Stacked-RFNet: intelligent fusion model for detecting jamming-based DoS and DDoS attacks in wireless sensor networks

Abstract

With the popularization of Internet of Things (IoT) systems, the risk to denial-of-service (DoS), distributed denial-of-service (DDoS), and wire-tapping jamming attacks has increased, especially in environments where heterogeneous deployment is required and in situations where the adversary is adaptively behaving. Existing intrusion-detection systems used in modern practice are usually said to achieve accuracy rates near perfection when tested empirically on small and isolated test beds. Nevertheless, these performance measures are usually based on random, rowwise partitions schemes and are thus not robust to distributional changes or measurement contaminations. In the given research article, a reproducible, robustness-based intrusion-detection model is presented, which incorporates four different datasets, including MOSAIC, BoT-IoT, CICIoT2023, and JamShield, into a deterministic reference model. The strategy includes strict feature intersection and label harmonisation in order to be consistent across datasets. A leakage-resistant preprocessing pipeline is used and the test regime is designed to favour held-out data sets and scenario-solved testing in preference to standard random splits. A further scenario-solved jamming corpus containing twenty CSV files is also added to explicitly evaluate behavioural generalisation in benign, constant, random and reactive jammer situations. In order to test the realism of deployment, noise is added during controlled Gaussian noise of different levels in test-only and noise-aware training regimes. The findings indicate that models with near perfect clean-accuracy show significant performance deterioration when out-of-distribution and when noise are added, hence revealing robustness differences that otherwise would be hidden when evaluated in the common evaluation practices. It has been shown that the proposed Stacked-RFNet is characterized by high cross-dataset performance and robustness competitive in the noise-aware training environment, providing a vivid example of the accuracy-robustness trade-off among the model classes. Overall, this work is relevant to the intrusion detection as it offers a deterministic multi-dataset benchmark, a scenario-resolved evaluation methodology, and an extensive robustness evaluation to allow a more realistic evaluation of intrusion detection in the field.