edge-deployed security systems.
The systematic comparison of nine model variants provides evidence that attention mechanisms and dropout layers are key contributors to detection performance on tabular network-traffic data.
The approach is directly transferable to other network-security datasets with similar feature structures, potentially improving detection rates beyond Edge-IIoTset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not clarify whether SMOTE is applied before or after the final train-validation split; if synthetic samples generated from training data appear in the validation set, the reported accuracy, FPR, and AUC figures could be inflated by data leakage.
A direct test of this would be to apply SMOTE strictly to the training fold, then evaluate the model on the untouched test partition; a material drop in multiclass accuracy would confirm leakage.
The reported multiclass loss value of 0.0220% appears to be expressed as a percentage rather than a standard cross-entropy value (which would be near zero), so the metric as stated may need clarification.
The same architecture could be benchmarked on more recent IIoT-specific datasets to see whether the attention-based performance advantage persists outside Edge-IIoTset.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the paper is a routine LSTM-CNN-attention mashup, and its headline numbers are not supported by a clean evaluation. All reported metrics are on "validation data," the SMOTE/split order is ambiguous, and no test-set numbers appear anywhere. As written, the central claim (100% binary, 99.04% multiclass) is unverified.

What it does well: it systematically compares nine architecture variants on a public benchmark (Edge-IIoTset), including ablations with and without attention and dropout. That is a reasonable way to show which component helps. The SOTA comparison table is useful, and the paper is short and readable. The literature review cites the relevant prior attention-based CNN/GRU models, so the authors are not overclaiming novelty in the text.

The soft spots are load-bearing. The "Data splitting" subsection says 80/20 train/test; the SMOTE subsection then says "After the application of SMOTE, the dataset is divided into training and validation sets once again." The paper never reports results on the original 20% test split. Table II labels its last column "Validation data (VD)" and the ROC/AUC/confusion-matrix sections all talk about validation. If SMOTE runs before the second split, synthetic samples generated from training data can end up in validation. If the second split is applied to the SMOTE-resampled training portion, validation is still a subset of training. Either way, those numbers are not an unbiased estimate of generalization. Add to that: single run, no seeds, no hyperparameters, no code, and an internal inconsistency where the Introduction promises model #10 but Table I stops at #9 and selects #9. The reported loss "0.0220%" also looks like a unit error (loss is not a percentage).

I don't see a reproducible result here yet. The architecture is standard, and the empirical claim is the whole point of the paper. Without a clean held-out test set or released code, I wouldn't cite it for SOTA or build on it. It might become a modest data point after a re-run with a properly separated test set and full experimental details. As submitted, I would desk reject it; a serious referee would spend most of the time asking for the same missing details.

Referee Report

4 major / 3 minor

Summary. The paper proposes a hybrid LSTM-CNN-Attention architecture for intrusion detection in Industrial IoT, evaluated on the Edge-IIoTset dataset. The authors report near-perfect binary classification (100% accuracy, 0% FPR) and 99.04% multiclass accuracy with a loss of 0.0220, claiming superiority over several deep-learning baselines and prior state-of-the-art methods. The methodology includes an 80/20 train/test split, SMOTE for class imbalance, a comparison of nine model variants, and selection of the best variant based on validation accuracy and loss. The central claim is that the LSTM-CNN-Attention model outperforms all compared models and existing approaches on Edge-IIoTset.

Significance. If the reported results were supported by a clean, reproducible evaluation, the work would provide a modest but useful data point on attention-augmented hybrid models for IIoT intrusion detection. The paper's genuine strengths include a systematic comparison of nine architecture variants, the use of a realistic public dataset, and explicit reporting of precision, recall, F1, and FPR alongside accuracy. However, the evaluation protocol has serious internal inconsistencies and the reported near-perfect metrics conflict with the described validation procedure, so the claimed performance cannot be credited as stated. The contribution is therefore incremental and, in its current form, not verifiable.

major comments (4)

