1Department of Computer Science, Federal Polytechnic Damaturu, Nigeria
2Department of Computer Science, Federal Polytechnic Bauchi, Nigeria
3Department of Computer Science, University of Birmingham, UK
4Department of Computer Science, FCT College of Education, Zuba, Abuja, Nigeria
5Department of Computer Science, SRM Institute of Science and Technology, Kattankullathur, 603203 Chennai, Tamilnadu, India
The increasing adoption of wireless sensor networks (WSNs) has brought forth significant security challenges, particularly in mitigating distributed denial-of-service (DDoS) attacks. These attacks significantly degrade network performance by bombarding sensor nodes with high volumes of traffic, causing resource depletion and service interruptions. Due to the constrained processing capacity, memory, and energy of WSNs, they are highly susceptible to such threats, which can rapidly drain battery power, reduce communication efficiency, and jeopardize data accuracy. As a result, essential functions like real-time data collection and transmission may be disrupted, impacting critical applications such as environmental monitoring, healthcare, and industrial automation. Moreover, DDoS attacks can introduce security weaknesses, increasing the risk of further exploitation by malicious entities. This paper introduces PSO_KAN, a novel hybrid model that integrates Particle Swarm Optimization (PSO) with the Kolmogorov-Arnold Network (KAN) to improve the detection of such attacks in WSNs. Utilizing Kolmogorov’s superposition theorem; KAN decomposes complex multivariate functions into simpler univariate components. In this framework, PSO plays a key role in optimizing the choice and tuning of these univariate functions and their parameters to ensure accurate representation of attack behaviors. By harnessing PSO’s ability to perform global optimization, the proposed model delivers enhanced performance in terms of detection accuracy, scalability, and computational efficiency. The experimental findings indicate that PSO-KAN attains a remarkable accuracy of 97.5%, surpassing conventional Neural Networks (91.2%), Convolutional Neural Networks (94.5%), Long Short-Term Memory networks (95.1%), and even Neural Networks optimized with PSO (96.7%). This represents a 6.3% improvement over standard Neural Networks and a 0.8% gain compared to other PSO-enhanced models, demonstrating the superiority of the proposed method. Additionally, the model consistently achieves high Precision, Recall, and F1-Scores across various attack types, reinforcing its reliability in network security applications. These results underscore the effectiveness of the integration of PSO and KAN, providing a powerful approach for strengthening the security of WSNs against sophisticated cyber threats.
In recent years, wireless sensor networks (WSNs) have attracted considerable interest from both researchers and industry professionals due to their ability to monitor environmental conditions effectively. Their cost-effectiveness, ease of installation, and user-friendly attributes make them a promising alternative to conventional sensory systems. These benefits have led to their widespread adoption in numerous fields, including healthcare, telecommunications, military applications, environmental observation, and medical research [1]. WSNs function through interconnected sensor nodes, which are arranged in various topologies such as star, tree, or mesh structures [2]. These nodes play a critical role in detecting data transmission and managing communication within the network. Their primary operations include sensing, data processing, computation, and communication [3, 4]. WSNs are commonly deployed in remote and inaccessible regions to monitor natural disasters such as floods, storms, wildfires, volcanic eruptions, and earthquakes. Additionally, they are used in more routine applications, such as tracking patient health metrics, developing smart environments and cities, optimizing logistics and flow management, and enabling Internet of Things (IoT) functionalities [5, 6]. Despite their advantages, WSNs also face several limitations, particularly in terms of security. These networks are vulnerable to various security threats and attacks due to their constrained resources, such as limited battery life, memory, storage, communication bandwidth, and processing power [3]. Furthermore, since WSNs are often deployed in unattended environments, their sensing components are susceptible to significant interference and potential cyber threats. Their accessibility increases the risk of malicious attacks, which can compromise network integrity and disrupt communication. These attacks can be classified into external and internal threats. External attacks involve the introduction of a rogue node that infiltrates the closed network, whereas internal attacks occur when an authorized node is compromised and manipulated by an attacker. The nature and severity of these attacks depend on their intent and the targeted network layer [7]. Among the numerous security threats faced by WSNs, Distributed Denial-of-Service (DDoS) attacks pose a significant challenge. These attacks come in various forms but share the common objective of depleting the energy of sensor nodes, thereby preventing them from performing their designated functions. Different types of DDoS attacks include blackhole, grayhole, flooding, and scheduling attacks. In a blackhole attack, a malicious node falsely claims the role of a cluster head (CH), responsible for forwarding data from sensor nodes to the base station. Instead of relaying the collected data, the attacker intercepts