2026-10-07T05:20:15Z https://api.figshare.com/v2/oai

oai:figshare.com:article/33985897 2026-09-24T13:56:37Z category_35672 category_33206 category_35681 portal_1042 item_type_3 month_year_09_2026

Coverage-Aware Gradient-Boosted Intrusion Detection for Smart-Meter Distributed Denial-of-Service Resilience - Supplementary Materials Harsh Kumar (657813) Sanjeev Kumar (279609) System and network security Electrical engineering Data engineering and data science Advanced metering infrastructure data leakage management Distributed denial-of-service attacks (DDoS) intrusion detection xgboost <p dir="ltr">Advanced metering infrastructure (AMI) relies on continuous communication among smart meters, gateways, routers, and utility monitoring systems, increasing exposure to distributed denial-of-service (DDoS) traffic. This study presents a system-level intrusion-detection methodology integrating coverage-aware sensor placement with leakage-controlled gradient-boosted classification. The contribution lies in combining monitoring visibility, training-only feature sanitization, duplicate and cross-partition overlap removal, false-positive-constrained threshold selection, repeated external testing, and a validated feature-budget mode. Seventeen CIC-DDoS2019 parquet files were analyzed. After removing conflicting labels, exact duplicate feature vectors, and 4,666 testing records overlapping the training partition, the final dataset contained 121,088 training records and 297,790 external testing records with 60 predictors. Across 10 paired random-seed runs, XGBoost achieved mean accuracy 0.97707, precision 0.99991, recall 0.97258, F1-score 0.98606, receiver operating characteristic area under the curve 0.99944, Matthews correlation coefficient 0.92450, and false-positive rate 0.00044. Random Forest achieved mean F1-score 0.98492. The paired F1 improvement was 0.00113 (95% confidence interval 0.00061–0.00166; one-sided Wilcoxon p = 0.00098), with McNemar testing also favoring XGBoost. Family-level analysis showed weaker recall for synchronize (SYN), User Datagram Protocol (UDP)-lag, and WebDDoS traffic. Independent RT-IoT2022 replication yielded mean XGBoost F1-score 0.99583, while a port/service-stripped sensitivity analysis yielded 0.93984. A CICIoT2023 stress test detected SYN, UDP, and unseen HTTP-flood traffic with recall of at least 0.9998. Results support a reproducible first-stage AMI communication-layer detector while confirming dataset-dependent attack-family detectability.</p> 2026-09-24T13:56:37Z Dataset Dataset 10.5772/acrt.deposit.33985897.v1 https://figshare.com/articles/dataset/Coverage-Aware_Gradient-Boosted_Intrusion_Detection_for_Smart-Meter_Distributed_Denial-of-Service_Resilience_-_Supplementary_Materials/33985897 CC BY 4.0