1D-CNN Multikernel Architecture for DDoS Attack Classification in IoT Environments

Becerra-Suarez F.L.; Forero M.G. · Lecture Notes in Computer Science (2026) · DOI: 10.1007/978-3-032-23161-1_11

Resumen

The exponential growth of the Internet of Things (IoT) has become the main target for cybercriminals to orchestrate various attacks such as distributed denial of service (DDoS). Despite advances, there is still a need for accurate, low-resource solutions that are adaptable to the IoT environment. This paper presents a one-dimensional multikernel convolutional architecture (1D-CNN) and an LSTM optimized for the classification of traffic associated with different types of DDoS attacks. The models were trained and evaluated on CICIoT2023 using a stratified 1% per-class sample of the normal and DDoS classes (which together represent 75.15% of the dataset). Two classification scenarios were considered: multiclass and binary. The 1D-CNN achieved an F1 score of 0.9981 in multiclass and 0.9991 in binary, outperforming the LSTM, which obtained 0.9692 and 0.9989, respectively. The 1D-CNN contains 433,557 parameters, about 85% fewer than the LSTM, confirming its lightness and computational efficiency. These results support its suitability for real-time monitoring and detection deployments in IoT environments. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2026.

Instituciones: Universidad Privada Norbert Wiener