and discards it. Similarly, in a grayhole attack, a malicious node acts as a cluster head but selectively drops data packets at random, forwarding only a portion of the received packets to the base station. In a flood attack, the malicious node transmits excessive cluster head advertisement messages (ADV_CH) at high power levels, causing other sensor nodes to rapidly deplete their energy reserves [8]. This forces distant nodes to use more energy to communicate with the cluster head. In a scheduling attack, the malicious node allocates overlapping data communication slots to multiple sensor nodes, resulting in packet collisions and subsequent data loss. To enhance WSN security and mitigate DDoS attacks, various machine learning and deep learning techniques have been utilized in developing Intrusion Detection Systems (IDS). Algorithms such as Support Vector Machine (SVM) [9], K-Nearest Neighbor (KNN) [10], Perceptron [11], Long Short-Term Memory (LSTM) [12], Recurrent Neural Network (RNN) [13], Convolutional Neural Network (CNN) [14], and Artificial Neural Network (ANN) [15] have demonstrated high accuracy in detecting malicious activities. However, there remains a need for more robust, interpretable, and efficient models that can provide improved security across diverse applications. This paper presents a novel approach for detecting and classifying DDoS attacks in wireless sensor networks using a hybrid model that combines Particle Swarm Optimization (PSO) with the Kolmogorov-Arnold Network (KAN). The proposed system enhances KAN’s ability to optimize univariate functions and parameters by considering each particle in the swarm as a potential solution representing a set of KAN parameters. Initially, PSO generates a population of particles with randomly assigned KAN parameters, such as weights and coefficients for univariate functions. The performance of each particle is assessed by training KAN on the dataset and evaluating its classification accuracy. The particles then refine their positions iteratively based on their own best performance and the best solution found globally, following predefined velocity and position update formulas. This optimization process steers the search towards the most effective KAN parameters, enabling the network to learn optimal function transformations for precise classification. By utilizing PSO’s global search capability, KAN effectively selects the best univariate functions and parameters to strengthen DDoS attack detection in wireless sensor networks.
The objectives of the paper are summarized as follows.
The rest of this paper is organized as follows: Section II of the paper presents the summary of the state-of-the-art approaches. Section III presents the proposed PSO-KAN framework for detection and classification of DDoS in WSN. Section IV presents the presents the experiment and results obtained. Lastly, section VI concludes the work and its findings.
LITERATURE REVIEW
This section explores and evaluates advanced techniques for detecting and predicting DDoS attacks in Wireless Sensor Networks (WSNs). To enhance node security and ensure safe communication within WSNs, researchers from both academia and industry have proposed various methods. For instance, the study in [16] assessed the effectiveness of three algorithms (Deep Neural Network (DNN), Self-Taught Learning (STL), and Recurrent Neural Network (RNN)) in identifying four types of security threats. Their evaluation, based on accuracy, precision, recall, and F1 score, utilized the KDD and NSL-KDD datasets for training and testing. Results indicated that the STL approach achieved the highest accuracy compared to the benchmarked LSTM model. In [17], researchers developed Scale-Hybrid-IDS-AlertNet, a scalable hybrid DNN framework for real-time network traffic analysis and host-level event detection to proactively identify cyber threats. Initially fine-tuned with the KDD-99 dataset, the model was later validated using multiple benchmark datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS2017. The framework demonstrated a higher accuracy for binary classification as compared to multiclass classification when applied to the WSN-DS dataset. The study in [18] introduced a Deep Learning-based Defense Mechanism (DLDM) designed to detect and mitigate DoS attacks during the Data Forwarding Phase (DFP). This method enhances detection reliability for various DoS attacks, including fatigue, jamming, homing, and flooding. Extensive simulation studies showed that the approach effectively distinguished between legitimate and malicious activities, achieving high detection accuracy, improved throughput, enhanced packet delivery ratio, and optimized overall performance, while also reducing energy consumption and minimizing false alarms. Furthermore, the authors in [19] employed Long Short-Term Memory (LSTM) networks to detect different types of cyber threats, such as DDoS attacks, command injection, and network malware, achieving an accuracy of 86.9%. Their findings demonstrated that LSTM outperformed other traditional machine learning techniques, particularly in identifying untrained malware threats, highlighting its superior ability to detect previously unseen attacks. To evaluate the efficiency of machine learning algorithms in identifying and predicting DDoS attacks in WSNs, the authors of [20] implemented a Random Forest (RF) classifier to detect different types of DoS attacks within the WSN-DS dataset. Their approach yielded high F1-scores for Blackhole, Flooding, Grayhole, Normal, and Scheduling (TDMA) attacks, respectively, with a promising classification accuracy. In [21], a comparative analysis was conducted on five major machine learning classification techniques alongside one deep learning algorithm. The researchers trained an Artificial Neural Network (ANN) and five machine learning models using the dataset, applying K-fold cross-validation to enhance predictive performance. The results confirmed that machine learning techniques like Random Forest and Support Vector Machines, along with deep learning approaches such as ANN, were effective in detecting network intrusions. In [22], the Random Forest algorithm was applied to the NSL-KDD dataset, achieving a maximum accuracy of 85.34%. This classification focused on identifying various attack types, including unauthorized remote access, DoS attacks, remote superuser access, and port scanning. The study in [23] analyzed the WSN-DS dataset, a widely recognized dataset in the WSN field, using seven distinct machine learning models. Among them, the Random Forest algorithm exhibited the highest accuracy in comparison to the other algorithms. Similarly, Okur and Dener [24] investigated IoT botnet attack traffic using machine learning techniques, where the Decision Tree algorithm achieved an outstanding accuracy. In [25], researchers further analyzed the WSN-DS dataset by implementing multiple learning models and classifying data based on attack types while also documenting the False Positive Rate and False Negative Rate percentages. To further enhance the performance of Machine Learning and Deep Learning-based Intrusion Detection Systems, several studies have combined the strengths of multiple algorithms to achieve optimal detection and classification accuracy. For instance, in [26], the authors proposed a CNN-LSTM approach to detect and classify DoS intrusion attacks, including Flooding, Blackhole, Normal, TDMA, and Grayhole. Their study utilized the computer-generated WSN-DS dataset for wireless sensor network intrusion detection. The proposed model showed promising results, achieving an accuracy of 97% in detecting and classifying the attacks. In [27], the researchers introduced a hierarchical neural network model named LuNet, which integrates multiple layers of CNN and RNN to jointly learn from input data. The model was tested on both the NSL-KDD and UNSW-NB15 datasets for binary and multiclass classification tasks. On the NSL-KDD dataset, LuNet achieved a higher accuracy rates for binary classification as compared to multiclass classification.
MATERIALS AND METHODS
In this section, the conventional Particle Swarm Optimization, Kolmogorov Arnold Network and the hybrid Particle Swarm Optimization and Kolmogorov Arnold Network (PSO-KAN) for Detection DDoS attacks in Wireless Sensor Networks (WSN) is presented.
Particle Swarm Optimization (PSO) is an optimization technique inspired by the collective movement of birds or fish in search of food. Developed by Kennedy and Eberhart in 1995, PSO has been extensively used to solve optimization problems across different fields. It operates as a population-based method, where multiple candidate solutions, known as particles, navigate the search space to locate the best possible outcome. Each particle's position and velocity are continuously adjusted based on its own past performance and the experience of the entire group. The algorithm aims to direct particles toward the most promising solutions while preserving exploration to prevent convergence to suboptimal points.
Each particle i in the swarm represents a potential solution to the optimization problem in an n-dimensional search space. Each particle has a position Xi?, which indicates its current location within the search space, and velocity Vi?, which determines the direction and speed of its movement. The position and velocity of each particle is given in equation 1 and 2 below.
Xi=(Xi,1, Xi,2, ………Xi,n) 1
Vi=(Vi,1, Vi,2, ………Vi,n) 2
Initially, particles are distributed randomly throughout the search space, and their velocities are assigned random values within set limits. Each particle maintains a record of its personal best position Pb, which represents the most optimal location it has reached based on the objective function. Alongside this, the global best position Gb is determined as the most favorable position discovered by any particle within the swarm.
The velocity and positions of the particles are continuously updated to guide the particle toward an optimal solution based on both individual performance and the swarm’s collective intelligence. The particles' movement is controlled by (3) and (4), which update their velocity and position:
Vit+1=wVit+ c1r1Pb- Xit+ c2r2Gb- Xit 3
Xit+1=Xit+ Vit+1 4
Where the parameter w, known as the inertia weight, regulates the influence of a particle's previous velocity on its current movement. A larger inertia weight fosters broader exploration of the search space, whereas a smaller value enhances exploitation by refining solutions near the best-known positions. The coefficients c1 and c2 serve as acceleration factors, controlling the balance between a particle’s tendency to move toward its personal best position and the global best position identified by the swarm. The variables r1 and r2 are randomly generated within the interval [0, 1], introducing a degree of randomness to enhance the diversity of the search process and Pb represents the best position that particle i has achieved so far, while Gb denotes the optimal position found by any particle in the swarm.
The PSO algorithm continues to run until a specified stopping condition is satisfied, which could be reaching a set number of iterations or attaining a predefined fitness value.
