An Intelligent Intent-Aware System for DDoS Attacks Detection and Mitigation in IoT Networks
Bibliographic record
Abstract
As Internet of Things (IoT) networks continue to grow in complexity and scale, ensuring reliable service delivery while defending against cyber attacks such as Distributed Denial of Service (DDoS) has become increasingly critical. IoT networks, with their resource-constrained devices, diverse traffic patterns, and real-time requirements, amplify the limitations of existing DDoS detection and mitigation solutions. These solutions often prioritize classification accuracy, but rely on static policies that do not adapt to evolving traffic behaviour or prioritize critical services. To address these challenges, Intent-Based Networking (IBN) offers a promising approach by enabling networks to dynamically align with high-level service goals, such as prioritizing control traffic or ensuring low-latency communication. However, current security solutions lack integration with IBN, resulting in a gap in context-driven, intent-aware DDoS mitigation. To address this, the paper proposes an intelligent intent-aware system for DDoS attack detection and mitigation (INACT) in IoT networks. The INACT system introduces a dual-output deep learning model that classifies both the type of traffic (benign or malicious) and its operational intent (e.g., control, security, or bandwidth priority), using a multitask learning approach. The INACT system uses a gradient-based method to select the most relevant features, allowing it to run smoothly on lightweight edge devices. To take immediate and meaningful action, the system includes a controller that applies different mitigation strategies depending on the intent of traffic. This ensures that critical services are protected first and that nonessential traffic is managed with minimal disruption during the attack response. The INACT system is evaluated using benchmark datasets such as HL-IoT and CICIoT-2023 and is deployed on a real testbed. The INACT system achieves high detection and intent classification accuracy while maintaining low latency, resource usage, and mitigation effectiveness.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.002 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.000 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.001 | 0.001 |
| Open science | 0.001 | 0.000 |
| Research integrity | 0.000 | 0.001 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".