Hybrid Deep Learning Model Detects Intrusions in Wireless Sensor Networks

Wireless sensor networks have become indispensable for collecting environmental data in applications ranging from military surveillance and smart cities to healthcare, but their sensor nodes are cheap, battery-powered devices with limited storage that can be easily hijacked by attackers. A new study published in Discover Computing on 30 October 2026 proposes a framework called Deep Q-based Siamese Convolutional Network, or DQSC-Net, designed to identify intrusions in these networks. The work, authored by M. Lizzy Nesa Bagyam and S. Maheswari, reports strong detection figures on a widely used benchmark: a true positive rate of 94.675 percent, a true negative rate of 90.766 percent, accuracy of 92.877 percent, precision of 91.778 percent, an F1-score of 93.204 percent, and balanced accuracy of 92.721 percent, alongside a false alarm rate of 9.234 percent and a false negative rate of 5.325 percent.

The framework is built as a pipeline rather than a single classifier. It begins with a simulation of the wireless sensor network, in which a hybrid optimization algorithm called the Kookaburra Crayfish Optimization Algorithm selects the cluster heads. This algorithm merges the Kookaburra Optimization Algorithm, which mimics the natural hunting behaviors of kookaburras, with the Crayfish Optimization Algorithm, which models crayfish foraging and escape behavior. The fitness function used for cluster head selection weighs residual energy, intra-cluster and inter-cluster distances, and delay, and the node achieving the maximal fitness is deemed ideal. According to the authors, combining the two metaheuristics balances exploration and exploitation better than classical approaches such as particle swarm optimization, differential evolution, or genetic algorithms, which can converge prematurely or become trapped in local optima.

Routing in the framework is secured with blockchain technology. The system operates on two coupled networks: a blockchain network and a routing network. Routing nodes register themselves on the chain, and the next hop is chosen through a Markov decision process routing policy that draws on blockchain-maintained routing information, including timestamps and packet counts reaching subsequent nodes. A fractional variant of the optimization algorithm, FKCO, which blends fractional calculus with the Kookaburra Crayfish Optimization Algorithm, determines the next hop based on distance, link reliability, delay, and energy prediction. The blockchain configuration uses a permissioned Proof of Authority design in which cluster heads act as validators, sensor nodes generate and forward transactions recording source, cluster head, next hop, destination, and timestamp, and the sink performs final verification with SHA-256 hashing to preserve record integrity.

The intrusion detection stage itself runs at the base station and follows a defined sequence. Input log data, including IP addresses and log details, first passes through linear normalization, also known as min-max normalization, which rescales every feature uniformly to a consistent range. Information gain then selects the most influential features by measuring the entropy reduction each attribute provides, filtering out irrelevant information before classification. Only after these preprocessing steps does the proposed DQSC-Net, an integration of a Deep Q-Network with a Siamese convolutional neural network, carry out the actual detection of attack versus normal traffic.

The architectural combination is the study’s central technical claim. The Deep Q-Network is a form of reinforcement learning that uses a deep neural network to estimate Q-values for decision-making tasks, allowing Q-value calculation and feature extraction to be learned concurrently in an end-to-end optimization. Because tabular Q-learning becomes inefficient for large, continuous problems, the method approximates the action-value function with trainable parameters and employs two networks, an online network and a target network, to stabilize learning. The Siamese convolutional network, in turn, consists of twin networks that process different inputs and are combined through an energy function that scores the similarity between high-level feature representations. The authors argue that this focus on equality among learned features, rather than raw data, makes the model robust to the highly variable behavior of network traffic and capable of uncovering subtle intrusions that would otherwise remain unseen.

In the full DQSC-Net, the normalized data feeds the Deep Q-Network, whose output and the selected features converge in an intermediate fusion layer that uses fractional calculus to perform regression modelling, merging inputs at different time intervals. The fused result then passes to the Siamese network, whose twin branches receive the two learned representations and produce a single sigmoid output through an induced distance metric between the twins. Convolutional filters are set in multiples of 16, with rectified linear unit activation followed by max pooling at each stage. The authors state that this unified design, which integrates feature extraction, decision-making, and similarity learning in one framework tailored to wireless sensor network intrusion detection, distinguishes their approach from prior methods that used these models individually.