Algorithm 1 presents the Particle Swarm Optimization Algorithm
Algorithm 1: Particle Swarm Optimization Algorithm (PSO)
1 Initialization
2 For Iteration = 1 to Maximum_iteration do
3 For particle =1 to Maximum_particle do
4 Update the particles velocity and their velocity bounds
5 Update the particles positions
6 Evaluation of positions of particles by evaluation function
7 If PAccuracyit > Pbestit
8 Update particle personal best
9 If Pbestit > Gbestt
10 Update global best
11 end
12 end
13 end
14 Update global best accuracy
15 end
Kolmogorov Arnold Network
Kolmogorov-Arnold Networks (KANs) are a type of neural network grounded in the Kolmogorov-Arnold Representation Theorem, which asserts that any continuous function with multiple variables can be expressed as a combination of univariate functions [29]. Unlike conventional feedforward neural networks that depend on weighted sums and activation functions, KANs creates intricate mappings through a structured hierarchy of simple univariate functions. This distinct architecture enhances their efficiency in approximating functions, especially in high-dimensional settings.
The core principle behind Kolmogorov-Arnold Networks (KANs) is the Kolmogorov-Arnold Representation Theorem, which establishes that any continuous function can be represented as a combination of univariate functions. This theorem serves as the basis for KANs, allowing them to approximate complex mappings through a structured hierarchy of simpler functions rather than relying on traditional weighted sums and activation functions.
Given a function f: Rn →R , f can be expressed as follows
fx1, x2, …, xn= q=12n+1Φqp=1nψpq(xp) 5
In this context, Φq and ψpq represent continuous univariate functions. The theorem suggests that instead of using conventional multilayer perceptrons (MLPs), functions can be approximated solely through sums and compositions of univariate functions. This approach provides an alternative to traditional neural networks, enabling more efficient and interpretable function approximate.
A Kolmogorov-Arnold Network (KAN) is structured with two functional layers. The first layer, known as the inner transformation layer, applies univariate transformations ψpq to the input variables. The second layer, called the outer combination layer, processes the sum of these transformed inputs using another set of univariate functions Φq. This hierarchical composition enables KANs to effectively approximate complex functions without relying on traditional weighted sums and activation functions. In KAN, univariate functions ψpq and Φq are commonly represented using neural networks, polynomials, or spline-based models. In practical applications, these functions are often initialized with straightforward linear mappings as follows:
ψpqxp=apqxp+ bpq 6
Φqy= cqy+ dq 7
Here, apq, bpq, cq, and dq represent learnable parameters that are adjusted during training. These parameters are optimized using gradient-based techniques to improve the model’s performance. The forward pass computation of the KAN employs two-layer transformations to compute its output. Given an input X=(x1, x2, …, xn) , the KAN compute the first layer transformation as follows:
yq=p=1nψpq(xp) 8
KAN applies the second layer transformation as follows.
z=q=12n+1Φq(yq) 9
This structured approach enables KANs to effectively capture complex, high-dimensional functions by relying solely on compositions of univariate functions. The parameters of ψpq and Φq are optimized through gradient descent with backpropagation. The gradients of the loss function LL concerning these functions are determined using the chain rule.
∂L∂ψpq=q=12n+1∂L∂Φq . ∂Φq∂yq . ∂yq∂ψpq 10
Because all transformations are univariate, the resulting gradients are more stable than those in traditional deep networks, helping to mitigate problems such as vanishing or exploding gradients.
In this section, the proposed hybrid particle swarm optimization with Kolmogorov Arnold network for detection of DDoS attack in wireless sensor network is presented. The proposed method consists of various phases that includes data collection, data preprocessing, data sampling, PSO_KAN model development and training and the evaluation of the trained model as depicted in figure 1.
Figure 1PSO-KAN Framework
In this work, we employed the dataset developed by the authors of [30], specifically designed to improve the detection and classification of DDoS attacks in Wireless Sensor Networks (WSNs). The dataset was generated using Network Simulator 2 (NS-2) and includes four types of DDoS attacks: Blackhole, Grayhole, Flood, and Scheduling attacks. It was created based on the LEACH protocol, a widely used hierarchical routing protocol in WSNs. Each data instance consists of 19 features, as outlined in Table 1, while the class distribution is depicted in Figure 2.
