Écrire un commentaire

Overall assessment

The manuscript proposes an LSTM–Lotka–Volterra intrusion detection framework and reports very high performance: 99.85% accuracy, 99.44% precision, 99.68% recall, and 99.56% F1-score.

The concept is potentially interesting, but the current manuscript does not provide sufficient methodological detail to establish that these results reflect genuine generalization rather than favorable preprocessing, data splitting, or model-selection choices. Several central claims are also stronger than the experiments actually demonstrate.

Major concerns

1. The data-splitting protocol is insufficiently specified.

The manuscript reports only a 60/20/20 train/validation/test split. It does not state whether the split is random, chronological, session-based, device-based, file-based, or attack-based.

This is a major issue for intrusion-detection data because temporally adjacent or closely related network flows may be highly correlated. If such samples appear in both training and test partitions, performance can be substantially overestimated. The reported 99.85% accuracy therefore cannot be properly interpreted without an explicit leakage-resistant splitting protocol.

2. The temporal input construction is not reproducible.

The authors state that the data are converted into time-series sequences for the LSTM, but they do not report sequence length, stride, window overlap, temporal ordering, or whether sequences may cross attack/session boundaries.

These details are fundamental for an LSTM-based IDS and can materially affect the reported performance.

3. The central LSTM–Lotka–Volterra connection is not defined.

The manuscript states that the LSTM hidden state is transformed into two states interpreted as normal traffic and anomalous traffic intensity. However, the transformation is not specified.

The paper does not explain the architecture of this mapping, its activation function, how it is trained, whether the states are constrained, or how the LV state is propagated over time. Because this is the central mechanism connecting the neural network to the dynamical model, its omission prevents independent reproduction of the proposed method.

4. The Lotka–Volterra component is not sufficiently justified.

The authors assign physical interpretations to the LV parameters, such as attack propagation and mitigation, and select one configuration empirically.

However, no parameter-estimation procedure, stability analysis, sensitivity analysis, or robustness study is presented. Therefore, the manuscript does not demonstrate that these parameters correspond to measurable network processes or that the selected configuration is stable across different operating conditions.

5. The feature-selection procedure is unclear.

The manuscript states that the dataset contains more than 80 features and that relevant features are selected, but it does not provide the feature-selection algorithm or the final feature set.

At the same time, the model input is described using only a small set of variables such as packet rate, bandwidth, number of devices, latency, and error rate.

The relationship between the original dataset and these selected inputs is therefore not sufficiently documented.

6. The claim of generalization to unseen attacks is not supported by the experiments.

The manuscript explicitly claims “better generalization to unseen attacks.”

However, no leave-one-attack-out, zero-day, cross-dataset, or attack-family holdout experiment is presented. A standard held-out test split does not demonstrate performance on genuinely unseen attack types. This claim should therefore be removed or supported with an appropriate experimental protocol.

7. The task is described inconsistently as both multiclass and binary.

The paper states that the system classifies different attack types and emphasizes the multi-class nature of the dataset.

However, the actual decision mechanism distinguishes only between normal and attack traffic.

The reported experiment therefore appears to be binary classification. The manuscript should not imply that fine-grained attack-type classification has been demonstrated unless multiclass results are provided.

8. The baseline comparison is not sufficiently controlled.

The proposed method is compared against LSTM, CNN–LSTM, and Autoencoder baselines.

However, the manuscript does not provide enough information about the baseline architectures, parameter counts, optimization procedures, regularization, or hyperparameter tuning. It is therefore unclear whether the comparison is strictly fair.

The ablation study is useful, but it only shows that the full hybrid configuration performs better than LSTM-only and LV-only variants under the authors' setup. It does not establish that the improvement is specifically due to Lotka–Volterra dynamics rather than to the addition of another nonlinear post-processing stage.

9. No statistical uncertainty is reported.

All performance results are presented as single values. There are no repeated runs, confidence intervals, standard deviations, or statistical significance tests.

For a neural-network experiment, this is insufficient to determine whether the reported improvement is stable across different initializations and data shuffles.

10. The efficiency claim is overstated.

The manuscript reports 47 ms detection time for HLV-AI, compared with 45 ms for LSTM and 40 ms for the Autoencoder.

Therefore, the proposed method is not the fastest model tested. Moreover, the manuscript itself states that its overall asymptotic complexity remains dominated by the LSTM.

The claim of a “reduced-complexity algorithm” in the abstract is therefore not demonstrated by the presented evidence.

11. The latency measurement is not reproducible.

The implementation section states only that TensorFlow/Keras and a GPU were used.

The GPU model, CPU, RAM, software versions, timing protocol, number of repetitions, and inference batch size are not reported. Consequently, the 47 ms result cannot be independently reproduced or meaningfully used to support claims about deployment on resource-constrained IoT devices.

12. Some claims exceed the evidence presented.

The paper describes the system as adaptive, robust, interpretable, and suitable for real-world IoT deployment. However:

• no online adaptive-threshold mechanism is actually demonstrated;

• no robustness experiment is presented;

• no interpretability analysis is performed;

• no deployment on edge or IoT hardware is reported.

The conclusion should distinguish clearly between demonstrated results and proposed future capabilities.

Additional issue

The related-work discussion appears internally inconsistent. Reference [25] is discussed as a malware-defense application of Lotka–Volterra dynamics, while the bibliography identifies it as a mathematical study of a discrete-time two-predators one-prey Lotka–Volterra model.

This citation should be checked and corrected if necessary.

Recommendation

Major revision.

The manuscript is not methodologically mature enough in its present form to support its main performance and generalization claims. The reported 99.85% accuracy is particularly difficult to assess because the data-splitting procedure, temporal sequence construction, feature-selection pipeline, and LSTM–Lotka–Volterra coupling are insufficiently specified.

The authors should explicitly rule out information leakage, provide a reproducible description of the complete preprocessing and modeling pipeline, justify the Lotka–Volterra parameterization, and report repeated-run statistics with uncertainty estimates. Claims regarding unseen attacks, robustness, interpretability, adaptivity, and computational efficiency also require direct experimental evidence rather than qualitative assertions.

Until these issues are addressed, the reported performance should not be considered convincing evidence of superior intrusion-detection capability. At present, the manuscript demonstrates a promising concept, but not yet a sufficiently validated or reproducible method.

Competing interests

The authors declare that they have no competing interests.

Use of Artificial Intelligence (AI)

The authors declare that they did not use generative AI to come up with new ideas for their review.