Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

CryptoDNA: A Machine Learning Paradigm for DDoS Detection in Healthcare IoT, Inspired by crypto jacking prevention Models

T0 review · 5 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The CryptoDNA framework transfers cryptojacking-detection clues—traffic entropy, resource-use spikes, time-series deviations—to catch DDoS attacks on hospital IoT devices with 96.8% accuracy at 12 ms per inference.

desk verdict Sensible idea, missing evidence—the paper's central results cannot be checked. read the letter →

arxiv 2501.18549 v1 pith:OGS7UZZF submitted 2025-01-30 cs.CR

Zag ElSayed , Ahmed Abdelgawad , Nelly Elsayed This is my paper · ORCID
classification cs.CR
keywords DDoSdetectionhealthcareIoTInternetofMedicalThingscryptojacking-inspiredfeaturesRandomForestbehavioralanalyticsentropy-basedtrafficanalysisanomaly
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that distributed denial-of-service (DDoS) attacks on healthcare Internet-of-Things devices can be caught with the same behavioral clues used to detect cryptojacking—unauthorized cryptocurrency mining on a victim's machine—namely abnormal CPU and memory use, traffic entropy, and time-series deviations from normal device behavior. It packages those clues into CryptoDNA, a lightweight Random Forest classifier with an autoencoder variant for novel attacks, and tests it on a public DDoS benchmark plus a synthetic 10,000-event trace modeled on a 100-device facility. The reported result is 96.8% accuracy, a 97.3% detection rate, a 2.1% false positive rate, and 12 ms average inference latency after pruning and quantization. If those numbers transfer to live hospitals, the payoff is real-time DDoS screening on low-power medical devices without a cloud round-trip.

What carries the argument

The carrying mechanism is a cross-domain feature transfer: DDoS detection is reframed as a resource-behavior anomaly problem, the way cryptojacking detection is framed. The feature set watches packet entropy, request frequency, bandwidth utilization, CPU and memory usage, system-call patterns, time-series deviations, and communication-graph metrics. A Random Forest classifier (an ensemble of decision trees) makes the normal-versus-attack decision on those features, and pruning plus quantization shrink the model by 35% and cut latency by 40%; an autoencoder variant flags patterns that deviate from learned normal behavior, giving the claimed 94.6% recall on synthetic zero-day patterns. The entropy and time-series features are the part carried over from cryptojacking detection, and they are what give the detector its sensitivity to subtle anomalies.

What would settle it

Run the exact feature set and training pipeline on an independent, labeled traffic log from a working hospital IoT network or a publicly available healthcare IoT dataset, and compare accuracy, detection rate, FPR, and latency to the reported 96.8%, 97.3%, 2.1%, and 12 ms; if performance drops materially, the representativeness assumption fails. A smaller first check is to regenerate the synthetic trace from the described 100-device scenario, hold it out, and see whether the model's zero-day recall stays near 94.6%.

Watch

Extended reading notes

Core claim

The paper's central claim is that the behavioral signals used to detect cryptojacking also separate DDoS traffic from normal healthcare IoT traffic. It packages those signals into CryptoDNA, whose primary detector is a pruned and quantized Random Forest and whose auxiliary detector is an autoencoder for zero-day anomalies. Evaluated on a public DDoS benchmark and a synthetic 10,000-event trace modeled on a 100-device facility, the framework reports 96.8% accuracy, a detection rate above 97.3%, a false positive rate of 2.1%, and an average inference latency of 12 ms, beating the two comparison systems on every reported column.

Load-bearing premise

The entire performance story rests on the assumption that the synthetic 10,000-event trace from a simulated 100-device facility behaves enough like real healthcare IoT traffic that the reported accuracy, false-positive rate, and latency carry over to actual hospitals; the paper offers no independent validation of that representativeness.

