EDCRAN: an enhanced dual-channel residual attention network for real-time DDoS attack detection in IoT

Dataset description

This study uses the Kaggle-hosted open-source IN-DDoS24 dataset. The dataset shows real IoT network traffic from a number of various types of devices functioning normally. It includes a number of distinct DDoS assault scenarios. It is a suitable option for evaluating modern intrusion detection algorithms since it is both realistic and varied.

Data collection and labeling: The packets from the network were organized into flows using the conventional 5-tuple. The protocol, source and destination IP addresses, and ports were all part of this. To label each flow, we utilized scripts that generated attacks, device logs, and execution records, which were time-stamped, that we obtained during the compilation of the dataset. This ensured that legitimate ground truth was used to classify both positive and negative traffic features.

Feature set: This dataset encompasses a wide range of data types, including statistical, temporal, and protocol-level information. Intrusion detection in the IoT is its primary function. All the attributes used in this inquiry are detailed in Table 2. In addition to features, this table also includes descriptions and classifications.

Class distribution: The dataset is very skewed, which is unfortunately typical of IoT systems. These attacks are relatively uncommon, with mixed-vector DDOS, HTTP flood, and ICMP flood being among the most unusual. Typical attacks on this group include regular traffic. Our solution was the Dynamic Weighted Balancing Strategy, also known as DWBS. To redirect the system’s attention and inspection efforts toward attack classes that are currently receiving insufficient attention, this method is being implemented.

Preprocessing steps: The training set was created by removing duplicate or broken flow entries and handling missing values in accordance with the guidelines provided by the first dataset. To standardize numerical data and alter categorical markers, the study used min-max scaling and one-hot encoding, respectively. Moreover, further filtering is performed using the Selective Hybrid Extraction (SHE) module to remove inconsistencies and preserve only the most essential features.

Train/Validation/Test split. To make it simpler to test a reliable model, the dataset was divided into three sections: 70% for training, 15% for validation, and 15% for testing. To ensure that each category had a representative number of unexpected attack types, a stratified sampling procedure was used.

Data preprocessing

Some preprocessing processes are used to make sure the dataset is clean, organized, and ready to be modeled (Mishra et al., 2020; Wang et al., 2024; Zhang et al., 2024b; Qiu et al., 2025). This procedure employs a collection of distinct methods, each tailored to deal with the dataset’s inherent heterogeneity and unique traits. Data normalization begins with bringing all continuous attributes’ scales into agreement on a single range, usually between 0 and 1. Having widely varying characteristic magnitudes aids convergence of numerous machine learning techniques. In order to normalize, the following equation must be obtained:

(1) $$X^{\ast }=\frac{X-min(X)}{max(X)-min(X)}$$with $X^{\ast }$ standing for the scaled feature, X for the raw attribute value, and $min(X)$ and $max(X)$ for its smallest and maximum observed values, respectively. Once normalization is complete, any outliers are selected and eliminated. As the dataset includes traffic data with very high and very low values, it is necessary to detect and deal with outliers. We take a fresh tack by updating the IQR method with a dynamic scaling factor that changes with the feature distribution; this makes our technique extremely advanced. The equation for identifying outliers adjusted:

(2) $$\mathrm{O}\mathrm{u}\mathrm{t}\mathrm{l}\mathrm{i}\mathrm{e}\mathrm{r}=W\le Q{1}^{\mathrm{\prime }}-m\cdot IQ{R}^{\mathrm{\prime }}\mathrm{o}\mathrm{r}W\ge Q{3}^{\mathrm{\prime }}+m\cdot IQ{R}^{\mathrm{\prime }}.$$

The third quartile of the dataset is represented as $Q{3}^{\mathrm{\prime }}$ and the first quartile is $Q{1}^{\mathrm{\prime }}$. To compute the interquartile range (IQR’), subtract Q3′ from Q1′ and use $m$ as a scaling factor to determine outlier identification sensitivity. The value of $m$ is fixed to 1.5 for standardization, but may be adjusted depending on dataset features. The next step involves managing the categorical variables ‘Device Type’ and ‘Operating System’. Frequency encoding substitutes categorical variables with their frequency instead of one-hot encoding. Use this equation:

