A Dynamic Spatiotemporal Deep Learning Solution for Cloud–Edge Collaborative Industrial Control System Distributed Denial of Service Attack Detection
Open accessAbstract
With the continuous development of industrial intelligence, the integration of cyber–physical components creates a need for effective attack detection methods to mitigate potential DDoS threats. Although several DDoS attack detection modeling approaches have been proposed, few effectively incorporate the unique characteristics of industrial control system (ICS) architectures and traffic patterns. This paper focuses on DDoS attack detection within cloud–edge collaborative ICSs and proposes a novel detection model called FedDynST. This model combines federated learning and deep learning to construct feature graphs of traffic data. Introducing dynamic and static adjacency matrices, this work reveals the interactions between long-term industrial traffic data and short-term anomalies associated with DDoS attacks. Convolutional neural networks are utilized to capture distinctive temporal features within industrial traffic, thereby improving the detection precision. Moreover, the model enables continuous optimization of the global detection framework through a federated learning-based distributed training and aggregation mechanism, ensuring the privacy and security of industrial client data. The effectiveness of the FedDynST model was validated on the CICDDoS2019 and Edge-IIoTset datasets. The simulation results validated the superiority of the proposed approach, and thus, demonstrated significant improvements in both detection accuracy and convergence.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
By representing hosts, flows, services, and even events as nodes and edges, graph-based methods are particularly suitable for detecting DDoS, reconnaissance, injection, and other multi-stage intrusions that manifest as abnormal communication patterns, rare paths, or sudden expansions in connectivity rather than only local feature changes.
“First, by representing hosts, flows, services, and even events as nodes and edges, these methods are particularly suitable for detecting DDoS, reconnaissance, injection, and other multi-stage intrusions that manifest as abnormal communication patterns, rare paths, or sudden expansions in connectivity rather than only local feature changes [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThe surveyed work highlights a trade-off between structural expressiveness and deployment complexity in graph-based detection.
“the surveyed work highlights a trade-off between structural expressiveness and deployment complexity.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
The Introduction and Section 3.3.1 describe graph-based modeling that captures complex relationships between traffic features, supporting the structural-expressiveness part. The complexity and feasibility discussion reports better detection performance with similar training times; it does not identify a trade-off with deployment complexity. Page numbers are unavailable in our copy. (LLM, conf=0.84)
Experimental — accuracy not yet measuredIncremental and federated learning strategies help graph-based detectors adapt to non-stationary traffic and emerging CVE-driven attacks without full retraining, as demonstrated in cloud-edge DDoS detection and PMU traffic monitoring.
“incremental and federated learning strategies help graph-based detectors adapt to non-stationary traffic and emerging CVE-driven attacks without full retraining, as demonstrated in cloud-edge DDoS detection and PMU traffic monitoring [51,59].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
The Introduction and §3.2 describe a graph-based, federated detector for cloud-edge industrial DDoS traffic, with client model updates aggregated into a global model. The paper does not demonstrate incremental learning or adaptation to non-stationary traffic and emerging CVE-driven attacks without full retraining; it does not address PMU traffic monitoring. Page numbers are unavailable in our copy. (LLM, conf=0.88)
Experimental — accuracy not yet measuredGraph-based models such as APPNP GCNs, heterogeneous GNN autoencoders, and hypergraph Kohonen maps can capture non-Euclidean correlations and higher-order neighborhood structures that are difficult to express with flat feature vectors.
“Graph-based models such as APPNP GCNs, heterogeneous GNN autoencoders, and hypergraph Kohonen maps can capture non-Euclidean correlations and higher-order neighborhood structures that are difficult to express with flat feature vectors [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
Section 3.3.1 (page unavailable) describes an APPNP graph convolution layer that uses static and dynamic adjacency matrices to capture relationships between traffic features. This supports the APPNP example and its ability to model feature correlations, but the paper does not establish the claimed comparison with flat feature vectors or explicitly discuss higher-order neighborhood structures. (LLM, conf=0.83)
Experimental — accuracy not yet measuredConstructing and maintaining communication graphs from live ICS/CPS traffic requires careful aggregation of flow logs, selection of node/edge types, and windowing, which introduce additional design choices and computational overhead at scale.
“Constructing and maintaining communication graphs from live ICS/CPS traffic requires careful aggregation of flow logs, selection of node/edge types, and windowing, which introduce additional design choices and computational overhead at scale [51,54,55].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
When properly engineered, graph-based detectors can be distributed across cloud-edge architectures or parallelized to support near-real-time operation in large industrial networks.