Editorial extensions

If this is right

  • If the reported numbers hold, hospitals could run continuous DDoS screening on the low-power devices already on the network, with each decision taking about 12 ms.
  • A false positive rate near 2% means far fewer spurious alerts than conventional anomaly systems, which matters in an ICU where alarms already compete for attention.
  • Because the features are behavioral rather than signature-based, the same detector should recognize both high-rate floods (SYN, HTTP) and slow, low-rate attacks that never match a known pattern.
  • The 35% model-size and 40% latency reductions from pruning and quantization make the model fit edge deployment without a cloud round-trip.
  • The autoencoder variant offers a path to zero-day DDoS detection in environments where labeled attack data is scarce, with 94.6% recall on the synthetic novel-attack test.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the behavioral transfer generalizes, the same entropy-and-resource feature set could be applied to other critical IoT sectors—power, water, transport—where low-rate DDoS and strict device resource limits coincide.
  • The 94.6% recall on synthetic zero-day patterns suggests a concrete testable path: retrain the autoencoder variant on unlabeled real traffic and measure whether unsupervised detection approaches the supervised 96.8% accuracy.
  • Because inference runs in about 12 ms on the compressed model, a practical extension is an on-device confirmation loop that flags an alert only when anomalous readings persist over several ticks, trading a small latency increase for even fewer false positives.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes CryptoDNA, a machine-learning DDoS detection framework for healthcare IoT that adapts behavioral features from cryptojacking detection, including packet entropy, request frequency, CPU/memory usage, and time-series deviations. The primary classifier is a Random Forest with pruning and quantization, plus an autoencoder anomaly-detection variant. The evaluation uses CICDDoS2019 and a self-generated synthetic dataset of 10,000 events from a simulated 100-device healthcare facility. The paper reports 96.8% accuracy, 97.3% detection rate, 2.1% FPR, and 12 ms average latency, and compares these against two baselines (S1, S2) in Table 1, concluding that CryptoDNA outperforms existing DDoS detection models.

Significance. If the reported performance were reproducible, the work would be a useful contribution to lightweight DDoS detection in healthcare IoT, particularly the cross-domain transfer from cryptojacking detection. The claimed 35% model-size reduction and 12 ms inference latency are relevant to resource-constrained devices. However, the paper currently provides no code, no dataset, no hyperparameters, no train/test split, and an incorrect F1-score formula, so the central quantitative claims cannot be verified. The interdisciplinary framing is conceptually interesting but is not backed by evidence at the standard required for a journal publication.

major comments (5)
  1. [Evaluation Metrics, Eq. (4)] Equation (4) defines F1-score as Precision × Recall / (Precision + Recall), missing the factor of 2. The correct harmonic mean is 2 × Precision × Recall / (Precision + Recall). If the reported F1 values were computed with Eq. (4), they are systematically half the true value, which directly affects the evaluation claims in the Results section.
  2. [Methodology, Machine Learning Model] The evaluation is not reproducible. The paper states that the model was trained over 50 epochs and that code is publicly available on GitHub under the CryptoDNA Project, but no repository URL, random seed, hyperparameters, cross-validation folds, or train/test split are given. For a Random Forest, 'epochs' is not a meaningful training quantity, which suggests the training protocol is not described accurately. Without these details, the reported 96.8% accuracy and 2.1% FPR cannot be independently checked.
  3. [Methodology, Testing] The synthetic healthcare dataset is not validated and not released. The dataset is described only as 10,000 events generated from a simulated 100-device facility using Raspberry Pi and Arduino boards, limited to text-based TCP/UDP traffic. No comparison against real healthcare IoT traffic or any statistical validation is provided. Since CICDDoS2019 is not healthcare-specific, the healthcare-IoT claim rests entirely on this unvalidated synthetic set.
  4. [Results, Table 1] Table 1's baseline comparison lacks a protocol. It is unclear whether S1 (Almiani et al. 2020) and S2 (Mothukuri et al. 2021) were re-implemented, re-run on the same data, or whether their numbers were copied from the original papers. No confidence intervals, standard deviations, or experimental conditions are reported. The 'Model Size Reduction (%)' row compares against a baseline that is not defined. Consequently, the claim that CryptoDNA 'outperformed existing DDoS detection models' is not supported.
  5. [Results, Result Compression] The adaptability claim for zero-day attacks is not substantiated. The Results section reports a recall of 94.6% for 'synthetic zero-day attack patterns' but does not describe how these patterns were generated, how they differ from the training attack types, or how the threshold adaptation works. This is load-bearing for the paper's claim of resilience against emerging attack vectors.
minor comments (5)
  1. [Throughout] There are multiple typos, e.g., 'P ercision' in Eq. (2) text, 'Healthare IoT' in a section heading, 'crypto jacking' in the title and abstract, and 'Fig1' without a space.
  2. [References] The reference Mollah, Shovon, and Roy (2024) is cited for a blockchain-based healthcare IoT architecture, but the listed title is about cyclone Remal vulnerability in Bangladesh; this citation appears mismatched.
  3. [Results, Figure 8] Figure 8 (confusion matrix) is not described in the text and its entries are not reported, so the reader cannot derive accuracy, precision, recall, or FPR from it.
  4. [Introduction, Figure 1] The '29.3 attacks per day in 2024' statistic in the Introduction is not sourced.
  5. [Evaluation Metrics] The equations are referred to as (1)-(4) in the text but are displayed without equation numbers.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: CryptoDNA's accuracy claims are empirical measurements on an external benchmark, not derived from fitted parameters or self-citations.