(3) $$W^{\mathrm{\prime }}=\frac{g(W)}{k}.$$

The transformed variable is represented by W′, the category count by $g(W)$, and the total number of occurrences in the dataset is explicitly given by $k$. Despite reduced dimensionality, each category remains significant. Next, identify the most informative aspects and remove the rest. To determine feature significance, recursive feature removal and correlation matrix are used, using the equation (Mishra et al., 2020):

(4) $$\mathrm{F}\mathrm{e}\mathrm{a}\mathrm{t}\mathrm{u}\mathrm{r}\mathrm{e}\mathrm{I}\mathrm{m}\mathrm{p}\mathrm{o}\mathrm{r}\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{c}\mathrm{e}=\frac{{\sum }_{j=1}^m|s_{j,k}|}{m}$$ $s_{j,k}$ specifies the correlation coefficient between characteristics $j$ and $k$, and $m$ indicates the total number of features. By quantifying the relative importance of each attribute in predicting the target label, this method improves and simplifies the model. We use a special preprocessing strategy to clean, organize, and optimize the dataset. This ensures that DDoS detection models perform effectively in Internet of Things scenarios. Every step of the process is improved in terms of accuracy, consistency, and reliability, and data issues are resolved using this strategy.

Advanced data preparation: balancing and feature optimization

The two crucial steps after initial data preparation are addressing the imbalance in the class distribution and prioritizing the features that will be most valuable for training the model (Susan & Kumar, 2021; Zhang et al., 2024a; Yue et al., 2025). Having said that, both of these things are vital. Due to underrepresentation of certain attack types in unbalanced datasets, inaccurate generalization and biased learning may result. Maintaining a customized approach throughout the prediction process is crucial for accurately representing all classes, including the ones with less frequent attack types. By extracting and selecting additional features, it is also possible to speed up and improve DDoS detection in IoT networks. To increase the feature space and balance the dataset, both methods are shown in Algorithm 1.

Classification: enhanced dual channel residual attention network

After preprocessing and optimising the dataset, a strong classification model called the EDCRAN is provided. To accurately identify DDOS attacks in IoT networks, this new model integrates the characteristics of EfficientNet (Navaneethakrishnan et al., 2024) and Vision Transformer (ViT) (Yin et al., 2022). A residual attention mechanism allows the EDCRAN’s two primary channels, the TAC and the SCC, to combine their outputs. The layered network is shown visually in Fig. 2.

Hyperparameter tuning with GJO

The GJO technique is used to optimize the hyperparameters of the EDCRAN model. Based on the golden jackal’s cooperative hunting, GJO efficiently explores and exploits the hyperparameter space. The optimization of the hyperparameters is represented by $V_j^{(t+1)}$ and the optimal solution is denoted by $V_{\mathrm{b}\mathrm{e}\mathrm{s}\mathrm{t}}$. The candidate who is performing is responsible for controlling the tracking intensity with $\gamma$, adjusting the attacking phase with $\delta$, and increasing search space coverage and diversifying exploration with $\mathrm{\Lambda }$.

(16) $$V_j^{(t+1)}=V_{\mathrm{b}\mathrm{e}\mathrm{s}\mathrm{t}}-\gamma \cdot |V_j^{(t)}-V_{\mathrm{b}\mathrm{e}\mathrm{s}\mathrm{t}}|+\delta \cdot \mathrm{\Lambda }.$$

The optimization of the hyperparameters is represented by $V_j^{(t+1)}$ and the optimal solution is denoted by $V_{\mathrm{b}\mathrm{e}\mathrm{s}\mathrm{t}}$. The candidate who is performing is responsible for controlling the tracking intensity with $\gamma$, adjusting the attacking phase with $\delta$, and increasing search space coverage and diversifying exploration with $\mathrm{\Lambda }$. GJO adaptively controls learning rate, batch size, and regularization in the EDCRAN model. Increasing the model’s exploration and exploitation improves its performance and helps it find ideal hyperparameters. GJO, which optimizes model hyperparameters using HPC servers, only works offline. By implementing these changes, we can ensure that the EDCRAN model works effectively before its implementation. The final model and parameters are sent to IoT edge devices after training. Inference does not need optimization or convergence overhead when everything is clear. Due to its minimal and efficient runtime, this method is suitable for resource-constrained environments. GJO’s quick convergence and small CPU footprint enable low-power Internet of Things devices to run the EDCRAN model in real-time without compromising performance.

