💻 computer science

A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks

This paper presents a resource-efficient neuro-symbolic framework that fuses a GRU neural network with a decision tree to achieve highly accurate, interpretable, and low-latency DDoS detection tailored for the strict timing and reliability constraints of operational technology networks.

Original authors: Mikiyas Alemayehu, Mohamed Chahine Ghanem, Hamza Kheddar, Aohan Li, J. J. Garcia-Luna-Aceves

Published 2026-08-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Mikiyas Alemayehu, Mohamed Chahine Ghanem, Hamza Kheddar, Aohan Li, J. J. Garcia-Luna-Aceves

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the hidden layers of modern civilization, where power grids hum, water treatment plants filter, and factories assemble goods, a silent nervous system operates. This is the world of operational technology, a realm where physical machinery is directed by digital commands. Unlike the computers on our desks, which can afford to be slow or make mistakes, these industrial controllers must react instantly and with absolute certainty. A delay of a fraction of a second can mean a turbine spinning out of control or a valve failing to close. For years, these systems have been isolated, but as they connect to the wider internet to improve efficiency, they have become vulnerable to a specific kind of digital siege known as a distributed denial-of-service attack. In such an attack, a flood of fake traffic overwhelms the system, choking off the real commands needed to keep the physical world running safely. The challenge for security experts has been to build a guard that is smart enough to spot these complex floods, fast enough to react before damage occurs, and simple enough to run on the small, low-power computers that sit inside the machinery itself.

A team of researchers has developed a new approach to this problem, creating a security system that blends two different ways of thinking to protect these critical industrial networks. Instead of relying on a single, massive computer program that tries to learn everything at once, they combined a neural network, which is good at spotting subtle patterns in data over time, with a decision tree, which follows a clear set of logical rules. Imagine a security guard who has two ways of checking a visitor: one is an experienced detective who senses something is wrong based on a person's history and behavior, and the other is a rulebook that says, "If the person arrives at 3 AM and carries a heavy box, they must be stopped." The researchers found that by letting these two methods work together, they could catch attacks that either method might miss on its own, while keeping the system light enough to run on the small devices found in factories.

The researchers tested their system on three different sets of data representing various types of industrial networks and attack scenarios. In the most difficult tests, where the data was messy and the attacks were hard to distinguish from normal activity, their combined system achieved a detection rate of nearly 99 percent. More importantly, it made very few mistakes in the direction that matters most for safety: it rarely failed to spot a real attack. In the industrial world, missing an attack is far more dangerous than raising a false alarm, because a missed attack can lead to physical damage or safety hazards. The system managed to reduce the number of missed attacks significantly compared to using just the pattern-recognition part or just the rule-based part alone. On a dataset representing a simpler, more predictable network, the rule-based part alone was perfect, but the researchers showed that the combined approach was necessary for the more complex, real-world scenarios where traffic patterns are chaotic.

To prove that this system could actually work in the real world, the team did not just run simulations on a powerful computer. They installed the software on two actual pieces of industrial hardware: a specialized gateway used in factories and a common single-board computer often used for prototyping. They measured how long it took for the device to analyze a single moment of network traffic and found that the process took less than one millisecond. This is incredibly fast, well within the strict time limits required for industrial control loops, which often need to react within 50 milliseconds. The system also used very little memory and energy, consuming only a tiny fraction of a joule for each check, proving that it could run continuously on the limited power supplies available in remote industrial sites without draining the battery or overheating the device.

The researchers also emphasized that their system is transparent. Unlike many advanced security tools that act as a "black box," where no one knows why a decision was made, their system produces a set of clear, human-readable rules. If the system flags an attack, an operator can look at the decision tree and see exactly which conditions triggered the alarm, such as a specific type of data packet arriving too frequently. This clarity is crucial for building trust with the engineers who manage these critical systems, allowing them to understand and verify the security measures protecting their infrastructure. By balancing the need for speed, the need for accuracy, and the need for human understanding, this work offers a practical path forward for securing the invisible digital backbone of our physical world.

Technical Summary: A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks

Problem Statement
Operational Technology (OT) environments, including Programmable Logic Controllers (PLCs), Industrial Control Systems (ICS), and SCADA systems, face increasing threats from Distributed Denial-of-Service (DDoS) attacks that can disrupt physical processes and compromise safety. However, the devices at the core of these networks (e.g., PLCs, remote terminal units) operate under severe constraints: low-power ARM-based CPUs, less than 1 GB of RAM, and the requirement for deterministic, sub-millisecond response times to maintain control-loop stability.

Existing Intrusion Detection Systems (IDS) struggle to meet these constraints. Deep Learning (DL) models offer high accuracy but are computationally too heavy for resource-constrained edge devices. Conversely, pure rule-based or symbolic systems are lightweight and interpretable but fail to capture complex temporal patterns in DDoS traffic and lack adaptability to evolving attacks. Furthermore, existing Neuro-Symbolic AI (NSAI) frameworks are typically designed for general-purpose networks with ample resources, often embedding differentiable logic or knowledge graphs that hinder deployment on industrial edge hardware.