Table 1 WSN-DS Dataset Attribures and Descriptions
|
S/No |
Attribute |
Description |
|
1 |
Node ID |
Unique ID number of a node |
|
2 |
Time |
Node runtime |
|
3 |
Is CH |
Used to represent a Cluster Head Node |
|
4 |
Who CH |
Cluster Head ID |
|
5 |
Distance to CH |
The distance between a node and a Cluster Head |
|
6 |
ADV CH Sent |
The count of broadcast messages sent by the advertise CH to the nodes |
|
7 |
ADV CH received |
The total number of advertise CH messages received from cluster heads (CHs) |
|
8 |
Join REQ sent |
The total number of join request messages transmitted by the nodes to the cluster head (CH) |
|
9 |
Join REQ received |
The total number of join request messages received by the cluster head (CH) from the nodes |
|
10 |
ADV SCH sent |
The total number of TDMA schedule broadcast messages sent by the cluster head (CH) to advertise the join schedule |
|
11 |
ADV SCH received |
The total number of scheduled messages received by the cluster head (CH) |
|
12 |
Rank |
The sequence in which nodes are assigned time slots during TDMA scheduling |
|
13 |
Data Sent |
The total number of packets transmitted by a normal node to its cluster head (CH) |
|
14 |
Data Received |
The total number of packets received by the node from the cluster head (CH) |
|
15 |
Data sent to BS |
The total number of packets transmitted to the base station (BS) |
|
16 |
Distance CH to BS |
Distance between Cluster Head and Base Station |
|
17 |
Send Code |
The cluster sending code |
|
18 |
Consumed energy |
The remaining energy of the node in the current round |
|
19 |
Attack type |
Nature of the attack |
Figure 2 Distribution of WSN-DS Dataset
The proposed PSO-KAN framework for detecting and classifying DDoS attacks in WSNs incorporates several preprocessing steps to prepare the data effectively for training. The process begins with data cleaning, which involves handling missing values and managing outliers. A median-based approach is used to address missing values, while robust statistical techniques mitigate the impact of outliers that could otherwise affect model training. These steps help remove inconsistencies in the dataset, ensuring optimal model performance. Following data cleaning, normalization is applied to standardize the feature values. This step ensures that all input features contribute equally during training, preventing biases due to differences in magnitude. Standardization adjusts the data to follow a Gaussian distribution with a mean of zero and a standard deviation of one, which is particularly advantageous for deep learning models sensitive to input scale variations. In this approach, the Standard Scaler is applied to the feature matrix X, ensuring uniformity in statistical characteristics across all features. Another essential preprocessing step is encoding the target variable. Since the target column consists of categorical labels, it must be converted into numerical values for the PSO-KAN model to process. Label encoding assigns a unique integer to each category, preserving class distinctions while avoiding unintended ordinal relationships. By integrating data cleaning, normalization, and label encoding, the preprocessing phase establishes a strong foundation for training, allowing the PSO-KAN model to focus on identifying patterns rather than handling inconsistencies in the data.
The dataset is partitioned into two subsets: training and testing. The PSO-KAN model is initially trained on the training set, while the testing set is used to assess its accuracy. A random split is performed, allocating 80% of the data for training and the remaining 20% for testing. Table 2 presents the percentage distribution of each attack class within these subsets.
Table 2 Percentage Split for WSN-DS Attacks
|
Attack type |
Index |
Number of train sample |
Number of test sample |
Percentage (%) |
|
Normal |
0 |
272087 |
67979 |
90.77 |
|
Blackhole |
1 |
8019 |
2030 |
2.68 |
|
Grayhole |
2 |
11653 |
2943 |
3.9 |
|
Flooding |
3 |
2694 |
618 |
0.88 |
|
Scheduling |
4 |
5275 |
1363 |
1.77 |
|
Total |
|
299728 |
74933 |
100 |
The PSO-KAN framework combines Particle Swarm Optimization (PSO) with the Kolmogorov-Arnold Network (KAN) to optimize univariate functions and parameters for detecting DDoS attacks in Wireless Sensor Networks (WSNs). By utilizing PSO’s global search capability, this hybrid approach effectively fine-tunes KAN’s structure, improving both detection accuracy and computational efficiency. The process is carried out in multiple stages, including KAN initialization, PSO-based optimization of KAN parameters, KAN training, and KAN evaluation. In the KAN initialization phase, KAN architecture consisting of input layer that takes the preprocessed WSN features as input, hidden layers consisting of multiple neurons that applies a univariate function ?(x) to the input features and an output layer that aggregates the transformed features using a weighted sum to generate the final classification output is build. Each univariate function ?(x) is chosen from a predefined set, such as polynomial, sigmoid, or Gaussian functions. Each neuron is associated with a set of parameters θ that determine its behavior. The initial selection of functions and parameters is performed randomly. The randomly generated KAN parameters are encoded into the PSO as particles with each particle representing a candidate KAN configuration consisting a set of univariate functions assigned to KAN neurons, the function parameters and the weight of the output layer connections. Each particle is encoded as a vector consisting of the aforementioned KAN configurations as follows.