[Section III, 'Data splitting' and 'Addressing class imbalance with SMOTE'] The evaluation protocol is internally inconsistent and does not support the headline numbers. The paper first states that the dataset was split 80% training and 20% testing, but then says that after applying SMOTE the dataset is 'divided into training and validation sets once again.' All reported metrics (Table II, Figure 3, Figure 4, Figure 5) are described as being on 'validation data,' and no results on the initial 20% test set are ever reported. If SMOTE is applied before the second split, synthetic samples derived from training data can appear in the validation set, inflating accuracy, AUC, and FPR. If the second split is applied only to the SMOTE-resampled training portion, the validation set is a subset of the training data and may contain synthetic instances derived from other validation points. In either case, the reported 100% binary and 99.04% multiclass results are not an unbiased estimate of generalization to unseen data.
[Section IV-C, 'Model selection strategy' and Table I] The selection of the best model is performed on the same validation set that is then used to report final performance, so the reported numbers are selection results rather than independent test results. The paper compares nine variants in Table I, chooses #9 as best based on validation accuracy/loss, and then presents #9's validation metrics as the final model performance. There is no separate held-out test set used after model selection, and no indication that the validation set is independent of model choice. This is a selection-based circularity that materially inflates the apparent quality of the chosen model.
[Section I and Table I] There is a factual inconsistency in the model numbering. The Introduction states that the selected model is '#10 LSTM-CNN-Attention model,' but Table I lists only models #1 through #9 and selects #9 as the best. This discrepancy, combined with the absence of any description of model #10, makes it unclear which architecture is actually being proposed and evaluated. The abstract and subsequent sections refer to 'the LSTM-CNN-Attention model' without resolving this ambiguity.
[Section IV-C and Table III] The comparison with state-of-the-art methods in Table III is not adequately controlled. The cited works are evaluated under different preprocessing pipelines, class groupings, train/test splits, and possibly different subsets of Edge-IIoTset; the paper does not state whether the same split and preprocessing were used for the comparators. Without such controls, the claim that the proposed model 'outperformed' all prior work is not established. Additionally, the reported loss value of 0.0220% in the abstract and text appears to be a unit error (loss is not a percentage), which further undermines confidence in the reported metrics.

minor comments (3)

[Abstract and Section IV-C] The paper contains several typographical and grammatical errors, including 'The proposed models was rigorously tested,' 'This later is one of the solutions to limit these suspicious is IDS,' and 'danse layer' instead of 'dense layer.' These should be corrected.
[Section IV-A] The text says 'as illustrated in Figure 3' when referring to the dataset attack types, but Figure 2 is the figure showing attack types with the number of samples. The figure numbering appears to be off.
[Section IV-C] The paper does not provide key hyperparameters (e.g., number of filters, kernel size, number of LSTM units, dropout rate, learning rate, batch size) or a random seed, and no code is made available. This prevents replication of the claimed results and is particularly problematic given the perfectly saturated metrics (100% accuracy, 0% FPR, 100% AUC for all classes).

Circularity Check

1 steps flagged · score 6.0 of 10

Headline accuracy is the model-selection criterion on the same validation set, not a held-out test prediction.

fitted input called prediction [Section III (Data splitting; Addressing class imbalance with SMOTE), Section IV-C (Model selection strategy; Tables I-II; Figure 3)]
"After the application of SMOTE, the dataset is divided into training and validation sets once again. ... The best performing model is the LSTM-CNN-Attention model with a Dropout layer (#9). ... Table II presents the multiclass classification performance of the LSTM-CNN model with attention ... Abbreviation: Validation data (VD)"

The final 100% binary and 99.04% multiclass accuracy numbers are measured on the same 'validation data' used to select #9 as the best variant. Table I compares variants by validation accuracy/loss, and the selected variant is then reported in Table II on 'Validation data'; no result on the initially defined 80/20 test set is ever reported. Thus the headline performance is the selection criterion, not an independent prediction. The SMOTE-before-second-split wording also permits synthetic samples derived from training data to appear in validation, so the reported numbers are even less clearly a generalization estimate.