Methodology
The paper proposes a lightweight, deployment-oriented neuro-symbolic framework tailored for DDoS detection in OT. The architecture employs a "loose coupling" strategy, integrating two independently trained components:

Neural Component (Temporal Modeling): A compact two-layer Gated Recurrent Unit (GRU) with 64 hidden units. It processes sliding windows of $L=16$ consecutive feature vectors to capture temporal attack patterns. The GRU is chosen over more complex architectures (like LSTMs) for its lower computational complexity and parameter count.
Symbolic Component (Interpretability): A shallow Decision Tree (CART algorithm) trained on the final vector of the sliding window. This component generates human-readable rules (e.g., "if flow duration > threshold and packet length < threshold, then DDoS"), providing transparency and auditability.
Fusion Mechanism: The outputs of the neural branch ( $p_{neural}$ ) and symbolic branch ( $p_{symbolic}$ ) are combined via a convex fusion weight $\alpha$ :
$p_{hybrid} = \alpha \cdot p_{neural} + (1 - \alpha) \cdot p_{symbolic}$
A decision threshold $\tau$ is applied to the hybrid score to produce the final binary classification. Both $\alpha$ and $\tau$ are jointly optimized on validation data to maximize the F1-score, allowing the system to adapt to the specific characteristics (e.g., class imbalance, complexity) of different datasets.

Data Processing and Experimental Setup
The framework utilizes a unified preprocessing pipeline applied to three benchmark datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. Key pipeline steps include:

Label mapping and numeric feature selection.
Robust scaling (using training-set statistics only).
Training-set-only under-sampling to address class imbalance (targeting a 30% attack ratio) while preserving the native distribution in validation and test sets to reflect real-world deployment conditions.
Sliding-window construction ( $L=16$ ) to maintain temporal alignment.

The system is evaluated against a 50 ms latency budget, derived from typical OT control-loop requirements (PLC scan cycles of 1–10 ms and SCADA polling of 1000 ms).

Key Results
The framework was evaluated on standard metrics (Accuracy, F1, MCC, FPR, FNR) and validated on real-world edge hardware.

Performance on Benchmarks:
- CIC-DDoS2019: The hybrid model achieved 99.04% accuracy and an MCC of 0.97. Crucially, it reduced the False Negative Rate (FNR) to 0.67%, a five-fold improvement over the pure neural baseline (3.34%) and a massive improvement over the pure symbolic baseline (32.12%).
- CICIoT23: Despite the dataset's extreme imbalance (97.6% attack base rate), the hybrid achieved 98.61% accuracy and an MCC of 0.76, reducing FNR to 1.21% compared to 2.16% for the pure neural model.
- Edge-IIoTset: The dataset proved linearly separable; the decision tree alone achieved 100% accuracy, validating the preprocessing pipeline. The optimal fusion weight $\alpha$ was 0.0, indicating the symbolic component sufficed for this specific dataset.
Inference Latency and Resource Usage:
- On a standard workstation CPU, model-only inference latency was sub-millisecond (0.58–0.79 ms).
- Hardware-in-the-Loop Validation: Deployed as an INT8 model using TensorFlow Lite on a Siemens SIMATIC IoT2050 (industrial gateway) and a Raspberry Pi 5, the system achieved mean latencies of 2.9 ms and 0.6 ms, respectively.
- Resource Footprint: Peak resident memory was at most 31 MB, and energy consumption per inference was 3.5 mJ (IoT2050) and 1.3 mJ (Pi 5). These metrics provide an order-of-magnitude headroom within the 50 ms control-loop budget.

Significance and Claims
The paper claims that its primary contribution is a minimal, auditable, late-fusion neuro-symbolic design that successfully balances detection accuracy, explainability, and computational efficiency for resource-constrained OT environments.

Operational Trade-off: The framework prioritizes minimizing False Negatives (missed attacks) over False Positives, aligning with OT safety requirements where a missed attack is more damaging than a false alarm. The fusion strategy allows operators to tune the system (via $\alpha$ and $\tau$ ) to specific environmental needs.
Deployment Feasibility: Unlike previous NSAI approaches that rely on computationally intensive logic solvers or knowledge graphs, this framework demonstrates that a simple GRU + Decision Tree fusion can run on industrial edge gateways with millisecond-scale latency and millijoule-scale energy consumption.
Interpretability: By retaining a shallow decision tree, the system provides human-readable rules that build operator trust and facilitate forensic analysis, a critical requirement for OT security that is often lost in pure deep learning models.

Limitations Acknowledged
The authors modestly note several limitations:

The optimal fusion weight is dataset-dependent, requiring re-optimization for new environments.
On the highly imbalanced CICIoT23 dataset, the hybrid model exhibited an 8.5% False Positive Rate, which the authors identify as operationally high for a Security Operations Center (SOC) and a target for future calibration.
The integration is "loose" (score fusion) rather than "tightly coupled" (differentiable logic), meaning the symbolic component does not constrain the neural optimization during training.
The current evaluation is limited to binary classification; multi-class identification would require more complex modeling.

Technical Summary: A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks

More like this