Pi=?1, θ1, ?2, θ2, …., W 11
Here, ?i represents the selected functions, θi denotes their corresponding parameters, and W is the weight vector. Each particle is assessed by assigning its parameters to the KAN and training the model using backpropagation. The classification accuracy on a validation set is used as the fitness function to evaluate performance. The fitness function F is given as follows
FPi=Correct PredictionsTotal Predictions 12
Where a higher accuracy indicates a more optimal selection of parameters
After evaluating the fitness of the particles, Particles adjust their velocity and position by considering both their individual best solutions and the global best solution found within the swarm. The particle velocity and position update is controlled by equation 3 and 4. The PSO optimizes both the selection of the function ?(x) and its associated parameters θ. For example, if a neuron in the KAN model uses a polynomial function, PSO adjust the parameters a, b, c of the polynomial function. This process is iterative, with PSO continuously refining the function parameters until an optimal set is achieved. Once PSO converges to the optimal parameter set Gbest, the refined KAN undergoes full training using backpropagation. The trained PSO-KAN model is then evaluated on unseen WSN traffic data to assess its performance.
IV. Experiment and Results
The experiment was carried out on a system featuring an Intel(R) Core (TM) i5-1235U 1.30 GHz 13th Gen, 16GB RAM, and an Intel® Iris® X? Graphics to enhance deep learning computations. The software environment was configured using Python 3.11, incorporating essential libraries such as NumPy, SciPy, Scikit-learn, Matplotlib, TensorFlow, PyTorch, and the KAN library. The dataset, which contained 374,662 instances with 18 attributes, was partitioned into 80% for training and 20% for testing. All experiments were executed on Ubuntu 22.04 LTS, and model tuning was performed using Particle Swarm Optimization (PSO) to adjust the parameters of the Kolmogorov-Arnold Network (KAN). The research process followed a systematic approach: (1) Preprocessing the dataset by normalizing feature values and encoding categorical labels, (2) Initializing the KAN model with various univariate functions, (3) Employing PSO to identify the optimal univariate function and its parameters, (4) Training and validating the KAN model optimized through PSO, and (5) Assessing performance using accuracy, precision, recall, F1-score, and confusion matrices. The obtained results were compared against conventional Neural Networks (NN), CNNs, LSTMs, and hybrid CNN-LSTM architectures to evaluate the effectiveness of PSO-KAN in detecting DDoS attacks in Wireless Sensor Networks (WSN).
Table 3 Parameter settings for PSO-KAN
|
Parameter |
Value(s) |
|
Number of particles (N) |
30 |
|
Maximum iteration (T) |
100 |
|
Inertia Weight (w) |
Adaptive (0.4 – 0.9) |
|
Cognitive Coefficient (c1?) |
1.5 |
|
Social Coefficient (c2?) |
1.5 |
|
Input Dimension (d) |
16 features |
|
Output Dimension (m) |
5 classes |
|
Number of Hidden layers |
5 |
Table 3 shows the parameter settings for the proposed PSO-KAN and the corresponding value of each parameter.
Table 4 Univariate functions and their performance
|
Univariate function |
Mathematical representation |
Parameters optimized by PSO |
Accuracy (%) |
|
Polynomial function |
?x=ax2+ bx+c |
a, b, c |
93.7 |
|
Sigmoid function |
?x=11+ e-αx |
α |
95.4 |
|
Hyperbolic tangent (tanh) |
?x=tanh?(βx) |
β |
94.2 |
|
Gaussian function |
?x=e-γ(x-μ)2 |
γ,µ |
96.5 |
|
Sinusoidal function |
?x=Asin(Bx+C) |
A, B, C |
91.9 |
|
ReLu (Rectified Linear Unit) |
?x=max?(0, x) |
None |
92.8 |
|
Softplus function |
?x=log?(1+ ex) |
None |
93.5 |
|
Logarithmic function |
?x=log?(x+ δ) |
δ |
90.3 |
|
Exponential function |
?x=eλx |
λ |
95.6 |
|
Piecewise Linear Function |
?x=aix+ bi |
ai,bi |
97.3 |
Table 4 outlines the univariate functions utilized in the PSO-KAN framework for detecting DDoS attacks in Wireless Sensor Networks (WSNs), detailing their mathematical formulations, PSO-optimized parameters, and corresponding maximum accuracy. Among these, the Piecewise Linear function achieves the highest accuracy of 97.53%, offering a straightforward yet effective transformation of input features, making it highly suitable for network traffic classification. The Polynomial function, incorporating second-degree terms, attains 96.84% accuracy, providing greater flexibility but showing a slight tendency toward overfitting. Meanwhile, the Sigmoid function, often used in activation functions, records 96.27% accuracy, efficiently capturing nonlinear relationships, though it may encounter vanishing gradient challenges. The Gaussian function, with an accuracy of 95.92%, proves useful for detecting traffic anomalies but requires careful parameter tuning. The Fourier Series function, which models periodic patterns in network traffic, achieves 95.58% accuracy, making it effective for capturing cyclic trends in WSN data, though it comes with high computational costs. The PSO algorithm fine-tunes each function’s parameters, such as transformation factors and coefficients, to optimize classification performance. By combining KAN’s hierarchical structure with PSO-driven optimization, the model ensures robust feature transformation, adaptability, and high precision in detecting DDoS attacks, all while maintaining computational efficiency for real-world WSN applications.