full rationale

The paper's central performance claim is circular in the evaluation sense rather than the definitional sense. Section III first defines an 80/20 train/test split, but all reported metrics (Table II, Figure 3, ROC/AUC) are explicitly on 'Validation data'. Section IV-C selects model #9 as the best of nine variants by comparing validation accuracy and loss in Table I, then reports the same validation accuracy (99.04%, and 100% for binary) as the final result. The 'prediction' that the LSTM-CNN-Attention model outperforms alternatives is therefore the criterion used to select it, not an independent test-set estimate; no test-set results appear anywhere. The SMOTE paragraph ('After the application of SMOTE, the dataset is divided into training and validation sets once again') leaves open the possibility that synthetic samples generated from the training portion are present in the validation set, further weakening the claim. There is also an internal inconsistency: the Introduction promises model '#10 LSTM-CNN-Attention', while Table I lists only #1-#9 and selects #9. No definitional circularity or load-bearing self-citation was found: the attention equation is standard, and the citations to the authors' prior work are not used to justify the central claim.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central numbers rest on unstated hyperparameters, the benchmark's label quality, the representativeness of synthetic SMOTE samples, and the integrity of the split order. The paper introduces no new entity, theory, or mathematical object.

free parameters (5)

Architecture hyperparameters = not reported
Number of Conv1D filters, LSTM units, dense units, dropout rate, learning rate, and batch size are absent; they directly determine the reported performance.
SMOTE parameters = not reported
The k-neighbors, sampling strategy, and whether class weights are also used are unspecified; these choices change the training distribution and the measured accuracy.
Number of epochs = 19
Training is fixed at 19 epochs without early stopping or repeated runs; the stopping point influences final metrics.
Train/test split ratio = 80/20
The 80/20 split ratio is chosen without justification, and the paper later mentions another training/validation split after SMOTE, making the effective split unclear.
Six-class label grouping = not reported
The 15 attack categories in Edge-IIoTset are mapped to six classes without stating the mapping rules; class boundaries affect accuracy and F1.

assumptions (4)

domain assumption Edge-IIoTset labels are accurate ground truth.
The paper does not audit label quality; all accuracy numbers inherit any errors in the benchmark.
domain assumption SMOTE synthetic samples are representative of real attack distributions.
The model is trained partly on synthetic points; if they are not representative, benchmark accuracy overstates real-world detection.
ad hoc to paper Validation/test data remain independent after SMOTE.
The text says the dataset was split 80/20 and then later divided into training and validation sets again after SMOTE, implying an independence assumption that is never stated or verified.
standard math Attention formula from Vaswani et al. is valid.
Equation (1) is cited from prior literature and used as a standard component.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models." pith.science (2026). https://pith.science/paper/RY6BJSV5

@misc{pith2026250113962,
  author       = {Pith},
  title        = {Pith review of: Adaptive Cyber-Attack Detection in IIoT Using Attention-Based LSTM-CNN Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RY6BJSV5}},
  note         = {Machine review of arXiv:2501.13962}
}

read the original abstract

The rapid expansion of the industrial Internet of things (IIoT) has introduced new challenges in securing critical infrastructures against sophisticated cyberthreats. This study presents the development and evaluation of an advanced Intrusion detection (IDS) based on a hybrid LSTM-convolution neural network (CNN)-Attention architecture, specifically designed to detect and classify cyberattacks in IIoT environments. The research focuses on two key classification tasks: binary and multi-class classification. The proposed models was rigorously tested using the Edge-IIoTset dataset. To mitigate the class imbalance in the dataset, the synthetic minority over-sampling technique (SMOTE) was employed to generate synthetic samples for the underrepresented classes. This ensured that the model could learn effectively from all classes, thereby improving the overall classification performance. Through systematic experimentation, various deep learning (DL) models were compared, ultimately demonstrating that the LSTM-CNN-Attention model consistently outperformed others across key performance metrics. In binary classification, the model achieved near-perfect accuracy, while in multi-class classification, it maintained a high accuracy level (99.04%), effectively categorizing different attack types with a loss value of 0.0220%.

Figures

Figures reproduced from arXiv: 2501.13962 by the authors.