Performance evaluation metrics

The Attack Complexity Weighted Score (ACWS) and Contextual Prediction Stability (CPS) are two new measures introduced in this study. Along with the more common metrics, such as recall, accuracy, precision, F1-score, and area under the curve (AUC), others are also included. To detect DDoS attacks in an IoT setting, these metrics are designed to track key elements of a model’s behavior. To sustain this conversation, forecasts must be robust against attacks of varying degrees of complexity and maintain their accuracy over time. Checking the accuracy of the model’s predictions over time is made easy using CPS. These metrics are used to measure the model’s reliability. When examining the anticipated class probabilities, CPS seeks volatility; lower volatility indicates greater stability over time. The standard approach primarily considers pointwise correctness; this is distinct from it. The definition of the metric is as follows:

(17) $$\mathrm{C}\mathrm{P}\mathrm{S}=1-\frac{1}{N-W+1}\sum _{t=W}^N\frac{|P_t-P_{t-1}|}{2}.$$

The predicted probability at time $t$ is shown by the variable $P_t$, the total number of time points is shown by the variable N, and the size of the window is shown by the variable W. The average flow time observed in the dataset over the whole method is used to determine the value of W for calibration, ensuring that temporal segments consistently display the correct traffic intervals. Although it is linked to smoothness metrics used in sequence modeling, CPS is especially developed to work for probability-based intrusion detection.

Another novel measure that demonstrates the model’s ability to detect attacks of varying degrees of complexity is the AACWS. Because specific attacks are uncommon, highly dynamic, or distributed across multiple protocol levels, it may be challenging to detect them. Each type of assault is assigned a complexity weight, denoted by $w_j$, to account for these variations. This complexity weight is dependent on a wide range of variables, including anomaly score dispersion, payload variability, and rarity. ACWS is expressed as:

(18) $$\mathrm{A}\mathrm{C}\mathrm{W}\mathrm{S}=\frac{\sum _{j=1}^K{w}_j\cdot {\mathrm{T}\mathrm{P}}_j}{\sum _{j=1}^K{w}_j\cdot ({\mathrm{T}\mathrm{P}}_j+{\mathrm{F}\mathrm{P}}_j)}.$$The accurate results (TPj) and incorrect results (FPj) variables stand in for the relevant data in class j. All of the weights are set up so that they equal one when summed together. This weighting technique strengthens the impact of improved recognition of complex or low-frequency assaults on the final score. Because of their greater stealth, the second and third forms of attacks are much less prevalent.

To prove the efficacy of the measures, the CPS was compared to the moving-window F1 and temporal AUC, and the ACWS was compared to the weighted F1 and balanced accuracy measurement. ACWS provided clearer information on how well individuals fared in infrequent, high-impact assaults, which traditional measures often overlook. CPS was more sensitive to short-term prediction instability. CPS and ACWS demonstrate how the concept works in real-life applications utilizing the Internet of Things. Attack complexity and temporal consistency are crucial for intrusion detection in these cases. They enhance accuracy metrics and reveal model behavior.

Model deployment feasibility and practicality in IoT environments

Crucially, a high-performance server that is not linked to the internet executes the whole model pipeline, which consists of preprocessing, dynamic balancing using DWBS, feature selection with SHE, and training. Our goal is to demonstrate how user-friendly EDCRAN would be in practical Internet of Things scenarios. In contrast, IoT devices do not perform these resource-intensive activities. Nodes in the network’s periphery get only the model’s little inference module after it has undergone exhaustive training and optimization.

The architecture of EDCRAN has been designed to be efficient, allowing it to provide fast forecasts while using minimal memory. Using depthwise separable convolutions, the SCC differs from the TAC’s compact attention approaches. This two-step process involves training the model offline and then deploying it live to ensure that IoT devices remain responsive and use energy efficiently. Furthermore, it enables the identification of DDoS attacks in real-time, eliminating the need for expensive computing budgets.