Figure 3 Convergence curve for different univariate functions
Figure 3 illustrates a convergence curve that compares the accuracy of various univariate functions over multiple iterations within the PSO-KAN (Particle Swarm Optimization - Knowledge-Augmented Network) framework. The x-axis represents the number of iterations, while the y-axis shows accuracy as a percentage. Each curve corresponds to a specific univariate function, including Polynomial, Sigmoid, Tanh, Gaussian, Sinusoidal, ReLU, Softplus, Logarithmic, Exponential, and Piecewise Linear. The graph highlights how different functions influence the learning process, with some reaching higher accuracy levels more quickly than others. From the visualization, the piecewise linear and gaussian functions demonstrate the best performance, approaching near-perfect accuracy as the number of iterations increases, proving their effectiveness in this scenario. Other functions, such as exponential and sigmoid, also achieve high accuracy, exceeding 96%. In contrast, functions like Logarithmic and sinusoidal exhibit slower convergence and lower final accuracy. The overall trend reveals that most functions experience a rapid accuracy boost in the initial iterations, followed by a gradual improvement until they reach a performance plateau. This analysis is crucial in identifying the most suitable activation function for optimizing PSO-KAN’s performance.
Figure 4 Accuracy comparison of univariate functions in PSO-KAN
The figure displays a bar chart comparing the accuracy of various univariate functions within the PSO-KAN (Particle Swarm Optimization - Knowledge-Augmented Network) framework. The x-axis represents different univariate functions, while the y-axis shows their corresponding accuracy in percentage. Each bar is distinctly color-coded and labeled with its exact accuracy value, allowing for a clear performance comparison across functions. The chart visually highlights the differences in accuracy achieved by each function. According to the chart, the Piecewise Linear function attains the highest accuracy at 97.3%, followed by the Gaussian function at 96.5% and the Exponential function at 95.6%. The Sigmoid and Tanh functions also demonstrate strong performance, with accuracy levels of 95.4% and 94.2%, respectively. In contrast, the Logarithmic function records the lowest accuracy at 90.3%, suggesting weaker effectiveness in this context. These findings indicate that different activation functions influence model accuracy differently, with Piecewise Linear and Gaussian functions emerging as the most effective in enhancing the PSO-KAN framework’s performance.
Table 5 Classification report for PSO-KAN
|
Attack Type |
Precision |
Recall |
F1-Score |
|
Normal |
0.987 |
0.985 |
0.986 |
|
Flooding |
0.972 |
0.975 |
0.974 |
|
TDMA |
0.960 |
0.958 |
0.959 |
|
Grayhole |
0.970 |
0.968 |
0.969 |
|
Blackhole |
0.978 |
0.980 |
0.979 |
|
Overall Accuracy |
0.975 |
- |
- |
Table 5 showcases the model’s classification performance in detecting various network attack types, evaluated using Precision, Recall, and F1-Score. Attack categories such as Normal, Flooding, TDMA, Grayhole, and Blackhole are analyzed to assess the model’s ability to correctly classify instances. Precision quantifies the proportion of correctly predicted positive cases among all predicted positives, while Recall measures the percentage of actual positive instances accurately identified. The F1-Score, which is the harmonic mean of Precision and Recall, offers a comprehensive evaluation of the model’s effectiveness. The overall accuracy is reported as 0.975, indicating that 97.5% of all classifications were correct. Among the different attack types, the Normal class achieves the highest Precision (0.987), signifying minimal false positives, while Blackhole attacks exhibit the highest Recall (0.980), meaning most actual Blackhole instances are correctly detected. The F1-Scores for all categories remain consistently high, with values nearing or exceeding 0.96, demonstrating strong overall classification performance. The lowest-performing category, TDMA, has an F1-Score of 0.959, still reflecting reliable detection accuracy. These findings indicate that the model is highly effective in identifying diverse network attack types, making it a strong candidate for network security threat detection.
