Network Attacks Research Articles

Event-based [formula omitted] load frequency control for fuzzy Markov-jump IPS with wind power under hybrid attacks

This paper addresses the H∞ load frequency control problem of interconnected power systems that incorporate high-permeability wind power and face a mixed attack of deception and denial of service. The interconnected power system is modeled as a Takagi–Sugeno (T–S) fuzzy Markov jump system. Given the involvement of wind power, optimizing the utilization of already in-demand communication resources becomes imperative. Thus, a new event-triggering mechanism is adopted to reduce data transmission traffic. Simultaneously, in response to the general network’s vulnerability to network attacks in power systems, a closed-loop system with Markov jump, modeled using the T–S fuzzy approach, is studied. A novel multi-agent Event-Triggering Strategy (ETS) composed of membership functions is proposed to address the mismatch between the membership functions of fuzzy systems and fuzzy controllers, and ensure the consistency of multi-agent systems. Subsequently, employing Lyapunov–Krasovskii theory and stochastic analysis techniques, conditions sufficient to ensure the asymptotic stability of interconnected power systems are derived from linear matrix inequalities. Finally, simulation verification is provided to ensure the accuracy and feasibility of the obtained theory.

Implementation of DHCP Snooping Method to Improve Security on Computer Networks

This research proposes the DHCP Snooping method which is used to increase security on computer networks because Dynamic Host Configuration Protocol (DHCP) is a potential target for computer network attacks, one of the attack gaps that can occur in DHCP is the DHCP Rogue attack which is the simplest hacking method in which the attacker creates a fake DHCP connected to the core network allowing the hacker to set up a fake DHCP Server with full access to distribute IP addresses to clients. To address security gaps in computer networks in this research, researchers applied the DHCP Snooping method, which is a series of techniques to improve DHCP network security. When the DHCP server allocates IP addresses to clients on the LAN, DHCP Snooping can be configured on the LAN switch to allow only clients with certain IP and MAC addresses to have access to the network. By implementing the DHCP Snooping method you can increase security on computer networks where DHCP Snooping can distinguish which ports can be trusted (Trusted Port) and which ports cannot be trusted (Untrusted Port) so that the security of data and information in the computer network is maintained properly. Based on the results of this research, DHCP Snooping can prevent clients from getting DHCP IPs from DHCP Rouge because it has determined Trusted Port and Untrusted Port.

Enhancing Network Attack Detection Accuracy through the Integration of Large Language Models and Synchronized Attention Mechanism

In this study, we propose a novel method for detecting cyberattack behaviors by leveraging the combined strengths of large language models and a synchronized attention mechanism. Extensive experiments conducted on diverse datasets, including server logs, financial behaviors, and comment data, demonstrate the significant advantages of this method over existing models such as Transformer, BERT, OPT-175B, LLaMa, and ChatGLM3-6B in key performance metrics such as precision, recall, and accuracy. For instance, on the server log dataset, the method achieved a precision of 93%, a recall of 91%, and an accuracy of 92%; on the financial behavior dataset, it reached a precision of 90%, a recall of 87%, and an accuracy of 89%; and on the comment data dataset, it excelled with a precision of 95%, a recall of 93%, and an accuracy of 94%. The introduction of a synchronized attention mechanism and a newly designed synchronized loss function proved especially effective, enhancing the method’s ability to process multi-source data and providing superior performance in identifying complex cyberattack patterns. Ablation experiments further validated the crucial roles of these innovations in boosting model performance: the synchronous attention mechanism substantially improved the model’s precision, recall, and accuracy to 93%, 89%, and 91% respectively, far exceeding other attention mechanisms. Similarly, the synchronized loss showcased a significant advantage, achieving the best performance across all tested metrics compared to traditional cross-entropy loss, focal loss, and MSE. These results underscore the method’s ability to deeply mine and analyze semantic information and contextual relationships within text data as well as to effectively integrate and process multimodal data, thereby offering strong technical support for the accurate and efficient detection of cyberattack behaviors.