“when properly engineered, graph-based detectors can be distributed across cloud-edge architectures or parallelized to support near-real-time operation in large industrial networks [51,55,59].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
The Introduction describes a graph-based DDoS detector trained through a distributed, cloud-edge federated framework. Section 3.3.1 says its dynamic adjacency matrix enables real-time detection of anomalous traffic changes. The paper does not establish parallelized operation or demonstrate near-real-time performance in large industrial networks. (LLM, conf=0.84)
Experimental — accuracy not yet measuredFedDynST jointly learns a static graph constructed from long-term traffic statistics and a dynamic graph estimated within short windows using APPNP GCN, extracting non-Euclidean correlations among traffic features, and a 1D-CNN further encodes temporal patterns for DDoS classification.
“The method jointly learns a static graph constructed from long-term traffic statistics and a dynamic graph estimated within short windows using APPNP GCN, extracting non-Euclidean correlations among traffic features. A 1D-CNN further encodes temporal patterns, enabling final DDoS classification.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
Cao et al. [51] proposed FedDynST, a graph-based spatiotemporal deep-learning model for DDoS detection in cloud-edge collaborative ICS environments, using CICDDoS2019 and Edge-IIoTset datasets.
“Using CICDDoS2019 and Edge-IIoTset datasets, Cao et al. [51] proposed FedDynST, a graph-based spatiotemporal deep-learning model for DDoS detection in cloud-edge collaborative ICS environments.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [51]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
1D convolutional neural networks and applications: A survey
Serkan Kiranyaz, B., Avcı, O., Abdeljaber, O., İnce, T., Gabbouj, M., & Inman, D. J. (2020) · Mechanical Systems and Signal Processing · doi:10.1016/j.ymssp.2020.107398 · Cited by 3,041 · see citing works
Guide to Industrial Control Systems (ICS) Security
Stouffer, K., Pillitteri, V., Lightman, S., Abrams, M., & Hahn, A. (2015) · doi:10.6028/nist.sp.800-82r2 · Cited by 1,377 · cited 1× · see citing works
“In ICS scenarios, such attacks can not only lead to production halts and service interruptions but also pose potential risks to personal safety [11,12].”
Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L. A., & Janicke, H. (2022) · IEEE Access · doi:10.1109/access.2022.3165809 · Cited by 1,308 · see citing works
Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy
Sharafaldin, I., Lashkari, A. H., Hakak, S., & Ghorbani, A. A. (2019) · 2019 International Carnahan Conference on Security Technology (ICCST) · doi:10.1109/ccst.2019.8888419 · Cited by 1,275 · see citing works
DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems
Li, B., Wu, Y., Song, J., Lu, R., Li, T., & Zhao, L. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3023430 · Cited by 623 · see citing works
MINE: Mutual Information Neural EstimationPreprint
Belghazi, M. I., Baratin, A., Rajeswar, S., Ozair, S., Bengio, Y., Courville, A. C., & Hjelm, R. D. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.04062 · Cited by 575 · see citing works
CNN-Based Network Intrusion Detection against Denial-of-Service Attacks
Kim, J., Kim, J., Kim, H., Shim, M., & Choi, E. (2020) · Electronics · doi:10.3390/electronics9060916 · Cited by 426 · see citing works
Predict then Propagate: Graph Neural Networks meet Personalized PageRankPreprint
Gasteiger, J., Bojchevski, A., & Günnemann, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1810.05997 · Cited by 422 · see citing works
Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection
Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martínez-del-Rincón, J., & Siracusa, D. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2971776 · Cited by 393 · see citing works
The Cybersecurity Landscape in Industrial Control Systems
McLaughlin, S., Konstantinou, C., Wang, X., Davi, L., Sadeghi, A.-R., Maniatakos, M., & Karri, R. (2016) · Proceedings of the IEEE · doi:10.1109/jproc.2015.2512235 · Cited by 391 · see citing works