Table 6 Performance comparison of PSO-KAN with State-of-the-art methods
|
Model |
Optimization Used |
Accuracy (%) |
|
PSO-KAN (Optimized) |
PSO for KAN parameter tuning |
97.5 |
|
Traditional Neural Network (NN) |
Backpropagation |
91.2 |
|
Convolutional Neural Network (CNN) |
Adam, SGD |
94.5 |
|
Long Short-Term Memory (LSTM) |
RMSprop, Adam |
95.1 |
|
Hybrid CNN-LSTM |
Adam, SGD |
96.3 |
|
PSO-Optimized Neural Network (PSO-NN) |
PSO for weight optimization |
96.7 |
Table 6 provides a comparison of various machine learning models for network attack detection, evaluating them based on their optimization techniques and accuracy percentages. The Model column includes different architectures such as PSO-KAN (Optimized), Traditional Neural Network (NN), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Hybrid CNN-LSTM, and PSO-Optimized Neural Network (PSO-NN). The "Optimization Used" column specifies the optimization method applied to each model, including Particle Swarm Optimization (PSO), Backpropagation, Adam, SGD, and RMSprop. The Accuracy (%) column reflects the classification effectiveness of each model in detecting network attacks. Among the models, the PSO-KAN (Optimized) achieves the highest accuracy at 97.5%, utilizing PSO to fine-tune Knowledge-Augmented Network (KAN) parameters, which enhances learning efficiency. In contrast, the Traditional NN, which employs backpropagation, has the lowest accuracy at 91.2%, suggesting that conventional training techniques may not be as effective for this task. The CNN, LSTM, and Hybrid CNN-LSTM models demonstrate increasing accuracy levels of 94.5%, 95.1%, and 96.3%, respectively, highlighting the advantages of deep learning architectures. The PSO-Optimized Neural Network (PSO-NN) achieves 96.7%, indicating that PSO-based weight optimization significantly improves model performance. Overall, the results emphasize the effectiveness of PSO-driven optimization in enhancing neural network models for network security applications.
CONCLUSION
This paper introduces an innovative method for detecting and classifying DDoS attacks in wireless sensor networks by integrating Particle Swarm Optimization (PSO) with the Kolmogorov-Arnold Network (KAN). The proposed model enhances KAN’s capability to optimize univariate functions and parameters by treating each particle in the swarm as a candidate solution representing a specific set of KAN parameters. Initially, PSO generates a population of particles with randomly assigned parameters, including weights and coefficients for univariate functions. The effectiveness of each particle is evaluated by training KAN on the dataset and measuring its classification accuracy. Through iterative updates, particles adjust their positions based on both their individual best performance and the globally optimal solution, following predefined velocity and position update rules. The combination of Particle Swarm Optimization (PSO) and the Kolmogorov-Arnold Network (KAN) has proven highly effective in detecting DDoS attacks within Wireless Sensor Networks (WSNs). PSO enhances KAN by optimizing its univariate functions and parameters, resulting in improved feature transformation and model adaptability. This leads to a more interpretable and resilient system for recognizing attack patterns. Experimental evaluation using a dataset containing 16 features and five attack types indicates that PSO-optimized KAN surpasses conventional machine learning and deep learning models, such as Neural Networks (NN), CNNs, LSTMs, and hybrid approaches. Achieving a peak accuracy of 97.53%, PSO-KAN offers a powerful defense mechanism against emerging cyber threats in WSNs. The primary strength of PSO-KAN is its adaptability and computational efficiency. Unlike traditional deep learning models that demand extensive hyperparameter tuning and large datasets, KAN’s hierarchical framework allows it to capture meaningful feature representations with reduced computational effort. By leveraging PSO for optimizing univariate functions, the model autonomously determines the most effective transformations for traffic data, enhancing attack classification accuracy while reducing false positives. Furthermore, PSO’s global search ability helps the model avoid local optima, resulting in a more stable and generalized approach for detecting DDoS attacks across diverse network settings. Although PSO-KAN demonstrates high accuracy and adaptability, it has some limitations that require further exploration. A major concern is its computational complexity, as the combination of KAN’s hierarchical transformations and PSO’s iterative optimization can result in longer processing times, particularly when dealing with large-scale WSN datasets.
REFERENCE
Fatima Shitu, Idris Yau Idris, Rumana Kabir Aminu, Ogochukwu John Okonko, Umar Kabir Umar*, Maryam Alka, PSO_KAN: A Hybrid Particle Swarm Optimization and Kolmogorov Arnold Network for Detection DDoS Attacks in Wireless Sensor Networks, Int. J. Sci. R. Tech., 2025, 2 (11), 462-476. https://doi.org/10.5281/zenodo.17637354
10.5281/zenodo.17637354