**Figure 1.** The proposed LSTM-CNN-Attention model. First, the model receive an Input layer which represents the input data, The first bloc is the CNN bloc, we have two Conv1D layer use filters to extract local features from the input data. These layers learn patterns in the data through ”kernel” weights. ”Bias” terms adjust the output of the filters. The ”activation” function introduces non-linearity, making the model capable o… view at source ↗

**Figure 2.** The Edge-IIoTset dataset attacks types with the [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Accuracy and loss of the LSTM-CNN-Attention: (a) [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Confusion matrix of the LSTM-CNN-Attention [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: ROC curve of the LSTM-CNN-Attention model for [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 28 canonical work pages

[1]

Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review,

N. Mishra and S. Pandya, “Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review,” IEEE Access, vol. 9, pp. 59 353–59 377, 2021

2021
[2]

Deep learning for cyber threat detection in IoT networks: A review,

A. Aldhaheri, F. Alwahedi, M. A. Ferrag, and A. Battah, “Deep learning for cyber threat detection in IoT networks: A review,” Internet of Things and Cyber- Physical Systems , 2023

work page 2023
[3]

A comprehensive study of DDoS attacks over IoT network and their countermeasures,

P. Kumari and A. K. Jain, “A comprehensive study of DDoS attacks over IoT network and their countermeasures,” Computers & Security , vol. 127, p. 103096, 2023

work page 2023
[4]

A lightweight multi-vector DDoS detection framework for IoT-enabled mobile health informatics systems using deep learning,

A. D. Aguru and S. B. Erukala, “A lightweight multi-vector DDoS detection framework for IoT-enabled mobile health informatics systems using deep learning,” Information Sciences , vol. 662, p. 120209, 2024

work page 2024
[5]

A secure image encryption scheme based on genetic operations and a new hybrid pseudo random number generator,

B. Mondal and T. Mandal, “A secure image encryption scheme based on genetic operations and a new hybrid pseudo random number generator,” Multimedia Tools and Applications , vol. 79, no. 25, pp. 17 497–17 520, 2020

work page 2020
[6]

Enhancing IoT security with cnn and lstm-based intrusion detection systems,

A. Gueriani, H. Kheddar, and A. C. Mazari, “Enhancing IoT security with cnn and lstm-based intrusion detection systems,” in 2024 6th International Conference on Pattern Analysis and Intelligent Systems (PAIS) . IEEE, 2024, pp. 1–7

work page 2024
[7]

Evolution of IoT to IIoT: Applications & challenges,

H. Jaidka, N. Sharma, and R. Singh, “Evolution of IoT to IIoT: Applications & challenges,” in Proc. Int. Conf. Innovative Comput. Commun. (ICICC) , 2020

work page 2020
[8]

Gaainet: A generative adversarial artificial immune network model for intrusion detection in industrial IoT systems,

S. P. Sithungu and E. M. Ehlers, “Gaainet: A generative adversarial artificial immune network model for intrusion detection in industrial IoT systems,” J. Adv. Inf. Technol., vol. 13, no. 5, 2022

work page 2022

Show all 31 references

[9]

Securing a smart home with a transformer- based iot intrusion detection system,

M. Wang, N. Yang, and N. Weng, “Securing a smart home with a transformer- based iot intrusion detection system,” Electronics, vol. 12, no. 9, p. 2100, 2023

2023
[10]

Reinforcement-learning-based intrusion detection in communication networks: A review,

H. Kheddar, D. W. Dawoud, A. I. Awad, Y . Himeur, and M. K. Khan, “Reinforcement-learning-based intrusion detection in communication networks: A review,” IEEE Communications Surveys & Tutorials , pp. 1–46, 2024

2024
[11]

Using ml and dl algorithms for intrusion detection in the industrial internet of things,

N. V . Dalarmelina, P. Arora, B. Kaur, R. I. Meneguette, and M. A. Teixeira, “Using ml and dl algorithms for intrusion detection in the industrial internet of things,” in AI, Machine Learning and Deep Learning . CRC Press, 2023, pp. 243–256

2023
[12]

A hybrid cnn+ lstm-based intrusion detection system for industrial IoT networks,

H. C. Altunay and Z. Albayrak, “A hybrid cnn+ lstm-based intrusion detection system for industrial IoT networks,” Engineering Science and Technology, an International Journal , vol. 38, p. 101322, 2023

2023
[13]

ABDNN-IDS: Attention-based deep neural networks for intrusion detection in industrial IoT,

S. Ullah, W. Boulila, A. Koubaa, Z. Khan, and J. Ahmad, “ABDNN-IDS: Attention-based deep neural networks for intrusion detection in industrial IoT,” in 2023 IEEE 98th V eh. Technol. Conf. (VTC2023-Fall) . IEEE, 2023, pp. 1–5