A Novel Traffic Classification Approach by Employing Deep Learning on Software-Defined Networking

The ever-increasing diversity of Internet applications and the rapid evolution of network infrastructure due to emerging technologies have made network management more challenging. Effective traffic classification is critical for efficiently managing network resources and aligning with service quality and security demands. The centralized controller of software-defined networking provides a comprehensive network view, simplifying traffic analysis and offering direct programmability features. When combined with deep learning techniques, these characteristics enable the incorporation of intelligence into networks, leading to optimization and improved network management and maintenance. Therefore, this research aims to develop a model for traffic classification by application types and network attacks using deep learning techniques to enhance the quality of service and security in software-defined networking. The SEMMA method is employed to deploy the model, and the classifiers are trained with four algorithms, namely LSTM, BiLSTM, GRU, and BiGRU, using selected features from two public datasets. These results underscore the remarkable effectiveness of the GRU model in traffic classification. Hence, the outcomes achieved in this research surpass state-of-the-art methods and showcase the effectiveness of a deep learning model within a traffic classification in an SDN environment.

A Hybrid Light Gradient Boosting Approach with Deep Boltzmann Machine for Intrusion Detection System

The need for network attack analysis and the number of cyber threats and attacks are increasing. Due to the scalability and adaptability of its internet-based computing resources, cloud computing is gaining popularity among businesses worldwide. Scientists are increasingly interested in cloud data security and face the difficulty of protecting hosts, enterprises, and data against more advanced digital threats. Over the past few decades, researchers have experimented with the Intrusion Detection (ID) paradigm, leading to various methodologies. However, critical to analyze the abnormalities in the intrusion detection framework. This research aims to classify the attacks or abnormalities in the network included in the NSL-KDD dataset using a Hybrid Light Gradient Boosting approach with Deep Boltzmann Machine. A Deep Boltzmann Machine Classifier and an ensemble model of the Light Gradient Boosting technique were used to create this model. Gradient boosting techniques improve the performance of DL classifiers by minimizing the number of errors discovered during network intrusion detection. This work evaluates and contrasts the proposed classifier with recognized classification strategies. The proposed model surpasses previous Recall, F-Measure, Precision, and Accuracy techniques.

IDG-SemiAD: An Immune Detector Generation-Based Collaborative Learning Scheme for Semi-supervised Anomaly Detection in Industrial Cyber-physical Systems

Anomaly detection is a critical line of defense to ensure the network security of industrial cyber-physical systems. However, a significant issue in the anomaly detection is the insufficient labels of anomaly classes. With emergence of the new and unknown network attacks, accurately labeling these attacks can be a costly task. The issue of inadequate labeling may negatively impact the detection performance of many existing anomaly detection methods. To meet this gap, this paper proposes a semi-supervised collaborative learning paradigm called IDG-SemiAD, based on an immune detector generation algorithm. First, we design an immune detector generation algorithm based on a chaos map to generate abnormal samples from self-samples. Then, these abnormal samples are combined with self-samples and given specific labels to form a new training set. Finally, the LightGBM classifier is used for training and detection. Experiments on the widely used public dataset BATADAL show that the proposed IDG-SemiAD outperforms the classical v-detector method in terms of recall and f-score, with improvements of 8.2% and 8%, respectively, and outperforms deep learning-based anomaly detection methods, with a maximum improvements of up to 89.7% and 59.5% respectively.

Distributed Denial of Service Attack Detection in IoT Networks using Deep Learning and Feature Fusion: A Review

The explosive growth of Internet of Things (IoT) devices has led to escalating threats from distributed denial of service (DDoS) attacks. Moreover, the scale and heterogeneity of IoT environments pose unique security challenges, and intelligent solutions tailored for the IoT are needed to defend critical infrastructure. The deep learning technique shows great promise because automatic feature learning capabilities are well suited for the complex and high-dimensional data of IoT systems. Additionally, feature fusion approaches have gained traction in enhancing the performance of deep learning models by combining complementary feature sets extracted from multiple data sources. This paper aims to provide a comprehensive literature review focused specifically on deep learning techniques and feature fusion for DDoS attack detection in IoT networks. Studies employing diverse deep learning models and feature fusion techniques are analysed, highlighting key trends and developments in this crucial domain. This review provides several significant contributions, including an overview of various types of DDoS attacks, a comparison of existing surveys, and a thorough examination of recent applications of deep learning and feature fusion for detecting DDoS attacks in IoT networks. Importantly, it highlights the current challenges and limitations of these deep learning techniques based on the literature surveyed. This review concludes by suggesting promising areas for further research to enhance deep learning security solutions, which are specifically tailored to safeguarding the fast-growing IoT infrastructure against DDoS attacks.