full rationale

The paper presents CryptoDNA as a supervised machine-learning framework whose central claims are measured detection accuracy, recall, false-positive rate, and latency. These are empirical results obtained by training a Random Forest and an autoencoder on the external CICDDoS2019 dataset plus an author-generated synthetic healthcare IoT dataset, then evaluating performance. There is no derivation chain in which an output quantity is defined in terms of an input quantity: the cryptojacking-inspired features (packet entropy, request frequency, bandwidth utilization, CPU/memory usage) are inputs to the classifier, not definitions of the target labels or of the reported metrics. The reference list contains no self-citations by ElSayed, Abdelgawad, or Elsayed, so no load-bearing self-citation or imported uniqueness theorem is present. The reported comparison against prior systems (S1, S2) uses literature-reported numbers rather than a self-defined baseline, and the 'cryptojacking-inspired' framing is conceptual rather than a formal equivalence. The main weaknesses are reproducibility-related: the synthetic dataset is not released, the GitHub link is not functional, no train/test split or hyperparameters are given, and Eq. (4) omits the factor of 2 in the F1-score formula. These are correctness and transparency concerns, not circularity. The absence of a held-out evaluation protocol could in principle create data leakage, but the paper explicitly states that cross-validation was performed, and the use of the external CICDDoS2019 benchmark provides an independent point of comparison. Therefore no specific circular reduction can be exhibited, and the appropriate finding is no significant circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The claimed performance rests on unverified representativeness assumptions, unstated hyperparameters, and a synthetic dataset that is neither validated nor released. No new physical or conceptual entities are introduced; the framework is a software artifact.

free parameters (3)
  • Random Forest hyperparameters
    Number of trees, depth, and split criteria are not reported; the claimed accuracy depends on these unstated choices.
  • Anomaly detection thresholds = dynamic, unspecified
    The autoencoder variant uses context-adaptive thresholds, but the adaptation rule and default values are not described.
  • Synthetic data generation parameters
    The 10,000-event simulated facility dataset is generated with unstated traffic models, device profiles, and attack proportions.
assumptions (4)
  • domain assumption CICDDoS2019 is representative of DDoS attacks on healthcare IoT
    The system is trained and tested on a general-purpose DDoS benchmark; no evidence maps it to medical device traffic. Enters in Methodology Training Process and Testing.
  • domain assumption The synthetic dataset accurately models real healthcare IoT traffic
    Generated by the authors with unspecified parameters; no validation against real traffic and no release. Enters in Methodology Testing.
  • domain assumption Train and test splits prevent data leakage
    The paper says cross-validation was done but gives no split details, making the reported generalization unverifiable. Enters in Methodology Training Process.
  • domain assumption Cryptojacking-inspired features carry independent signal for DDoS detection
    The motivating premise of the work; no ablation isolates the contribution of these features. Enters in Contributions and Results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CryptoDNA: A Machine Learning Paradigm for DDoS Detection in Healthcare IoT, Inspired by crypto jacking prevention Models." pith.science (2026). https://pith.science/paper/OGS7UZZF

