A Deployment-Oriented and Resource-Efficient Neuro-Symbolic Framework for Explainable DDoS Detection in Operational Technology Networks

2026-08-17

AI Summary

This study addresses the challenge of balancing interpretability, low latency, and high detection rates in DDoS detection for Operational Technology (OT) networks by proposing a neuro-symbolic framework integrating Gated Recurrent Units with Decision Trees. This approach introduces a novel joint optimization mechanism for weights and thresholds, enhancing model transparency while significantly reducing false negatives in critical scenarios. Experimental evaluations on the CIC-DDoS2019 and CICIoT23 datasets demonstrate that the proposed framework achieves accuracy rates of 99.04% and 98.61%, respectively, with inference latency below 1 ms. These results confirm its effectiveness in meeting the stringent real-time security control requirements inherent to OT environments, successfully reconciling the trade-offs between predictive performance and computational efficiency.

Abstract

Operational technology (OT) environments, including programmable logic controllers (PLCs), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) systems, are increasingly targeted by distributed denial-of-service (DDoS) attacks. This paper presents a neuro-symbolic framework specifically designed for robust DDoS detection in these resource-constrained environments. The framework fuses a gated recurrent unit (GRU) neural network with a shallow decision tree as a symbolic component. The symbolic component alone provides a compact, interpretable rule set, while the fusion combines the strengths of both paradigms. The hybrid model is evaluated on three real-world benchmark DDoS datasets: CIC-DDoS2019, Edge-IIoTset, and CICIoT23. A unified comprehensive preprocessing pipeline including label mapping, numerical feature selection, robust scaling, and class balancing is applied. The fusion weight alpha and decision threshold are jointly optimised on validation data to maximise F1-score. The hybrid model attains 99.04% accuracy (MCC 0.97) on CIC-DDoS2019 and 98.61% accuracy (MCC 0.76) on CICIoT23, in both cases reducing the FNR below that of the pure-neural and pure-symbolic baselines; on the linearly separable Edge-IIoTset the shallow decision tree alone already reaches 100%, so this benchmark validates the preprocessing pipeline rather than the fusion. The principal gain of the fusion is a lower FNR at a controlled false-positive cost, which matters in operational technology, where a missed attack is more damaging than a false alarm. Model-only inference latency is sub-millisecond (0.58-0.79 milliseconds per sample) on a standard central processing unit; including on-device flow-feature extraction, the end-to-end path remains within a single-digit-millisecond budget, which is compatible with OT control-loop timing.

Problem

• DDoS detection
• Operational Technology
• Explainability
• Resource-constrained
• Real-time

Innovation

• Neuro-Symbolic Framework
• DDoS Detection
• Operational Technology
• Resource-Efficient
• Explainable AI