PETRAK: A solution against DDoS attacks in vehicular networks

In recent years, the frequently reported incidents of Distributed Denial of Service assaults on vehicular networks in various countries have made researchers find new protective solutions. DDoS attacks can propagate through the charging points for electric vehicles in a charging station and affect the production of critical infrastructures such as electric grids. Existing solutions are efficient in attack detection; however, current systems do not offer multi-level protection, and zero-day vulnerabilities are prone to escape from the detection systems.In this paper, we address the problems mentioned above and introduce the first Machine Learning (ML)–based DDoS protective solution to combine prevention and detection mechanisms in vehicular networks. To be more specific, our proposed model is the first to consider the adaptive traffic threshold to generate the alarm for a suspicious amount of traffic flow in an Intrusion Detection Prevention System (IDPS). We call our proposed approach Protecting vEhicular neTworks against distRibuted deniAl of service attacKs (PETRAK). PETRAK uses four functions: prevention, alarm, training, and detection. The alarming system uses the flow parameters and activates the detection module to detect malicious packets. The prevention system works in two modes: immediate and future. PETRAK uses logistic regression to identify incoming packets and signatures of malicious packets to prevent future attacks. We also show that our proposed model is implacable towards advanced post-quantum cryptography-based traffic and also able to analyse side-channel attacks. We run a comprehensive set of experiments to test PETRAK on our synthesized dataset, KDDCUP’99 dataset, CIC-MalMem-2022, and the ToN-IoT dataset. We observe that PETRAK shows an accuracy of 99%. The results claim the efficiency of PETRAK in detecting and preventing DDoS attacks in vehicular networks.

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Faced with the challenges of security strategy design brought about by the complexity of attack behavior and the dynamism of network structure, dynamic hierarchical intelligent defense methods have shown their effectiveness. However, in complex network environments, their application requires a higher level of coordination mechanisms. Therefore, this paper proposes a hierarchical multi-agent reinforcement learning network attack and defense game and cooperative defense decision-making method, which autonomously and efficiently completes the formulation of defense strategies and defense behavior responses. Firstly, we construct a Stackelberg hypergame model of cyberspace conflicts, and under the condition of information loss, characterize the multi-layer dynamic defense coordination response mechanism. Secondly, By utilizing a hierarchical multi-agent reinforcement learning method as the driving force for game evolution, we sequentially solve the Nash equilibrium of the game, and form a dynamic autonomous defense strategy. Finally, we construct a hierarchical multi-agent reinforcement learning framework, which decouples the defense decision problem, reduces the dimension of the defense action space and the exploration difficulty of the strategy space, and learns coordinated defense strategies more efficiently. We used the CybORG (Cyber Operations Research Gym) environment for simulation. We compared and analyzed the autonomously generated cyber defense strategies with other related works, verifying the superior coordination performance of our method in defense strategy generation and control.

Leveraging datasets for effective mitigation of DDoS attacks in software-defined networking: significance and challenges

Software-Defined Networking (SDN) has emerged as a transformative paradigm for network management, offering centralized control and programmability. However, with the proliferation of Distributed Denial of Service (DDoS) attacks that pose significant threats to network infrastructures, effective mitigation strategies are needed. The subject matter of this study is to explore the importance of datasets in the mitigation of DDoS attacks in SDN environments. The paper discusses the significance of datasets for training machine learning models, evaluating detection mechanisms, and enhancing the resilience of SDN-based defense systems. Goal of the paper is to assist researchers in effectively selecting and usage of datasets for DDoS mitigation in SDN, thereby maximizing benefits and overcoming challenges involved in dataset selection. This paper outlines the challenges associated with dataset collection, labeling, and management, along with potential solutions to address these challenges. Effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Characterization of tasks for each section is as follows: Importance of datasets in DDoS attack mitigation in SDN, challenges in dataset utilization in DDoS mitigation in SDN, Guidelines for dataset selection, comparison of datasets used and their results and different dataset usage according to the need. Methodology involves collecting results in tabular form based on prior research to analyze the characteristics of existing datasets, techniques for dataset augmentation and enhancement, and evaluating the effectiveness of different datasets in detecting and mitigating DDoS attacks through comprehensive experimentation. Results of our findings indicate that effective detection and mitigation of DDoS attacks in SDN require robust datasets that capture the diverse and evolving nature of attack scenarios. Our findings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks. In conclusion, our findings provide valuable insights into the importance of datasets in enhancing the resilience of SDN infrastructures against DDoS attacks and highlight the need for further research in this critical area. Thorough guidelines for dataset selection and impacts of different datasets used in recent studies, provide research challenges and future directions in this area.

