Adaptive Deep Reinforcement Learning: A Novel Framework for DDoS Detection on Resource-Constrained Edge Devices
Received: 29 November 2025 | Revised: 4 January 2026, 14 January 2026, and 19 January 2026 | Accepted: 21 January 2026 | Online: 6 February 2026
Corresponding author: Syaifuddin Saif
Abstract
The rapid growth of the Internet of Things (IoT) has significantly increased exposure to Distributed Denial of Service (DDoS) attacks, particularly due to the limited resources and heterogeneous traffic characteristics of IoT devices. Conventional intrusion detection approaches, including supervised learning models, often fail to adapt to dynamic traffic patterns and zero-day attacks. This study proposes an adaptive DDoS detection framework based on Deep Reinforcement Learning (DRL) designed for deployment on resource-constrained edge devices. The framework is evaluated using the IoT-DH dataset, a real-world multi-protocol IoT traffic dataset collected via a honeypot. Experimental results show that the proposed DRL-based approach consistently outperforms static models, achieving an F1-score of up to 0.98–0.99 on in-distribution data while maintaining a low False Positive Rate (FPR). Cross-dataset evaluation on public benchmarks further demonstrates stable performance with F1-scores above 0.96 under distribution shifts. Implementation on a Raspberry Pi 3 confirms that the model operates with low inference latency and acceptable resource usage. These results indicate that adaptive DRL provides an effective and practical solution for real-time DDoS detection in edge-based IoT environments.
Keywords:
Deep Reinforcement Learning (DRL), DDoS detection, Internet of Things (IoT), edge computing, Dueling Deep Q-Network (DQN), Prioritized Experience Replay (PER)Downloads
References
N. Sharma, M. Shamkuwar, and I. Singh, "The History, Present and Future with IoT," in Internet of Things and Big Data Analytics for Smart Generation, V. E. Balas, V. K. Solanki, R. Kumar, and M. Khari, Eds. Cham, Switzerland: Springer International Publishing, 2019, pp. 27–51. DOI: https://doi.org/10.1007/978-3-030-04203-5_3
S. Sinha. "Number of connected IoT devices growing 14% to 21.1 billion." IoT Analytics. https://iot-analytics.com/number-connected-iot-devices/.
M. Gelgi, Y. Guan, S. Arunachala, M. S. S. Rao, and N. Dragoni, "Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques," Sensors, vol. 24, no. 11, June 2024, Art. no. 3571. DOI: https://doi.org/10.3390/s24113571
K. Yang, D. Blaauw, and D. Sylvester, "Hardware Designs for Security in Ultra-Low-Power IoT Systems: An Overview and Survey," IEEE Micro, vol. 37, no. 6, pp. 72–89, Nov. 2017. DOI: https://doi.org/10.1109/MM.2017.4241357
C. Tagliaro, M. Komsic, A. Continella, K. Borgolte, and M. Lindorfer, "Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused Protocols," in Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses, Padua, Italy, 2024, pp. 561–578. DOI: https://doi.org/10.1145/3678890.3678899
M. A. Shyaa, N. F. Ibrahim, Z. Zainol, R. Abdullah, M. Anbar, and L. Alzubaidi, "Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems," Engineering Applications of Artificial Intelligence, vol. 137, Nov. 2024, Art. no. 109143. DOI: https://doi.org/10.1016/j.engappai.2024.109143
A. Hussain, E. Marín Tordera, X. Masip-Bruin, and H. C. Leligou, "Rule-Based With Machine Learning IDS for DDoS Attack Detection in Cyber-Physical Production Systems (CPPS)," IEEE Access, vol. 12, pp. 114894–114911, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3445261
R. Alsulami, B. Alqarni, R. Alshomrani, F. Mashat, and T. Gazdar, "IoT Protocol-Enabled IDS based on Machine Learning," Engineering, Technology & Applied Science Research, vol. 13, no. 6, pp. 12373–12380, Dec. 2023. DOI: https://doi.org/10.48084/etasr.6421
Z. Deng, "Developing machine learning-based intrusion detection systems for IoT environments," in Joint Proceedings of the BIR 2025 Workshops and Doctoral Consortium co-located with 24th International Conference on Perspectives in Business Informatics Research, Riga, Latvia, 2025, pp. 246–255.
B. R. Kikissagbe and M. Adda, "Machine Learning-Based Intrusion Detection Methods in IoT Systems: A Comprehensive Review," Electronics, vol. 13, no. 18, Sept. 2024, Art. no. 3601. DOI: https://doi.org/10.3390/electronics13183601
X. Lin, "A Survey of AI-Based Zero-Day Attack Detection Methods," Applied and Computational Engineering, vol. 164, pp. 171–179, July 2025. DOI: https://doi.org/10.54254/2755-2721/2025.PO25664
R. H. Altaie and H. K. Hoomod, "An Intrusion Detection System using a Hybrid Lightweight Deep Learning Algorithm," Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 16740–16743, Oct. 2024. DOI: https://doi.org/10.48084/etasr.7657
T. Schaul, J. Quan, I. Antonoglou, and D. Silver, "Prioritized Experience Replay," in 4th International Conference on Learning Representations, San Juan, Puerto Rico, 2016.
M. Hessel et al., "Rainbow: Combining Improvements in Deep Reinforcement Learning," Proceedings of the AAAI Conference on Artificial Intelligence, vol. 32, no. 1, pp. 3215–3222, Apr. 2018. DOI: https://doi.org/10.1609/aaai.v32i1.11796
S. Jamshidi, A. Nikanjam, K. W. Nafi, F. Khomh, and R. Rasta, "Application of deep reinforcement learning for intrusion detection in Internet of Things: A systematic review," Internet of Things, vol. 31, May 2025, Art. no. 101531. DOI: https://doi.org/10.1016/j.iot.2025.101531
N. Gavric, G. Prasad Bhandari, and A. Shalaginov, "Towards Resource-Efficient DDoS Detection in IoT: Leveraging Feature Engineering of System and Network Usage Metrics," Journal of Network and Systems Management, vol. 32, no. 4, Aug. 2024, Art. no. 69. DOI: https://doi.org/10.1007/s10922-024-09848-2
S. Saif, W. Widyawan, and R. Ferdiana, "IoT-DH dataset for classification, identification, and detection DDoS attack in IoT," Data in Brief, vol. 54, June 2024, Art. no. 110496. DOI: https://doi.org/10.1016/j.dib.2024.110496
W. Fedus et al., "Revisiting Fundamentals of Experience Replay," in Proceedings of the 37th International Conference on Machine Learning, Vienna, Austria, 2020, pp. 3061–3071.
A. K. Cook et al., "Multiple-Choice Questions in Small Animal Medicine: An Analysis of Cognitive Level and Structural Reliability, and the Impact of these Characteristics on Student Performance," Journal of Veterinary Medical Education, vol. 47, no. 4, pp. 497–505, July 2020. DOI: https://doi.org/10.3138/jvme.0918-116r
M. Chahoud et al., "Reward shaping in DRL: A novel framework for adaptive resource management in dynamic environments," Information Sciences, vol. 715 Oct. 2025, Art. no. 122238. DOI: https://doi.org/10.1016/j.ins.2025.122238
Downloads
How to Cite
License
Copyright (c) 2026 Syaifuddin Saif, Widyawan Widyawan, Ridi Ferdiana
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