DDoS attacks in cloud computing: Issues, taxonomy, and future directions
Somani, G., Gaur, M. S., Sanghi, D., Conti, M., & Buyya, R. (2017) · Computer Communications · doi:10.1016/j.comcom.2017.03.010 · Cited by 325 · see citing works
A Survey on Edge and Edge-Cloud Computing Assisted Cyber-Physical Systems
Cao, K., Hu, S., Shi, Y., Colombo, A. W., Karnouskos, S., & Li, X. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3073066 · Cited by 307 · see citing works
A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks
Haider, S., Akhunzada, A., Mustafa, İ., Patel, T. B., Fernandez, A. S., Choo, K. R., & Iqbal, J. (2020) · IEEE Access · doi:10.1109/access.2020.2976908 · Cited by 263 · see citing works
Deep learning approaches for detecting DDoS attacks: a systematic review
Mittal, M., Kumar, K., & Behal, S. (2022) · Soft Computing · doi:10.1007/s00500-021-06608-1 · Cited by 241 · see citing works
FLEAM: A Federated Learning Empowered Architecture to Mitigate DDoS in Industrial IoT
Li, J., Lyu, L., Liu, X., Zhang, X., & Lyu, X. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3088938 · Cited by 209 · see citing works
Hương, T. T., Bac, T. P., Long, D. M., Luong, T. D., Dan, N. M., Quang, L. A., Cong, L. T., Thang, B. D., & Tran, K. P. (2021) · Computers in Industry · doi:10.1016/j.compind.2021.103509 · Cited by 196 · see citing works
An ensemble deep learning model for cyber threat hunting in industrial internet of things
Yazdinejad, A., Kazemi, M., Parizi, R. M., Dehghantanha, A., & Karimipour, H. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.09.008 · Cited by 176 · see citing works
FLAD: Adaptive Federated Learning for DDoS attack detection
Doriguzzi-Corin, R., & Siracusa, D. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103597 · Cited by 144 · see citing works
An Efficient Hybrid-DNN for DDoS Detection and Classification in Software-Defined IIoT Networks
Zainudin, A., Ahakonye, L. A. C., Akter, R., Kim, D., & Lee, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3196942 · Cited by 134 · see citing works
Koay, A. M. Y., Ko, R. K. L., Hettema, H., & Radke, K. (2023) · Journal of Intelligent Information Systems · doi:10.1007/s10844-022-00753-1 · Cited by 131 · see citing works
Bao, G., & Guo, P. (2022) · Journal of Cloud Computing Advances Systems and Applications · doi:10.1186/s13677-022-00377-4 · Cited by 131 · see citing works
Proposed algorithm for smart grid DDoS detection based on deep learning
Diaba, S. Y., & Elmusrati, M. S. (2022) · Neural Networks · doi:10.1016/j.neunet.2022.12.011 · Cited by 116 · see citing works
Network intrusion detection system for DDoS attacks in ICS using deep autoencoders
Ortega-Fernandez, I., Sestelo, M., Burguillo, J. C., & Piñón-Blanco, C. (2023) · Wireless Networks · doi:10.1007/s11276-022-03214-3 · Cited by 104 · see citing works
Cyber attack and defense on industry control systems
Lin, C.-T., Wu, S., & Lee, M.-L. (2017) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/desec.2017.8073874 · Cited by 68 · see citing works
Kumar, S., Dwivedi, M., Kumar, M., & Gill, S. S. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100661 · Cited by 64 · see citing works
Overview of cyber-security of industrial control system
Fan, X., Fan, K., Wang, Y., & Zhou, R. (2015) · International Conference on Security of Smart Cities, Industrial Control System and Communications (SSIC) · doi:10.1109/ssic.2015.7245324 · Cited by 55 · see citing works
Aslam, M. M., Tufail, A., Apong, R. A. A. H. M., Silva, L. C. D., & Raza, M. T. (2024) · IEEE Access · doi:10.1109/access.2024.3394848 · Cited by 54 · see citing works
Kaur, A., Krishna, C. R., & Patil, N. V. (2024) · Computer Science Review · doi:10.1016/j.cosrev.2024.100692 · Cited by 48 · see citing works
Port cyberattacks from 2011 to 2023: a literature review and discussion of selected cases
Senarak, C. (2023) · Maritime Economics & Logistics · doi:10.1057/s41278-023-00276-8 · Cited by 47 · see citing works
Aljohani, T. M., & Almutairi, A. (2024) · Ain Shams Engineering Journal · doi:10.1016/j.asej.2024.102860 · Cited by 43 · see citing works
New Approach to Determine DDoS Attack Patterns on SCADA System Using Machine Learning
