Research Appraisals
Evidence-based critical appraisals of the latest medical research, systematically evaluated using Oxford CEBM methodology.
Showing 2 appraisals
PloS one
Distributed denial of service detection and mitigation in software-defined networking-enabled software-defined wide area networks
Software-defined wide area networks (SD-WAN), empowered by software-defined networking (SDN) technology, offer unparalleled flexibility and efficiency in wireless communication. However, their integration introduces new security challenges, particularly in mitigating distributed denial of service (DDoS) attacks. In this paper, we propose an advanced security framework tailored to SDN-enabled SD-WAN. A dataset collected during experiments was used for training and testing the model's performance. Our framework leverages machine learning algorithms to detect and classify DDoS attacks targeting SD-WAN controllers, considering the environment's unique characteristics. We develop adaptive machine learning model capable of accurately discerning high-rate and low-rate DDoS attacks, enhancing the network's resilience against sophisticated threats. Results from controlled experiments show promise for real-world deployment, though further validation is needed. Our results highlight the framework's ability to adapt to dynamic network conditions and provide robust security for SDN-enabled SD-WAN. Our adaptive model integrates RF and DT explicitly for SD-WAN contexts, achieving 99.97% accuracy for high-rate attacks and 99.96% for low-rate attacks. Our QT-PCA preprocessing pipeline reduces dimensionality while preserving performance, and PACKET_IN event-triggered mitigation enables dynamic response. This method significantly enhances security solutions' accuracy, ensuring robust DDoS attack detection in SD-WAN environments. Additionally, by leveraging the SD-WAN architecture's efficiency, our approach optimizes network performance, underscoring its efficacy and practicality in enhancing security and efficiency.
14 May 2026
Read appraisal →PloS one
Enhancing intrusion detection in encrypted DoH traffic through a robust ensemble learning framework
The DNS over HTTPS (DoH) protocol enhances user privacy by encrypting DNS queries and responses within HTTPS. However, this encryption enables attackers to tunnel malicious traffic through covert DoH channels and make detection difficult for network security and enterprises. In this study, we propose a stacked ensemble approach that employs four sequential base learners' - two Long Short-Term Memory (LSTM) and two Gated Recurrent Unit (GRU) neural networks as base classifier networks with varied hyperparameters and XGBoost (eXtreme Gradient Boosting) as the meta-learner. An XGBoost model trained on out-of-fold predictions generated by base learners supported through stratified 5-fold cross validation. We also applied Recursive Feature Elimination (RFE) with XGBoost for cross-validated feature selection and decreased high-dimensional feature spaces from 29 to 13 and 20 features on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets respectively. The proposed framework was evaluated on the CIRA-CIC-DoHBrw-2020 and DoH-Tunnel-Traffic-HKD datasets achieved 0.9996 recall, 0.9999 F1-score and 1.0000 AUC-PR on CIC-DoH dataset and 0.9998 recall, 0.9999 F1-score, and 1.0000 for both AUC-ROC and AUC-PR on HKD-DoH dataset. The proposed model outperforms all individual base classifiers, evaluated ML models, and existing state-of-the-art approaches. The proposed XGBoost meta-model needs only 1.26 seconds for training and 0.129 seconds for inference on HKD-DoH dataset, thus making the proposed framework both highly accurate and computationally efficient for real-world intrusion detection in encrypted DoH traffic.The preprocessed data and the source code supporting the findings of this study are available at: https://github.com/soreettihussein/Stacked-ensemble-meta-learning-IDS-for-DoH-network-traffic/tree/main.
10 Apr 2026
Read appraisal →