KS-SDN-DDoS: A Kafka streams-based real-time DDoS attack classification approach for SDN environment

Software-Defined Networking (SDN) is a modern networking architecture that segregates control logic from data plane and supports a loosely coupled architecture. It provides flexibility in this advanced networking paradigm for any changes. Further, it controls the complete network in a centralized using controller(s). However, it comes with several security issues: Exhausting bandwidth and flow tables, Distributed Denial of Service (DDoS) attacks, etc. DDoS is a powerful attack for Internet-based applications and services, traditional and SDN paradigms. In the case of the SDN environment, attackers frequently target the central controller(s). This paper proposes a Kafka Streams-based real-time DDoS attacks classification approach for the SDN environment, named KS-SDN-DDoS. The KS-SDN-DDoS has been designed using highly scalable H2O ML techniques on the two-node Apache Hadoop Cluster (AHC). It consists of two modules: (i) Network Traffic Capture (NTCapture) and (ii) Attack Detection and Traffic Classification (ADTClassification). The NTCapture is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-1). It captures incoming network traffic, extracts and formulates attributes, and publishes significant network traffic attributes on the Kafka topic. The ADTClassification is deployed on the two nodes Apache Kafka Streams Cluster (AKSC-2). It consumes network flows from the Kafka topic, classifies it based on the ten attributes, and publishes it to the decision Kafka topic. Further, it saves attributes with outcome to the Hadoop Distributed File System (HDFS). The KS-SDN-DDoS approach is designed and validated using the recent “DDoS Attack SDN dataset”. The result shows that the proposed system gives better classification accuracy (100%).

A novel authentication scheme for long-term evolution mobility management: A security investigation

Long-term evolution in wireless broadband communication aims to provide secure communication for users and a high data rate for a fourth-generation network. Even though the fourth-generation network provides security, some loopholes lead to several attacks on the fourth-generation network attacks. The denial-of-service attack occurs when the user communicates with a rogue base station, and the radio base station in fourth-generation long-term evolution networks ensures that the user is attached to the rogue node assigned network. The location leak attack occurs when the packets are sniffed to find any user’s location using its temporary mobile subscriber identity. Prevention of rogue base station and location leak attacks helps the system achieve secure communication between the participating entities. Earlier works in long-term evolution mobility management do not address preventing attacks such as denial-of-service, rogue base stations and location leaks and suffer from computational costs while providing security features. Hence, the present paper addresses the vulnerability of these attacks. It also investigates how these attacks occur and exposes communication in the fourth-generation network. To mitigate these vulnerabilities, the paper proposes a novel authentication scheme. The proposed scheme is simulated using Network Simulator 3, and the security analysis of the proposed scheme is shown using AVISPA –a security tool. Numerical analysis demonstrates that the proposed scheme significantly reduces communication overhead and computational costs associated with the fourth-generation long-term evolution authentication mechanism.

Improving user security during a call

The recent development of mobile networks has led to the emergence of new threats and methods of implementing existing ones. Phishing attacks, including robocalls, are causing record losses to both individual users and large corporations. At the same time, existing countermeasures cannot provide protection against such attacks because most existing solutions focus on device authentication, whereas user authentication does not occur during a call. Another problem with mobile networks is that there is no point-to-point encryption, i.e., the speech is encrypted only on the segment from the subscriber to the base station. The subject of study in this article is the process of ensuring user security during a call. The purpose of this study is to develop a model of mutual user authentication and end-to-end data encryption in a mobile network during a call. The main objectives are the protection of users from spoofing and vishing and the proposal of a protection method by implementing mutual authentication of users during a call without storing confidential information on the side of a "trusted third party". Method of secure key exchange and end-to-end encryption during a call in the mobile network was proposed. It prevents the interception of calls by the operator for circuit-switched and packet networks. The methods used are mathematical modelling, ontological approach, and multi-criteria optimization models. Because of this research, an algorithm for mutual authentication of users is proposed by introducing biometric authentication methods and modifying the sequence of messages during a call. The proposed approach can be implemented for CS-call and VoLTE/VoWiFi calls. A call cannot be received without user biometric authentication; such as ear pattern or bone conduction methods. Modified SETUP and CONNECT ACK messages are used to inform the other party about the user verification result. This prevents user spoofing, call masquerading, and robocalls. A combination of the proposed asymmetric encryption, a short authentication string, and hashes of previous calls provides a higher level of confidentiality, integrity, and additional resistance to man-in-the-middle attacks. Conclusions. The scientific novelty of the obtained results is the integration of the above methods into the sequence of call flow messages for providing mutual authentication, end-to-end encryption, and counteraction to the number of network attacks. The proposed methods allow one level to increase the provision of services of privacy and observation groups and can be implemented in the software part of user equipment.

