Electrical and Computer Engineering Faculty Publications
Document Type
Article
Publication Date
9-2026
Abstract
Advanced metering infrastructure (AMI) relies on continuous communication among smart meters, gateways, routers, and utility monitoring systems, increasing exposure to distributed denial-of-service (DDoS) traffic. This study presents a system-level intrusion-detection methodology integrating coverage-aware sensor placement with leakage-controlled gradient-boosted classification. The contribution lies in combining monitoring visibility, training-only feature sanitization, duplicate and cross-partition overlap removal, false-positive-constrained threshold selection, repeated external testing, and a validated feature-budget mode. Seventeen CIC-DDoS2019 parquet files were analyzed. After removing conflicting labels, exact duplicate feature vectors, and 4,666 testing records overlapping the training partition, the final dataset contained 121,088 training records and 297,790 external testing records with 60 predictors. Across 10 paired random-seed runs, XGBoost achieved mean accuracy 0.97707, precision 0.99991, recall 0.97258, F1-score 0.98606, receiver operating characteristic area under the curve 0.99944, Matthews correlation coefficient 0.92450, and false-positive rate 0.00044. Random Forest achieved mean F1-score 0.98492. The paired F1 improvement was 0.00113 (95% confidence interval 0.00061–0.00166; one-sided Wilcoxon p = 0.00098), with McNemar testing also favoring XGBoost. Family-level analysis showed weaker recall for synchronize (SYN), User Datagram Protocol (UDP)-lag, and WebDDoS traffic. Independent RT-IoT2022 replication yielded mean XGBoost F1-score 0.99583, while a port/service-stripped sensitivity analysis yielded 0.93984. A CICIoT2023 stress test detected SYN, UDP, and unseen HTTP-flood traffic with recall of at least 0.9998. Results support a reproducible first-stage AMI communication-layer detector while confirming dataset-dependent attack-family detectability.
Recommended Citation
Harsh Kumar and Sanjeev Kumar. “Coverage-Aware Gradient-Boosted Intrusion Detection for Smart-Meter Distributed Denial-of-Service Resilience.” AI, Computer Science and Robotics Technology, ahead of print, September 23, 2026. https://doi.org/10.5772/acrt.20260076.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 International License.
Publication Title
AI, Computer Science and Robotics Technology
DOI
10.5772/acrt.20260076
Comments
©2026 The Author(s), Licensee IntechOpen, License: CC BY 4.0