# Machine Learning DDoS Detection for Consumer Internet of Things Devices

arXiv: https://arxiv.org/abs/1804.04159 · HTML: https://mlsanity.com/paper/1804.04159/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Apr 2018.

## Built on by (most cited first, 21 of 21)

- [Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS](https://mlsanity.com/paper/2102.07244/) (2021)
- [A Modern Analysis of Aging Machine Learning Based IoT Cybersecurity Methods](https://mlsanity.com/paper/2110.07832/) (2021)
- [A Transformer-Based Framework for Payload Malware Detection and Classification](https://mlsanity.com/paper/2403.18223/) (2024)
- [Machine and Deep Learning for IoT Security and Privacy: Applications, Challenges, and Future Directions](https://mlsanity.com/paper/2210.13547/) (2022)
- [Packet Inspection Transformer: A Self-Supervised Journey to Unseen Malware Detection with Few Samples](https://mlsanity.com/paper/2409.18219/) (2024)
- [NetFlowGen: Leveraging Generative Pre-training for Network Traffic Dynamics](https://mlsanity.com/paper/2412.20635/) (2024)
- [Evaluation of an Anomaly Detector for Routers using Parameterizable Malware in an IoT Ecosystem](https://mlsanity.com/paper/2111.00097/) (2021)
- [Online Self-Supervised Deep Learning for Intrusion Detection Systems](https://mlsanity.com/paper/2306.13030/) (2023)
- [An Investigation into the Performances of the State-of-the-art Machine Learning Approaches for Various Cyber-attack Detection: A Survey](https://mlsanity.com/paper/2402.17045/) (2024)
- [AdIoTack: Quantifying and Refining Resilience of Decision Tree Ensemble Inference Models against Adversarial Volumetric Attacks on IoT Networks](https://mlsanity.com/paper/2203.09792/) (2022)
- [CADeSH: Collaborative Anomaly Detection for Smart Homes](https://mlsanity.com/paper/2303.01021/) (2023)
- [Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity](https://mlsanity.com/paper/2304.04987/) (2023)
- [5G Networks and IoT Devices: Mitigating DDoS Attacks with Deep Learning Techniques](https://mlsanity.com/paper/2311.06938/) (2023)
- [Enhancing IoT Security Against DDoS Attacks through Federated Learning](https://mlsanity.com/paper/2403.10968/) (2024)
- [Leveraging Machine Learning for Accurate IoT Device Identification in Dynamic Wireless Contexts](https://mlsanity.com/paper/2405.17442/) (2024)
- [Towards Efficient Machine Learning Method for IoT DDoS Attack Detection](https://mlsanity.com/paper/2408.10267/) (2024)
- [Leveraging Machine Learning for Botnet Attack Detection in Edge-Computing Assisted IoT Networks](https://mlsanity.com/paper/2508.01542/) (2025)
- [Collaborative Zone-Adaptive Zero-Day Intrusion Detection for IoBT](https://mlsanity.com/paper/2602.16098/) (2026)
- [Explainable Threat Attribution for IoT Networks Using Conditional SHAP and Flow Behavior Modelling](https://mlsanity.com/paper/2603.22771/) (2026)
- [An Improved CNN-LSTM Based Intrusion Detection System for IoT Networks](https://mlsanity.com/paper/2606.05776/) (2026)
- [Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling](https://mlsanity.com/paper/2608.15465/) (2026)

## Abstract (arXiv)

An increasing number of Internet of Things (IoT) devices are connecting to the Internet, yet many of these devices are fundamentally insecure, exposing the Internet to a variety of attacks. Botnets such as Mirai have used insecure consumer IoT devices to conduct distributed denial of service (DDoS) attacks on critical Internet infrastructure. This motivates the development of new techniques to automatically detect consumer IoT attack traffic. In this paper, we demonstrate that using IoT-specific network behaviors (e.g. limited number of endpoints and regular time intervals between packets) to inform feature selection can result in high accuracy DDoS detection in IoT network traffic with a variety of machine learning algorithms, including neural networks. These results indicate that home gateway routers or other network middleboxes could automatically detect local IoT device sources of DDoS attacks using low-cost machine learning algorithms and traffic data that is flow-based and protocol-agnostic.