Experimental setup and dataset description

The experiments were conducted on an Intel Core i7 workstation with 16 GB of RAM, utilising Python for model creation and assessment, with the aid of Scikit-learn, TensorFlow, and PyTorch. Automated hyperparameters for EDCRAN were chosen using the Golden Jackal Optimisation (GJO) technique. With its variety of DDoS attack behaviours and actual IoT traffic, the IN-DDoS24 dataset was used for training and validation. To prevent any potential impact from future traffic patterns on the training process, all flow data were first organised chronologically according to their timestamps. This was done before the train/validation/test divides were created. The complete architecture and parameters, layers along with values are shown in Table 3.

The accuracy, F1-score, AUC, CPS, and ACWS values shown here represent the mean across all pipeline runs, with minimal variation, and were used to evaluate the model’s stability. The initialisation seeds used were five separate random ones. After that, the dataset was cleaned, normalised, and class-balanced using DWBS. Then, features were refined using the SHE module to build an input space that was consistent and of high quality. We evaluated EDCRAN’s performance with many baseline intrusion detection models to assess its accuracy, processing efficiency, and suitability for IoT contexts with limited resources. Moreover, it further discusses in depth the design and training setup for repeatability in the parts that follow.

Edge efficiency analysis

To support the lightweight-deployment claim, the computational behaviour of EDCRAN was evaluated using its architecture profile and measured runtime performance. With 1.18 M trainable parameters and approximately 0.62 GFLOPs per forward pass, the model requires around 4.7 MB of memory in FP32 precision (and about 2.4 MB when using FP16). On the workstation used for experimentation (Intel Core i7, 16 GB RAM), the model achieves an average inference time of 2–3 ms per sample. This proves that EDCRAN can keep its computational cost and memory footprint low. This makes it a good fit for resource-constrained Internet of Things environments that rely heavily on real-time detection. With a variation of $\pm$0.3 milliseconds, the average inference latency across all five experiments was 2.8 milliseconds. To determine whether the data was consistent over time, we consulted this data. For real-time Internet of Things (IoT) deployments, EDCRAN’s constant timing characteristic is crucial because to its relative stability, especially in situations when network requirements are subject to change. Its minimal variance is evidence of this.

Attack analysis and traffic distribution

The various forms and distribution of DDoS assaults are shown in Fig. 3. In terms of frequency, the next most prevalent kinds of traffic are application layer attacks (12.8%), UDP flood (19.1%), SYN flood (25.5%), and regular traffic (42.6%). Using data balancing strategies during model training is essential to avoid bias in favor of majority classes. The need for this differentiation becomes clear when one considers how real networks operate. Consider the frequency of certain types of attacks while designing intrusion detection systems. Because of this, it is possible to take focused actions. This manner, both typical and out-of-the-ordinary dangers may be identified.

Figure 4 illustrates DDoS assaults on Linux, Windows, and RTOS operating systems. Most attacks target Linux, Windows, and RTOS. Linux has been attacked 100,000 times, Windows 80,000. Linux is open-source and widely utilized in industrial systems, thus attackers target it. Hackers target Linux, as seen by these statistics. Linux powers many IoT devices. The analysis demonstrates that Linux installation settings need custom security measures. Linux’s flexibility and customisation might make users more susceptible. Information security experts may use this data to understand OS-specific hardening tactics, fix important security gaps, and protect Internet of Things ecosystems from new attacks.

Network protocols (TCP, UDP, ICMP) are distributed in both regular and attack traffic, as seen in Fig. 5. With 150,000 everyday occurrences and 80,000 attacks, TCP traffic is the most prevalent. The prevalence of IoT devices is suggested. Then comes UDP with 120,000 normal and 60,000 attack events. Less-checked real-time apps utilize it. The lowest diagnostic distribution is ICMP, with 50,000 normal and 20,000 attack events. These numbers illustrate how protocols operate within a network. We need protocol-specific defenses since TCP might be targeted. Databases are susceptible to SYN Flood attacks; however, they are protected by TCP handshakes. For average anomaly scores across different attacks, refer to Fig. 6. A score indicates weird behavior. Typical traffic has an irregularity value of 0.1, whereas App Layer Attack has the highest score of 0.9. The App Layer Attack sees the most surprising behavior. It appears that there are distinct patterns of traffic. The anomaly ratings for SYN Flood and UDP Flood are 0.85 and 0.7, respectively. This is because, despite their diversity, they lack the sophistication of malicious actors operating at the application layer. The results show the significance of anomaly detection systems. They may distinguish the two types of traffic. System sensitivity and attack miss rate are both improved by increasing high-anomaly attack detection settings. This figure help adaptive detection systems find DDoS problems.

