Advanced IoT–Fog Network‐Based Intrusion Detection Framework Using Granger Causality‐Inspired Graph Neural Network for Robust DDoS UDP Flooding Threat Detection and Cyber Reliability Enhancement

ABSTRACT The growth of IoT increases vulnerability to DDoS UDP flooding, while traditional methods struggle with complex IoT–Fog traffic and often miss coordinated attacks due to ignoring causal device relationships. In this manuscript, advanced IoT–Fog Network‐based Intrusion Detection Framework Using Granger Causality‐Inspired Graph Neural Network for Robust DDoS UDP Flooding Threat Detection and Cyber Reliability Enhancement (IoT‐GCIGNN‐FTD) is proposed. Initially, network traffic and device interaction data are collected from a real‐time simulated IoT–Fog network environment. Then, the collected data are pre‐processed using Dual Central Difference Kalman Filter (DCDKF), used for data cleaning and normalization. The pre‐processed data are fed into a feature extraction stage using the Scarifying Discrete Cosine Stockwell Transform (SDCST) to derive packet‐level features, including packet size, packet rate, protocol type, and source and destination ports. Granger Causality‐Inspired Graph Neural Network (GCIGNN) uses these features to classify traffic as normal or DDoS/UDP attack. To enhance accuracy, the Shrike Optimization Algorithm (SOA) is used to improve GCIGNN parameters, ensuring accurate threat detection and classification. IoT‐GCIGNN‐FTD is evaluated using FNR, FPR, accuracy, precision, recall, specificity, F1‐score, and AUC. IoT‐GCIGNN‐FTD outperforms IDS‐DDoS‐IoTFog, DL‐IDS‐IoMT, and MT‐Fog‐IOT with higher accuracy (6.16%–8.36%), higher recall (5.82%–8.95%), and lower FPR (0.54%–7.82%).