2023
[14]

Transformers and large language models for efficient intrusion detection systems: A comprehensive survey,

H. Kheddar, “Transformers and large language models for efficient intrusion detection systems: A comprehensive survey,” arXiv preprint arXiv:2408.07583 , 2024

2024 arXiv
[15]

Machine learning and vision transformers for thyroid carcinoma diagnosis: A review,

Y . Habchi, H. Kheddar, Y . Himeur, A. Boukabou, A. Chouchane, A. Ouamane, S. Atalla, and W. Mansoor, “Machine learning and vision transformers for thyroid carcinoma diagnosis: A review,” arXiv preprint arXiv:2403.13843, 2024

2024
[16]

Automatic speech recognition with bert and ctc transformers: A review,

N. Djeffal, H. Kheddar, D. Addou, A. C. Mazari, and Y . Himeur, “Automatic speech recognition with bert and ctc transformers: A review,” in 2023 2nd Int. Conf. on Electronics, Energy and Measurement (IC2EM) , vol. 1. IEEE, 2023, pp. 1–8

2023
[17]

A self- attention-based deep convolutional neural networks for IIoT networks intrusion detection,

M. S. Alshehri, O. Saidani, F. S. Alrayes, S. F. Abbasi, and J. Ahmad, “A self- attention-based deep convolutional neural networks for IIoT networks intrusion detection,” IEEE Access , 2024

2024
[18]

A hybrid cnn-lstm model for iiot edge privacy-aware intrusion detection,

E. M. de Elias, V . S. Carriel, G. W. De Oliveira, A. L. Dos Santos, M. Nogueira, R. H. Junior, and D. M. Batista, “A hybrid cnn-lstm model for iiot edge privacy-aware intrusion detection,” in 2022 IEEE Latin-American Conference on Communications (LATINCOM) . IEEE, 2022, pp. 1–6

2022
[19]

Explainable artificial intelligence for intrusion detection in IoT networks: A deep learning based approach,

B. Sharma, L. Sharma, C. Lal, and S. Roy, “Explainable artificial intelligence for intrusion detection in IoT networks: A deep learning based approach,” Expert Systems with Applications , vol. 238, p. 121751, 2024

2024
[20]

Magru-ids: A multi-head attention-based gated recurrent unit for intrusion detection in IIoT networks,

S. Ullah, W. Boulila, A. Koubaa, and J. Ahmad, “Magru-ids: A multi-head attention-based gated recurrent unit for intrusion detection in IIoT networks,” IEEE Access , 2023

2023
[21]

Attention is all you need,

A. Vaswani, “Attention is all you need,” Advances in Neural Information Processing Systems, 2017

2017
[22]

Automatic speech recognition using advanced deep learning approaches: A survey,

H. Kheddar, M. Hemis, and Y . Himeur, “Automatic speech recognition using advanced deep learning approaches: A survey,” Information Fusion , p. 102422, 2024

2024
[23]

Edge- IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning,

M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, “Edge- IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning,” IEEE Access , vol. 10, pp. 40 281–40 306, 2022

2022
[24]

Deep reinforcement learning for intrusion detection in IoT: A survey,

A. Gueriani, H. Kheddar, and A. C. Mazari, “Deep reinforcement learning for intrusion detection in IoT: A survey,” in 2023 2nd Int. Conf. on Electronics, Energy and Measurement (IC2EM) , vol. 1. IEEE, 2023, pp. 1–7

2023
[25]

Deep learning for steganalysis of diverse data types: A review of methods, taxonomy, challenges and future directions,

H. Kheddar, M. Hemis, Y . Himeur, D. Meg´ıas, and A. Amira, “Deep learning for steganalysis of diverse data types: A review of methods, taxonomy, challenges and future directions,” Neurocomputing, p. 127528, 2024

2024
[26]

Robustness evaluations of sustainable machine learning models against data poisoning attacks in the internet of things,

C. Dunn, N. Moustafa, and B. Turnbull, “Robustness evaluations of sustainable machine learning models against data poisoning attacks in the internet of things,” Sustainability, vol. 12, no. 16, p. 6434, 2020