Protocol behavior and temporal trends

The distribution of attack types across the year is shown graphically in Fig. 7. This illustrates how types impact network traffic and security. Normal traffic dominates all months, as seen by the stacked area figure. In contrast, SYN Flood, UDP Flood, and Application Layer Attack exhibit various patterns across time. During seasonal or operational changes, preventive and adaptive measures must be taken to protect oneself. EDCRAN works effectively with IN-DDoS24, according to this study. It must be compatible with bigger and more diverse IoT networks. We will use datasets with varying network sizes, traffic patterns, and threats to demonstrate EDCRAN’s ability to adapt to dynamic Internet of Things circumstances.

The data in Fig. 8 shows that out of all the traffic, 57.1% is carried by TCP, 35.7% is by UDP, and 7.1% is via ICMP. The widespread use of TCP demonstrates its dependability and suitability for connection-oriented communication. One indication that UDP excels in real-time applications is its widespread use. Diagnostic or flood attacks may still cause damage, even when ICMP attacks are infrequent. This research suggests that EDCRAN’s ability to generalize across protocols is a strong suit; however, to prove its robustness, it is necessary to use a wider variety of traffic scenarios and larger networks. To evaluate EDCRAN’s performance in actual Internet of Things environments, this approach will be used in subsequent experiments.

Figure 9 shows that 7.1% of DDoS traffic is ICMP, 35.7% is UDP, and 57.10% is TCP. DDoS assaults often use the TCP. TCP might be targeted by a SYN Flood, a connection-based assault, due to its prevalence. Data may overflow as UDP does not need a state. However, less common uses, such as reconnaissance and targeted flooding, utilize the Internet Control Message Protocol (ICMP). For this reason, adaptive systems and protocol-aware detection are crucial. As seen in Fig. 10, TCP sessions, which are primarily concerned with connections, tend to last longer than UDP sessions (30.2% of the time) and ICMP sessions (15.8% of the time). The reason is that a TCP session only lasts for fifty-five seconds. These enhancements have made it clear that flow time patterns are crucial for identifying DDoS attack types targeting specific protocols.

Feature importance and anomaly detection

Figure 11 shows the distribution of anomaly ratings across different network protocols. These stages are shown in the figure. The SYN Flood and ACK Flood attacks exploit the fact that TCP can handle a wide range of anomaly scores. A security issue arises with the TCP, which is a connection-based protocol. UDP is susceptible to attacks such as UDP Floods because of its lack of connection-oriented features. In comparison to other algorithms, UDP has a smaller range of anomaly scores. Due to its primary use in network diagnostics, ICMP’s anomaly ratings are infrequently updated. In light of these results, it appears that protocol-specific anomaly detection systems are crucial for identifying and defending against targeted attacks.

A stacked histogram showing changes in payload length with various attacks is shown in Fig. 12. Standard payload sizes for IoT network communication are 64 and 128 bytes. The 512-byte and 1,024-byte payloads are used by SYN and UDP Flood attack techniques, respectively. There are numerous ways that application-layer attacks can evade detection systems, even if their payloads differ. Unusual payload sizes may be uncovered via the discovery of anomalies. Reduce false positives and aid in detecting high-frequency attacks by utilizing payload-specific characteristics. The importance of attack-specific detection is further highlighted. It would lead to improved DDoS protection. By analyzing the relationship between packet rate, payload length, and anomaly scores, Figs. 13 and 14 illustrate how traffic responds to various attacks. Application Layer Attacks may cause system overload as a consequence of increasing traffic, as seen in Fig. 13. Under UDP Flood attacks, a 1024-byte payload is effective. These differences underscore the importance of traffic pattern analysis when developing systems to detect various types of attacks. Figure 14 displays a three-dimensional scatter plot illustrating a correlation between higher anomaly scores and faster packet speeds and payloads. The UDP Flood and the Application Layer Attack are two examples of aggressive attacks. The fact that benign traffic is more evenly distributed suggests that the model can differentiate between benign and harmful actions. In multidimensional traffic, they enhance anomaly detection systems. Systems can proactively handle intricate and ever-changing DDoS patterns.

