A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed a new method to detect DDoS attacks in industrial technology systems like controllers and SCADA, which have limited computing power. Their approach combines a neural network with a simple decision tree to get both strong detection and understandable rules. They tested it on real attack datasets and found it detects attacks more reliably than using either method alone, especially by missing fewer attacks while keeping false alarms low. The system works fast enough to be used in real-time industrial settings. This approach helps improve security where catching every attack is very important.
Operational TechnologyDistributed Denial-of-Service (DDoS)Programmable Logic Controllers (PLCs)Industrial Control Systems (ICS)Supervisory Control and Data Acquisition (SCADA)Gated Recurrent Unit (GRU)Decision TreeNeuro-Symbolic FusionF1-scoreFalse Negative Rate (FNR)
Authors
Mikiyas Alemayehu, Mohamed Chahine Ghanem, Hamza Kheddar, Aohan Li, J. J. Garcia-Luna-Aceves
Abstract
Operational technology (OT) environments, including programmable logic controllers (PLCs), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems, are increasingly targeted by distributed denial-of-service (DDoS) attacks. This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments. The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component. The symbolic component alone provides a compact, interpretable rule set, while the fusion combines the strengths of both paradigms. The hybrid model is evaluated on three real-world benchmark DDoS datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. A unified comprehensive preprocessing pipeline including label mapping, numerical feature selection, robust scaling, and class balancing is applied. The fusion weight alpha and decision threshold are jointly optimised on validation data to maximise F1-score. The hybrid model attains 99.04% accuracy (MCC 0.97) on CIC-DDoS2019 and 98.61% accuracy (MCC 0.76) on CICIoT23, in both cases reducing the FNR below that of the pure-neural and pure-symbolic baselines; on the linearly separable Edge-IIoTset the shallow decision tree alone already reaches 100%, so this benchmark validates the preprocessing pipeline rather than the fusion. The principal gain of the fusion is a lower FNR at a controlled false-positive cost, which matters in operational technology, where a missed attack is more damaging than a false alarm. Model-only inference latency is sub-millisecond (0.58-0.79 milliseconds per sample) on a standard central processing unit; including on-device flow-feature extraction, the end-to-end path remains within a single-digit-millisecond budget, which is compatible with OT control-loop timing.