@misc{pith2026250118549,
  author       = {Pith},
  title        = {Pith review of: CryptoDNA: A Machine Learning Paradigm for DDoS Detection in Healthcare IoT, Inspired by crypto jacking prevention Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OGS7UZZF}},
  note         = {Machine review of arXiv:2501.18549}
}
read the original abstract

The rapid integration of the Internet of Things (IoT) and Internet of Medical (IoM) devices in the healthcare industry has markedly improved patient care and hospital operations but has concurrently brought substantial risks. Distributed Denial-of-Service (DDoS) attacks present significant dangers, jeopardizing operational stability and patient safety. This study introduces CryptoDNA, an innovative machine learning detection framework influenced by cryptojacking detection methods, designed to identify and alleviate DDoS attacks in healthcare IoT settings. The proposed approach relies on behavioral analytics, including atypical resource usage and network activity patterns. Key features derived from cryptojacking-inspired methodologies include entropy-based analysis of traffic, time-series monitoring of device performance, and dynamic anomaly detection. A lightweight architecture ensures inter-compatibility with resource-constrained IoT devices while maintaining high detection accuracy. The proposed architecture and model were tested in real-world and synthetic datasets to demonstrate the model's superior performance, achieving over 96% accuracy with minimal computational overhead. Comparative analysis reveals its resilience against emerging attack vectors and scalability across diverse device ecosystems. By bridging principles from cryptojacking and DDoS detection, CryptoDNA offers a robust, innovative solution to fortify the healthcare IoT landscape against evolving cyber threats and highlights the potential of interdisciplinary approaches in adaptive cybersecurity defense mechanisms for critical healthcare infrastructures.

Figures

Figures reproduced from arXiv: 2501.18549 by the authors.

Figure 1
Figure 1. Global Average Attack by Industry. Beyond the technical implications, the economic and ethi￾cal ramifications of DDoS attacks on healthcare IoT systems are profound and far-reaching. Economically, the impact of DDoS attacks on healthcare infrastructures is staggering. In 2022 alone, the global cost of cyberattacks on health￾care institutions was estimated to exceed $10 billion, with DDoS attacks accounting for a sig… view at source ↗
Figure 2
Figure 2. Attacked Healthcare Organization. warfare and the need for stricter international regulations to prevent such activities. These economic and ethical dimensions underscore the urgency of developing innovative solutions to mitigate DDoS attacks on healthcare IoT and IoM devices by combining advanced machine learning techniques with a deep understanding of healthcare-specific security require￾ments. This paper introduc… view at source ↗
Figure 5
Figure 5. Fig5. These approaches, while promising, often involve high [PITH_FULL_IMAGE:figures/full_fig_p003_5.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Example of a blockchain based Secure IoT System [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]
Figure 6
Figure 6. Figure 6: Top level proposed CryptoDNA framework archi [PITH_FULL_IMAGE:figures/full_fig_p004_6.png]
Figure 7
Figure 7. Figure 7: The proposed CryptoDNA model architecture. [PITH_FULL_IMAGE:figures/full_fig_p004_7.png]
Figure 8
Figure 8. Figure 8: The proposed CryptoDNA confusion matrix. Results and Discussion This section presents the experimental evaluation of the pro￾posed CryptoDNA framework, highlighting its performance in detecting DDoS attacks on healthcare IoT and IoM de￾vices. The results are analyzed u…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Extreme Learning Machine Based System for DDoS Attacks Detections on IoMT Devices

    cs.CR 2025-07 conditional novelty 3.0 of 10

    An extreme learning machine classifier obtained roughly 95% accuracy detecting DDoS attacks in the CICIoMT2024 IoMT dataset, but the evaluation may leak test information during feature selection and the low-cost claim...

Reference graph

Works this paper leans on

18 extracted references · 17 canonical work pages · cited by 1 Pith paper

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION fin.entry add.period write newline FUNCTION new.block output.state before.all = 'skip after.block 'output.state := if FUNCTION new.sentence output.state after.block = 'skip output.state before.all = 'skip after.sentence 'output.state := if if FUNCTION not #0 #1 if FUNCTION and 'skip pop #0 if FUNCTIO...