Predicting DoS and DDoS attacks in network security scenarios using a hybrid deep learning model

Abstract Network security faces increasing threats from denial of service (DoS) and distributed denial of service (DDoS) attacks. The current solutions have not been able to predict and mitigate these threats with enough accuracy. A novel and effective solution for predicting DoS and DDoS attacks in network security scenarios is presented in this work by employing an effective model, called CNN-LSTM-XGBoost, which is an innovative hybrid approach designed for intrusion detection in network security. The system is applied and analyzed to three datasets: CICIDS-001, CIC-IDS2017, and CIC-IDS2018. We preprocess the data by removing null and duplicate data, handling imbalanced data, and selecting the most relevant features using correlation-based feature selection. The system is evaluated using accuracy, precision, F1 score, and recall. The system achieves a higher accuracy of 98.3% for CICIDS-001, 99.2% for CICIDS2017, and 99.3% for CIC-ID2018, compared to other existing algorithms. The system also reduces the overfitting of the model using the most important features. This study shows that the proposed system is an effective and efficient solution for network attack detection and classification.

Cyber security attack recognition on cloud computing networks based on graph convolutional neural network and graphsage models

In this paper, the modeling of the network attacks of cloud computing through Graph Neural Networks is considered. Based on structural features and relationships between neighboring nodes and the edges of the cloud ecosystem a cyberattack detection method is proposed. A simulation dataset is created on the CSE-CIC-IDS2018 dataset to train and test the proposed graph neural network based models. In a comparative analysis of the suggested method with the existing one superior results are obtained from the model constructed on the GraphSAGE algorithm. Thus in the recognition of dataset samples, the model obtained a value of 0.97739 according to the accuracy metric. The values obtained by the algorithm on precision, recall, and F1-score metrics were also higher compared to the Graph Convolutional Neural Network model.

Multi-task learning for IoT traffic classification: A comparative analysis of deep autoencoders

As a system allowing intra-network devices to automatically communicate over the Internet, the Internet of Things (IoT) faces increasing popularity in modern applications and security threats — particularly network intrusions that target both networks and devices. A major threat is network attacks that attempt to obtain unauthorised access and damage the networks or systems. To effectively safeguard against these attacks, it is essential to use efficient hybrid intrusion detection systems with advanced techniques. Deep learning-based algorithms, such as Autoencoders (AEs), have been recognised as efficient methods for intrusion detection. However, it is crucial to further analyse the impact of different structures on detection performance. This paper proposes a method combining AE for data reconstruction and anomaly detection and multi-task learning (MTL)-structured models for IoT traffic classification. Additionally, we suggest a hybrid resampling technique with the Synthetic Minority Over-Sampling Technique and Generative Adversarial Network (SMOTE-GAN) for enhanced training and conduct a comparative analysis of different neural networks with AEs. The experimental results on two publicly available datasets demonstrate the effectiveness and practicality of the proposed AE-MTL approach compared with single-task learning. Additionally, while the performance varies on different datasets, Long Short-Term Memory (LSTM), Gated Recurrent Units (GRU), and Convolutional Neural Network (CNN) have improved the detection of minor classes.

TENNER: intrusion detection models for industrial networks based on ensemble learning

In the pursuit of discerning patterns within computer network attacks, the utilization of Machine Learning and Deep Learning algorithms has been prevalent for crafting detection models based on extensive network traffic datasets. Furthermore, enhancing detection efficacy is feasible by applying cluster learning techniques, wherein multiple Machine Learning models collaborate to yield detection outcomes. Nevertheless, it is imperative to discern the optimal features within the dataset for training the intrusion detection model. In the present study, we proffer a novel framework for feature selection and intrusion detection within industrial networks, employing Ensemble Learning to achieve commendable performance in terms of both high predictive accuracy and efficient learning duration. The outcomes evince that the proposed model exhibits an accuracy of 99.93%, with a mere one h and 34 min required for comprehensive training. In contrast, a model trained without the framework presented in this paper attains an accuracy of 99.94%, necessitating an extensive training period of 156 h. Notably, the detection model derived from the proposed solution demonstrates superior results in prediction time, accomplishing predictions within 0.0009 seconds, compared to the alternative model which requires 0.0076 seconds for predictions.

