A CALIBRATED HYBRID MACHINE-LEARNING AND DEEP-LEARNING ENSEMBLE FRAMEWORK FOR MULTICLASS DDOS INTRUSION DETECTION IN IOT AND IOMT ECOSYSTEMS

Abstract

The rapid proliferation of the Internet of Things (IoT) and its multimedia-rich extension, the Internet of Multimedia Things (IoMT), has dramatically enlarged the attack surface available to adversaries, with Distributed Denial-of-Service (DDoS) attacks remaining among the most damaging and frequent threats. Conventional signature-based and binary intrusion detection systems struggle with the heterogeneity, class imbalance, and non-stationarity of modern IoT traffic, and they frequently fail on rare but high-impact attack categories such as application-layer WebDDoS. This paper presents a unified, calibrated detection framework that combines classical machine learning (ML), deep learning (DL), and cost-aware ensemble learning for multiclass DDoS classification on a CICDDoS2019-style benchmark. The pipeline integrates mutual-information and recursive feature elimination, SMOTE-ENN balancing, four sequence-aware deep architectures (1D-CNN, CNN-BiLSTM, Temporal Convolutional Network, and a lightweight Transformer), and a cost-aware stacking ensemble with temperature scaling and per-class threshold tuning. Experimental results show that the cost-aware stack attains 99.39% accuracy, a macro-F1 of 0.97, a macro ROC-AUC of 1.00, and—most importantly—raises the WebDDoS F1 from 0.38 to 0.77 while keeping the benign false-positive rate at 0.016. The framework also achieves a low expected calibration error (0.014–0.017), making its probabilities trustworthy for security-operations-center thresholding. The study demonstrates that calibrated, imbalance-aware ensembling is essential for operational IoT/IoMT defense.