2020
[27]

Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review,

H. Kheddar, Y . Himeur, and A. I. Awad, “Deep transfer learning for intrusion detection in industrial control networks: A comprehensive review,” J. Netw. Comput. Appl. , vol. 220, p. 103760, 2023

2023
[28]

Analysis of ton-iot, unw-nb15, and edge-iiot datasets using dl in cybersecurity for iot,

I. Tareq, B. M. Elbagoury, S. El-Regaily, and E.-S. M. El-Horbaty, “Analysis of ton-iot, unw-nb15, and edge-iiot datasets using dl in cybersecurity for iot,” Applied Sciences , vol. 12, no. 19, p. 9572, 2022

2022
[29]

Secure IIoT networks with hybrid cnn-gru model using edge-IIoTset,

R. Saadouni, A. Khacha, Y . Harbi, C. Gherbi, S. Harous, and Z. Aliouat, “Secure IIoT networks with hybrid cnn-gru model using edge-IIoTset,” in 2023 15th Int. Conf. on Innovations in Inf. Technol. (IIT) . IEEE, 2023, pp. 150–155

2023
[30]

An intrusion detection system for edge-envisioned smart agriculture in extreme environment,

D. Javeed, T. Gao, M. S. Saeed, and P. Kumar, “An intrusion detection system for edge-envisioned smart agriculture in extreme environment,” IEEE Internet of Things Journal , 2023

2023
[31]

Federated learning for computer vision,

Y . Himeur, I. Varlamis, H. Kheddar, A. Amira, S. Atalla, Y . Singh, F. Bensaali, and W. Mansoor, “Federated learning for computer vision,” arXiv preprint arXiv:2308.13558, 2023

2023 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review,

N. Mishra and S. Pandya, “Internet of things applications, security challenges, attacks, intrusion detection, and future visions: A systematic review,” IEEE Access, vol. 9, pp. 59 353–59 377, 2021

2021

[2] [2]

Deep learning for cyber threat detection in IoT networks: A review,

A. Aldhaheri, F. Alwahedi, M. A. Ferrag, and A. Battah, “Deep learning for cyber threat detection in IoT networks: A review,” Internet of Things and Cyber- Physical Systems , 2023

work page 2023

[3] [3]

A comprehensive study of DDoS attacks over IoT network and their countermeasures,

P. Kumari and A. K. Jain, “A comprehensive study of DDoS attacks over IoT network and their countermeasures,” Computers & Security , vol. 127, p. 103096, 2023

work page 2023

[4] [4]

A lightweight multi-vector DDoS detection framework for IoT-enabled mobile health informatics systems using deep learning,

A. D. Aguru and S. B. Erukala, “A lightweight multi-vector DDoS detection framework for IoT-enabled mobile health informatics systems using deep learning,” Information Sciences , vol. 662, p. 120209, 2024

work page 2024

[5] [5]

A secure image encryption scheme based on genetic operations and a new hybrid pseudo random number generator,

B. Mondal and T. Mandal, “A secure image encryption scheme based on genetic operations and a new hybrid pseudo random number generator,” Multimedia Tools and Applications , vol. 79, no. 25, pp. 17 497–17 520, 2020

work page 2020

[6] [6]

Enhancing IoT security with cnn and lstm-based intrusion detection systems,

A. Gueriani, H. Kheddar, and A. C. Mazari, “Enhancing IoT security with cnn and lstm-based intrusion detection systems,” in 2024 6th International Conference on Pattern Analysis and Intelligent Systems (PAIS) . IEEE, 2024, pp. 1–7

work page 2024

[7] [7]

Evolution of IoT to IIoT: Applications & challenges,

H. Jaidka, N. Sharma, and R. Singh, “Evolution of IoT to IIoT: Applications & challenges,” in Proc. Int. Conf. Innovative Comput. Commun. (ICICC) , 2020

work page 2020

[8] [8]

Gaainet: A generative adversarial artificial immune network model for intrusion detection in industrial IoT systems,

S. P. Sithungu and E. M. Ehlers, “Gaainet: A generative adversarial artificial immune network model for intrusion detection in industrial IoT systems,” J. Adv. Inf. Technol., vol. 13, no. 5, 2022

work page 2022