Research and Application of Active Security Protection Methods for Automotive Cloud

With the gradual maturity of the Internet of vehicles and cloud computing industry and the continuous evolution of network attack forms, the demand for cloud security in the automotive industry will increase year by year. In the automobile cloud platform environment, because the traditional security scheme is still effective for the north-south traffic, the security problem of the automobile cloud platform mainly lies in the security protection of the east-west traffic of the platform and the division of the security boundary. The purpose of this project is to solve the security risk of east-west cross-subnet traffic of the automobile cloud platform, especially the traffic security problem between hosts, in order to provide the next generation firewall, intrusion prevention and other professional security protection functions for the virtual network environment without affecting the service virtual machine. In order to achieve the above purpose, it is necessary to solve the problem of virtual switch diversion and virtual machine drift on the cloud platform, study the service security requirements of the automotive cloud platform, the relationship between data transfer and processing on the cloud platform, and finally provide a prototype system of active security protection for the cloud platform risks. The system implements VM microisolation, network attack defense, malicious code defense, ip address-based secure access policies, application-type secure access policies, and VM migration security functions in cloud application scenarios.

Enhancing Network Security: Leveraging Machine Learning for Intrusion Detection

In order to precisely identify and categorise different kinds of network attacks, this study focuses on applying machine learning approaches for network intrusion detection. Data collection, preprocessing, feature scaling, model definition, feature selection, and assessment metrics are all part of the methodology. Different machine learning models, including Decision Tree Classifier and Random Forest Classifier, are considered, along with the use of all features or some part of features for each attack category. Evaluation is performed using K-fold cross-validation, with metrics such as accuracy, precision, recall, and F1-score analysed. Results indicate the efficiency of Random Forest Classifier in handling high-dimensional datasets and improving detection accuracy, making it a superior choice for network intrusion detection tasks.

Secure deep learning-based energy efficient routing with intrusion detection system for wireless sensor networks

In general, wireless sensor networks are used in various industries, including environmental monitoring, military applications, and queue tracking. To support vital applications, it is crucial to ensure effectiveness and security. To prolong the network lifetime, most current works either introduce energy-preserving and dynamic clustering strategies to maintain the optimal energy level or attempt to address intrusion detection to fix attacks. In addition, some strategies use routing algorithms to secure the network from one or two attacks to meet this requirement, but many fewer solutions can withstand multiple types of attacks. So, this paper proposes a secure deep learning-based energy-efficient routing (SDLEER) mechanism for WSNs that comes with an intrusion detection system for detecting attacks in the network. The proposed system overcomes the existing solutions’ drawbacks by including energy-efficient intrusion detection and prevention mechanisms in a single network. The system transfers the network’s data in an energy-aware manner and detects various kinds of network attacks in WSNs. The proposed system mainly comprises two phases, such as optimal cluster-based energy-aware routing and deep learning-based intrusion detection system. Initially, the cluster of sensor nodes is formed using the density peak k-mean clustering algorithm. After that, the proposed system applies an improved pelican optimization approach to select the cluster heads optimally. The data are transmitted to the base station via the chosen optimal cluster heads. Next, in the attack detection phase, the preprocessing operations, such as missing value imputation and normalization, are done on the gathered dataset. Next, the proposed system applies principal component analysis to reduce the dimensionality of the dataset. Finally, intrusion classification is performed by Smish activation included recurrent neural networks. The proposed system uses the NSL-KDD dataset to train and test it. The proposed one consumes a minimum energy of 49.67 mJ, achieves a better delivery rate of 99.92%, takes less lifetime of 5902 rounds, 0.057 s delay, and achieves a higher throughput of 0.99 Mbps when considering a maximum of 500 nodes in the network. Also, the proposed one achieves 99.76% accuracy for the intrusion detection. Thus, the simulation outcomes prove the superiority of the proposed SDLEER system over the existing schemes for routing and attack detection.