Classification performance and statistical analysis

A packet rate density map for different assault strategies is given in Fig. 15. This graphic shows how attacks affect network data flow. Density peaks occur when packet rates increase due to SYN Flood and UDP Flood attacks, overwhelming the target with traffic and depleting its resources. Intrusion detection systems identify and classify this focused activity. Regular traffic is continuous and well-distributed; we can use it as a baseline to identify outliers. These patterns help IDSs by changing packet-rate thresholds for early detection and lowering false positives.

The correlation matrix for certain selected features is shown in Fig. 16. Predictive modeling and its implications are shown in this matrix. The speed of packets, flow duration, payload length, and anomaly score can help detect network attacks. Adding related variables emphasizes key qualities and enhances model prediction. Source Port and Anomaly Score are weak connections that reveal the data isn’t helpful and simplify it. A correlation matrix simplifies feature selection, making it easier to detect DDoS attacks and other network issues. As shown in Fig. 17, the DDoS prediction model prioritizes the importance of each feature. Since they match attacker traffic, the Anomaly Score and Flow Duration may also detect attacks. To learn about atypical traffic patterns, the model may utilize all of these attributes and then select the most relevant one. Additionally, Source Port and Source IP may not have a significant impact. Optimizing processing resources by prioritizing essential variables improves model accuracy and data handling. The confusion matrix used for categorizing different types of DDoS attacks is shown in Fig. 18. The algorithm ensures that the rates of false positives and false negatives for each category remain below 3, enabling it to distinguish between dangerous and regular traffic quickly. Minimizing instances of misclassification becomes crucial when precise detection is necessary to maintain network security in real-world scenarios. The model’s remarkable classification performance shows this.

The model is able to distinguish between good and poor data in real-time Internet of Things scenarios, as shown in Fig. 19. The model seems to be successful against a wide variety of assaults, according to the AUC ratings, which fall within the range of 0.978 to 0.995. The model’s ability to handle complicated and high-dimensional patterns is shown by its maximum AUC, which was obtained during the Application Layer Attack. The results show that the model’s architecture is strong; it detects risks by using advanced feature selection and optimization techniques. Further, they facilitate detection to numerous evolving IoT scenarios.

After thirty epochs of training and testing, the EDCRAN model’s accuracy is shown in Fig. 20, with convergence being achieved by the twenty-fourth epoch. The successful learning is demonstrated by the constant improvement in accuracy during the early epochs, while the robust generalisation without overfitting is indicated by the end accuracy of 98.99 percent. The training and testing losses are significantly reduced in the first few epochs, as seen in Fig. 21, but they stabilise after the 24th epoch. The model’s ability to learn and reduce its error rate is made abundantly obvious by this discovery. It seems that EDCRAN can reliably and properly identify complex DDoS patterns in real-world circumstances, according to the conservative estimates of final loss.

The comparison of DDoS detection systems’ accuracy, precision, and AUC is presented in Table 4. Proposed EDCRAN employs a unique dual-channel residual attention architecture to focus on relevant features and minimise input noise, thereby enhancing performance. The model distinguishes between attacks and non-attacks with an AUC of 99.5% and an accuracy of 98.9%, yielding minimal false positives. Dropout regularisation and feature selection improved EDCRAN performance. It helps models to operate effectively with imbalanced and noisy datasets. Attention layers and residual connections enable EDCRAN to assimilate and display complex DDoS attack patterns. EDCRAN’s CNN and DBN outperform Adaptive Transfer Learning for advanced, attention-free DDoS detection. Complex and resource-intensive, GNN Ensemble Learning and MMEDRL-ADM improve detection with ensemble and metaheuristic tuning. MSCBL and CNN-LSTM-Transformer effectively handle time- and space-varying data. It employs static feature extraction, which is unable to handle EDCRAN and other attacks. EDCRAN is reliable and scalable, as it can detect multiple DDoS attacks. Complex data linkages and large, high-dimensional datasets pose challenges for SVM and Decision Trees. Rapid EDCRAN threat detection makes networks safer and more robust to growing attacks.