Alhaidari, F. A., & Aldahasi, E. (2019) · doi:10.1109/iccisci.2019.8716432 · Cited by 41 · see citing works
ICS anomaly detection based on sensor patterns and actuator rules in spatiotemporal dependency
Cai, J., Wei, Z., & Luo, J. (2024) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2024.3393528 · Cited by 38 · see citing works
Shao, J., Zeng, G., Lu, K., Geng, G., & Weng, J. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103910 · Cited by 33 · see citing works
Zainudin, A., Akter, R., Kim, D.-S., & Lee, J. (2022) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc55196.2022.9952610 · Cited by 27 · see citing works
A Multi-Model Proposal for Classification and Detection of DDoS Attacks on SCADA Systems
Söğüt, E., & Erdem, O. A. (2023) · Applied Sciences · doi:10.3390/app13105993 · Cited by 21 · see citing works
Praseed, A., & Thilagam, P. S. (2022) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2021.103090 · Cited by 12 · see citing works
Cloud Edge Integrated Security Architecture of New Cloud Manufacturing System
Zhao, L., Li, B., & Yuan, H. (2024) · Journal of Systems Engineering and Electronics · doi:10.23919/jsee.2024.000112 · Cited by 9 · see citing works
Overview of Research on Cloud-Edge-End Collaboration Technology of Industrial Control System
Wang, Y., Fang, L., Hu, B., Ge, G., Zhou, X., & Zhang, W. (2023) · International Conference on Electronics, Computers and Communication Technology (CECCT) · doi:10.1145/3637494.3638724 · Cited by 5 · see citing works
An LSTM based Malicious Traffic Attack Detection in Industrial Internet
Shen, C., Xiao, G., Yao, S., Zhou, B., Pan, Z., & Zhang, H. (2021) · International Conference on Security, Pattern Analysis, and Cybernetics (SPAC) · doi:10.1109/spac53836.2021.9539933 · Cited by 4 · see citing works
Enhancing Intrusion Detection Systems through Federated Learning and Gated Recurrent Units
Dev, A., Lal, A., Yadav, N., & Kumar, M. (2024) · IEEE Conference on Engineering Informatics (ICEI) · doi:10.1109/icei64305.2024.10912297 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Hemalatha, K. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-17843-5_11 · Cited by 19 · see citing works
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
Assessing Cross-Domain Threats in Cloud–Edge-Integrated Industrial Control Systems
Zhang, L., Wang, Y., Chang, C., & Shen, X. (2025) · Electronics · doi:10.3390/electronics14163242 · Cited by 3 · see citing works
Lysenko, A. K., Nos, R., Mazorchuk, K., & Nehodov, S. (2025) · Engineering · doi:10.26565/2079-1747-2025-36-10 · Cited by 1 · see citing works
Adaptive Intrusion Detection in Edge-Cloud Environments Using Reinforcement Learning
Laskar, A. K. M. N., Raihan, K. A., Ahmed, K. R., Khan, G. M., Miah, M. K., & Goyal, S. K. (2026) · International Conference on Signal Analysis for Smart Systems (SIGNASS) · doi:10.1109/signass67826.2026.11479986 · Cited by 1 · see citing works
A Survey of Advanced Intrusion Detection Systems Using Deep Learning in Cloud-Edge IoT Environments
Assiri, M. (2026) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.18328 · Cited by 1 · see citing works
- Authors
- Cao, Z., Liu, B., Gao, D., Zhou, D., Han, X., & Cao, J.
- Affiliations
- Purple Mountain Laboratories (CN)
- Southeast University (CN)
- Corresponding author
- Liu, Bo
- Venue
- Electronics
- Publisher
- MDPI AG
- Published
- 2025-04-30
- Volume
- 14
- Issue
- 9
- Pages
- 1843
- ISSN
- 2079-9292 (ISSN-L)
- OpenAlex
- W4410008052
- Cited by
- 7
- References
- 40
- Citations by year
- 2026: 4 · 2025: 3
- FWCI
- 2.96
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Electronics (publishedVersion, cc-by)
- Funders
- National Key R&D Progam of China (2022YFB3104300, BK20240292)
- Jiangsu Provincial Natural Science Foundation of China (2022YFB3104300, BK20240292)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- industrial control systems, cloud-edge collaboration, federated learning, spatiotemporal deep learning, traffic anomaly detection, convolutional neural networks, dynamic adjacency matrix, data privacy, CICDDoS2019, Edge-IIoTset
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