Evaluation was performed on the publicly available BoT-IoT dataset, which contains 2,934,817 samples described by 43 features and exhibits a severe class imbalance: the distributed denial of service class holds 1,541,315 samples, denial of service holds 1,320,148, reconnaissance holds 72,919, theft holds only 370, and the normal class holds just 65. The authors are explicit that the dataset records were not collected from their simulated network; the simulation evaluates the secure routing process, while BoT-IoT provides realistic traffic instances for training and testing the detection model at the base station. The framework performs binary classification, labeling instances as normal or attack, under training-testing splits of 90-10, 80-20, 70-30, and 60-40. Experiments ran in Python 3.9.11 on a Windows 10 machine with 8 GB of RAM, a 1.7 GHz CPU, and GPU support.

Performance varied systematically with model depth and validation scheme. Using 90 percent training data, true positive rates rose from 88.876 percent with two convolutional stages to 93.899 percent with eight; accuracy under 70 percent training data climbed from 83.987 percent to 88.877 percent across the same range. Under K-fold validation, the model reached a true positive rate of 91.877 percent at K-fold 5 with eight layers, a true negative rate of 90.766 percent at K-fold 8, and accuracy of 90.768 percent at K-fold 6. Against comparison methods including CCGAN-EOSA-CHS-BC, DL-RMCV, BCR-TM-JSO, Swin Transformers with LSTM, CNN-LSTM, and a dual-attention CNN-GCN-BiLSTM, DQSC-Net posted the best figures on every reported metric, with an ablation study showing that removing feature selection, normalization, or either network component reduced accuracy. The full model also required the least computation, at 25.998 seconds and 15.700 MB of memory, roughly 60.61 percent less time and 52.02 percent less memory than the slowest comparison method.

The authors also report statistical support for the improvements. A two-tailed paired t-test over eight fold-wise results from 8-fold cross-validation, conducted at a 95 percent confidence level with a fixed random seed of 42, yielded p-values below 0.05 for accuracy, true positive rate, true negative rate, precision, F1-score, and balanced accuracy, and a one-way ANOVA produced an F-statistic of 12.9999 with a p-value of 0.000091. A 95 percent confidence interval for DQSC-Net accuracy spanned 88.20 to 94.46, and precision-recall and ROC analyses gave the model the highest area under the curve among the compared methods, at 0.91 and 0.93 respectively. A confusion matrix over 4,376 instances showed 2,090 of 2,275 attack instances correctly detected and 1,931 of 2,101 normal instances correctly recognized, for an accuracy of approximately 91.884 percent. Under simulated real-world stresses, including a 20 percent node failure rate, networks of 400 nodes, and varying sink positions, the model retained the highest accuracy among the tested approaches.

The study’s limitations deserve clear framing. The detection results derive from a benchmark dataset of simulated and legitimate IoT traffic rather than from live attacks on the simulated sensor network, and the extreme imbalance of the BoT-IoT dataset, particularly the tiny normal and theft classes, makes minority-class detection genuinely difficult and means headline metrics are dominated by the large denial-of-service categories. The blockchain routing layer adds storage and communication overheads that the authors note were considered in simulation. Nevertheless, the reported combination of energy-aware cluster head selection, blockchain-secured routing, and a reinforcement-learning-plus-Siamese classifier offers a coherent template for defending resource-constrained sensor deployments, and the authors indicate that future work will apply progressive optimization strategies to train the deep learning system and further raise its detection effectiveness.

Subject of Research: A hybrid deep learning framework for intrusion detection in wireless sensor networks

Article Title: Deep Q Siamese convolutional network for intrusion detection in WSN

Article References: Bagyam, M. L. N., & Maheswari, S. (2026). Deep Q Siamese convolutional network for intrusion detection in WSN. Discover Computing, 29(1), Article 825. https://doi.org/10.1007/s10791-026-10752-3

Image Credits: AI Generated

DOI: 10.1007/s10791-026-10752-3

Keywords: wireless sensor networks, intrusion detection, deep Q-network, Siamese neural network, blockchain routing, BoT-IoT dataset, optimization algorithms, cybersecurity, machine learning, cluster head selection, Deep, Siamese