Table 5 displays statistical analysis of execution durations for DDoS attack detection models, including Adaptive Transfer Learning with CNN, DBN, CNN-LSTM-Transformer, Correlation-Aware LSTM and Transformers, and EDCRAN. Statistics such as mean, median, minimum, maximum, range, and standard deviation are used to evaluate a model’s computational efficiency and stability. The suggested EDCRAN is computationally efficient and stable because of its short mean execution time and low variability. EDCRAN achieves high detection accuracy and low computational overhead due to its streamlined dual-channel architecture and enhanced residual attention mechanism. Its lightweight design is well-suited for real-time IoT applications that require rapid response times. Regular models, such as Adaptive Transfer Learning with CNN and CNN-LSTM-Transformer, take longer and are more unpredictable. Their sophisticated designs and lack of real-time performance adjustment may explain this. These models are helpful in certain situations but struggle to balance computing load with forecast accuracy. When compared to more complex models, Decision Trees and SVMs are easier to operate, but their lack of accuracy and durability makes them unsuitable for complex real-time detection applications. EDCRAN’s ability to combine computational economy with detection reliability makes it a promising candidate for scalable and time-sensitive IoT applications, outperforming both complicated and straightforward methods.

Resource efficiency and scalability

In Fig. 22, Precision, Recall, and F1-score values are compared for five methods: Adaptive Transfer Learning with CNN, DBN, CNN-LSTM-Transformer, GNN Ensemble Learning, and Proposed EDCRAN, across dataset sizes from 20,000 to 250,000 records. The proposed EDCRAN surpasses all previous approaches, with Precision, Recall, and F1-score improving considerably with dataset size. EDCRAN has the highest F1-score of 0.9875 at 250,000 records, demonstrating its capacity to generalize in larger and more complex datasets. EDCRAN’s dual-channel residual attention architecture combines global and local information for precise classification, yielding improved performance. Advanced preprocessing methods, such as DWBS and SHE, enhance minority attack class recall by addressing unbalanced datasets. Optimised feature selection reduces overfitting, improving accuracy and F1-score. Other approaches work well with smaller datasets but struggle with larger ones due to issues with feature extraction and imbalance management. DBN and CNN-LSTM-Transformer have poorer recall rates, suggesting difficulty in collecting complicated attack patterns from large datasets. These findings demonstrate EDCRAN’s scalability and efficiency in IoT network intrusion detection.

Figure 23 compares processing time for several approaches, including Adaptive Transfer Learning, Deep Belief Networks, CNN-LSTM-Transformer, GNN Ensemble Learning, and Proposed EDCRAN, with increasing dataset sizes. The EDCRAN has the lowest processing times across all dataset sizes and scales well with bigger datasets. EDCRAN processes 250,000 records in 50 s, whereas GNN Ensemble Learning and CNN-LSTM-Transformer take 105 and 100 s. Due to its lightweight dual-channel residual attention technique, which balances computational efficiency and feature extraction, EDCRAN processes data more efficiently. EDCRAN removes redundant features via SHE, reducing computing overhead. Its optimised hyperparameter tuning utilising Golden Jackal Optimisation (GJO) speeds convergence, increasing efficiency. Due to their ensemble methodologies and sequential processing architectures, GNN Ensemble Learning and CNN-LSTM-Transformer take longer to process. Large, unbalanced datasets are inefficiently processed using these approaches without adaptive pretreatment, such as DWBS. This chart shows EDCRAN’s applicability for real-time IoT with rapid and reliable intrusion detection.

As the dataset grows, Fig. 24 displays CPU and memory use for each strategy. The least resource-intensive approach is EDCRAN, with 42% CPU and 2.0 GB RAM for 250,000 entries. CNN-LSTM-Transformer and GNN Ensemble Learning require over 85% CPU and 7.8 GB RAM. By employing lightweight convolutional layers and attention approaches, EDCRAN’s scalable method simplifies computation. This maximizes resources. EDCRAN’s TAC and SCC handle global and local trends without further processing. The DWBS reduces rebalancing calculations, saving resources. Since they utilize ensemble techniques and deep recurrent structures, GNN Ensemble Learning and CNN-LSTM-Transformer consume more resources. EDCRAN is beneficial in resource-constrained settings like edge-based IoT setups where speed is crucial.