  2. [2]

    D., and Erukala, S

    Aguru, A. D., and Erukala, S. B. 2024. A lightweight multi-vector ddos detection framework for iot-enabled mobile health informatics systems using deep learning. Information Sciences 662:120209

    work page 2024

  3. [3]

    A.; and Sahar, N

    Aleesa, A.; Younis, M.; Mohammed, A. A.; and Sahar, N. 2021. Deep-intrusion detection system with enhanced unsw-nb15 dataset based on deep learning techniques. Journal of Engineering Science and Technology 16(1):711--727

    work page 2021

  4. [4]

    Alhasawi, Y., and Alghamdi, S. 2024. Federated learning for decentralized ddos attack detection in iot networks. IEEE Access 12:42357--42368

    work page 2024

  5. [5]

    Almiani, M.; AbuGhazleh, A.; Al-Rahayfeh, A.; Atiewi, S.; and Razaque, A. 2020. Deep recurrent neural network for iot intrusion detection system. Simulation Modelling Practice and Theory 101:102031

    work page 2020

  6. [6]

    Almurshid, H.; Almomani, I.; Khalifa, M.; and El-Shafai, W. 2024. A holistic intelligent cryptojacking malware detection system. IEEE Access

    work page 2024

  7. [7]

    Chung, J.-M. 2024. Emerging secure networks, blockchains and smart contract technologies. Cham, Switzerland: Springer

    work page 2024

  8. [8]

    Djenna, A.; Harous, S.; and Saidouni, D. E. 2021. Internet of things meet internet of threats: New concern cyber security issues of critical cyber infrastructure. Applied Sciences 11(10):4580

    work page 2021

Show all 18 references
  1. [9]

    B.; and Panigrahi, P

    Gaurav, A.; Gupta, B. B.; and Panigrahi, P. K. 2022. A novel approach for ddos attacks detection in covid-19 scenario for small entrepreneurs. Technological Forecasting and Social Change 177:121554

    2022

  2. [10]

    B., and Dahiya, A

    Gupta, B. B., and Dahiya, A. 2021. Distributed Denial of Service (DDoS) Attacks: Classification, Attacks, Challenges and Countermeasures . CRC press

    2021

  3. [11]

    J.; Kumar, S.; and Sharma, H

    Kumar, A.; Goyal, S. J.; Kumar, S.; and Sharma, H. K. 2024. Hybrid fusion of lightweight security frameworks using data mining approach in iot. Fusion: Practice & Applications 14(2)

    2024

  4. [12]

    H.; Shovon, H

    Mollah, A. H.; Shovon, H. H.; and Roy, A. 2024. Assessing socioeconomic vulnerability of cyclone remal-affected coastal communities in bangladesh. Natural Hazards 1--26

    2024

  5. [13]

    M.; Pouriyeh, S.; Dehghantanha, A.; and Srivastava, G

    Mothukuri, V.; Khare, P.; Parizi, R. M.; Pouriyeh, S.; Dehghantanha, A.; and Srivastava, G. 2021. Federated-learning-based anomaly detection for iot security attacks. IEEE Internet of Things Journal 9(4):2545--2554

    2021

  6. [14]

    Sabrina, F.; Li, N.; and Sohail, S. 2022. A blockchain based secure iot system using device identity management. Sensors 22(19)

    2022

  7. [15]

    Somasundaram, R., and Thirugnanam, M. 2021. Review of security challenges in healthcare internet of things. Wireless Networks 27(8):5503--5509

    2021

  8. [16]

    Tanana, D. 2020. Behavior-based detection of cryptojacking malware. In 2020 Ural symposium on biomedical engineering, radioelectronics and information technology (USBEREIT) , 0543--0545. IEEE

    2020

  9. [17]

    A., and McCauley, V

    Williams, P. A., and McCauley, V. 2016. Always connected: The security challenges of the healthcare internet of things. In 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT) , 30--35. IEEE

    2016

  10. [18]

    Xu, G.; Dong, W.; Xing, J.; Lei, W.; Liu, J.; Gong, L.; Feng, M.; Zheng, X.; and Liu, S. 2023. Delay-cj: A novel cryptojacking covert attack method based on delayed strategy and its detection. Digital Communications and Networks 9(5):1169--1179

    2023

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.