An AI-Driven LSTM–Fuzzy Framework for Adaptive DDoS Detection in Cyber–Physical Systems (CPSs)

Cyber–Physical Systems (CPSs) are increasingly vulnerable to Distributed Denial-of-Service (DDoS) attacks, which can disrupt critical operations and compromise system safety. Although deep learning (DL) techniques are widely adopted for cyberattack detection, conventional DL-based classifiers often struggle to handle the uncertainty and ambiguity inherent in network traffic data. To address this limitation, this paper proposes an AI-driven hybrid framework, termed LSTM–Fuzzy–CPS, for adaptive DDoS detection in CPS environments. Unlike prior LSTM–Fuzzy approaches that are primarily restricted to SDN settings, the proposed framework is adapted for CPS environments and introduces continuous risk scoring, reduced false positives for safety-critical operation, and proportional mitigation mechanisms. The framework consists of a detection module and a conceptual mitigation module. The detection module, named LSTM–Fuzzy–Detector, integrates an LSTM network with a Mamdani-type fuzzy inference system that maps LSTM outputs into a continuous risk score using triangular membership functions (Low, Medium, High) and centroid defuzzification. The mitigation module is designed as a rule-based conceptual framework that translates risk levels into adaptive response actions; however, its experimental implementation is left for future work. The proposed detector is evaluated on the CICIoT2023 dataset and achieves an accuracy of 99.83% with a false-positive rate of 0.12%, demonstrating strong robustness against complex and evolving attack patterns. These results indicate that the proposed framework provides an effective, interpretable, and scalable solution for intelligent threat detection in CPS environments.