MP-IoT Defender: A Unified Deep Neural Network for Multi-Protocol DDoS Detection in IoT Networks

The rapid growth of Internet of Things (IoT) deployments has made them both a prime source and a prime target of Distributed Denial-of-Service (DDoS) attacks. Existing detectors are typically designed for a single protocol, so mixed Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP) traffic either requires separate models or leaves gaps in coverage. This paper presents MP-IoTDefender, a unified deep neural network that detects DDoS traffic across TCP, UDP, and ICMP within a single model. Training and evaluation use a custom labelled dataset, captured in an isolated testbed, that covers benign traffic and SYN, UDP, and HTTP-flood attacks; the dataset is publicly available. The framework extracts thirty-four deterministic packet- and flow-level features and passes them to a twelve-layer feed-forward network regularised with dropout and L2 penalties and trained with stratified splitting. On a held-out test set, the unified model reaches 96.60% accuracy, 97.56% precision, 98.94% recall, and 98.25% F1-score after 50 epochs, with recall above 98% in every training configuration and no sign of overfitting in the training and validation curves. Preliminary mixed-protocol runs exceeded 99% accuracy. Compared with recent protocol-specific and hybrid detectors, MP-IoTDefender provides broader protocol coverage within a single model.