DDoS Attack Detection in Consumer IoT-Based Healthcare Systems Using Improved Off-Policy Proximal Policy Optimization and Generative Adversarial Network

Distributed denial of service (DDoS) attacks threaten the reliability of consumer IoT-based healthcare systems. However, traditional DDoS detection methods often struggle with feature selection, imbalanced datasets, generalizability, and hyperparameter optimization. This paper proposes a novel method for detecting DDoS attacks in healthcare environments. To enhance feature selection and handle imbalanced data, we employ the off-policy proximal policy optimization (PPO) algorithm, which improves sample efficiency by leveraging past experiences in reinforcement learning. SHAP (SHapley Additive exPlanations) values are integrated for precise feature identification, while augmented rewards for underrepresented classes help mitigate data imbalance. An improved generative adversarial network (GAN) is used for online data augmentation, selectively excluding gradients from critical batch elements to generate more diverse and applicable results. Furthermore, the Bayesian Optimization Hyperband (BOHB) method accelerates hyperparameter tuning by combining Bayesian optimization with Hyperband’s scaling capabilities. Our model is evaluated on four datasets: KDDcup99, ISCX UNB, CICDDOS, and DARPA, achieving superior performance over state of the art methods, with accuracy and F-measure values of (90.498%, 89.286%) (93.186%, 91.896%), (92.403%, 90.285%), and (92.849%, 92.790%), respectively. It demonstrates the model’s efficiency in delivering timely predictions, supporting its practical deployment in real-time healthcare cybersecurity systems.