The accuracy of various techniques, taking into account the expanding dataset, is shown in Fig. 25. EDCRAN beats competitors with 98.9% accuracy for 250,000 records. However, GNN Ensemble Learning scores 95.6%. CNN-LSTM-Transformer and CNN-Adaptive Transfer Learning only get 94.0% and 93.2%. EDCRAN yields accurate results because to its dual-channel design and sophisticated preprocessing pipeline. The model finds important patterns by reducing noise and unnecessary features using feature dropout and Selective Hybrid Extraction (SHE). The CPS and ACWS measurements assess the model’s ability to handle complicated attack patterns. The lack of dynamic balancing and constrained feature selection in Adaptive Transfer Learning with CNN and DBN may explain its low performance. EDCRAN can detect several complete Internet of Things datasets, as shown.

The new EDCRAN model outperforms all other models on the IN-DDoS24 and CIC-DDoS2019 datasets, as shown in the comparison in Table 6. With 98.9% accuracy and 99.5% AUC on IN-DDoS24 and 97.6% accuracy and 98.2% AUC on CIC-DDoS2019, EDCRAN routinely surpasses existing CNN-LSTM hybrids, graph-based models, and transformer-driven approaches. These benefits show the effectiveness of EDCRAN’s dual-channel residual attention design. In many IoT contexts, it improves the reliability of DDoS attack detection and captures more complicated traffic patterns.

An ablation study assessing the key components of the EDCRAN architecture is shown in Table 7. Removing the TAC or SCC reduces accuracy and AUC, indicating that heterogeneous IoT traffic requires global contextual modeling and targeted spatial pattern extraction. EDCRAN, SMOTE, and class reweighting were evaluated to assess the Dynamic Weighted Balancing Strategy. Although less accurate, F1-score, and CPS than DWBS, these techniques fared better than no balancing mechanism. DWBS outperforms synthetic oversampling and static reweighting for rapidly changing, highly skewed IoT attack distributions. Similar trends were seen using Chi-square–based feature selection and SHE. Due to EDCRAN’s nonlinear feature refinement, duplication was reduced and discrimination improved, but Chi-square variation underperformed SHE. Finally, eliminating the Golden Jackal Optimization (GJO) module increased execution time and lowered predictive performance, proving hyperparameter tuning is necessary for accuracy and stability. A full EDCRAN configuration has maximum accuracy, F1-score, and AUC and competitive execution time. Each component impacts performance and produces a robust, well-balanced intrusion detection architecture.

The accuracy of the proposed model’s categorization is impacted by the hyperparameters used, as shown in Fig. 26. This demonstrates that the learning rate, batch size, and dropout rate influence model performance and flexibility. The optimal setup has a 99.8 percent success rate with a learning rate of 0.01 and a batch size of 96. Assuming sufficiently large learning rates and batch sizes, the described technique seems to expedite convergence while preserving stability. It is crucial to choose hyperparameter ranges intelligently to prevent a value loss plateau, as seen in a plateau of growing accuracy performance. In varied situations, the model can come together without underperforming or overfitting. Our results show that hyperparameter modification balances prediction accuracy and computational economy. Since factors change and resources are limited, IoT performance requires adaptation. Since it remains accurate when parameters change, the model is valuable in real life. This research shows the EDCRAN architecture’s scalability and durability in varied IoT network contexts and gives academics and practitioners a practical guidance for adjusting hyperparameters to minimize resource utilization and improve detection accuracy.

The Table 8 evaluates forecasting models against performance consistency, correlation strength, and statistical reliability. Strong Spearman’s and Pearson’s correlation scores and a low Paired ANOVA result indicate that the proposed EDCRAN has good generalization and low prediction variability across data subsets. Recursive feature selection and deep learning capture complex data interactions. Bi-LSTM and ResNet-18 have lower correlation and more variability than EDCRAN, but they still struggle to adapt to new features. Traditional methods like Decision Trees and Random Forests are less trustworthy and have higher error margins for high-dimensional Internet of Things data. EHO minimizes execution time and speeds network convergence to enhance EDCRAN. The statistical research shows that EDCRAN can identify DDOS assaults on complicated IoT datasets.