Mohamed Nosseir Hemdan
Current Organizations / Institutes
The organizations/institutes from the scholar's latest article
Research Subjects
Mohamed Nosseir Hemdan has a total of 3 co-authors. Here are the top co-authors by number of shared publications:
- Ameer El-Sayed
Department of Information Technology, Faculty of Computers and Informatics, Zagazig University, Zagazig, Egypt
1 shared publication - Ehab R. Mohamed
Zagazig University
1 shared publication - Hanaa M. Hamza
Department of Information Technology, Faculty of Computers and Informatics, Zagazig University, Zagazig, Egypt
1 shared publication
Latest Publications
- Open Access
- 11 August 2026
- Published by Riset Publishing Services L.L.C. in Computer and Decision Making (COMDEM)
- Vol. 3, 1054-1076
PISMA: Programmable In-Switch Telemetry and Multi-Stage Adaptive Deep Learning for Threat Mitigation in SD-IoT
The convergence of Software-Defined Networking and the Internet of Things (SD-IoT) enhances network orchestration but exposes centralized controllers and application-layer services to sophisticated, multi-stage cyber threats such as structural web injections and stealthy application-layer floods. This study aims to develop and validate the PISMA framework, an integrated defense mechanism designed to bridge programmable data planes with intelligence-driven control layers to achieve real-time, accurate threat detection and precision mitigation without causing collateral service disruptions. The framework incorporates P4-programmable in-switch feature extraction, sliding-window behavioral aggregation, a hybrid deep learning classification engine combining convolutional representations with bidirectional recurrent neural networks, and confidence-aware policy orchestration. Comprehensive experimental evaluations were conducted across a hybrid emulation testbed using five benchmark security datasets (CICIoT2023, ToN_IoT, IoT-ID20, UNSW-NB15, and Edge-IIoTset) to assess classification performance, error rates, and operational response times. Across the benchmark evaluations, PISMA consistently outperformed alternative ensemble baselines, achieving a peak binary classification accuracy of 98.75%, an F1-score of 98.59%, a Matthews Correlation Coefficient of 0.97, and an Area Under Curve of 0.99, while keeping false positive and false negative rates below 1.5%. Furthermore, multi-class categorizations for SQL injection, cross-site scripting, command injection, and HTTP floods maintained recognition rates exceeding 96.8% with an ultra-low total mitigation response time averaging 1.12 milliseconds. The findings demonstrate that combining programmable data-plane telemetry with hybrid deep learning and confidence-aware policy enforcement successfully neutralizes application-layer intrusions, eliminates centralized processing bottlenecks, and preserves high service continuity in resource-constrained IoT networks.
- 11 August 2026
- Published by Riset Publishing Services L.L.C. in Computer and Decision Making (COMDEM)
- Vol. 3, 1054-1076
Open AccessPISMA: Programmable In-Switch Telemetry and Multi-Stage Adaptive Deep Learning for Threat Mitigation in SD-IoT
The convergence of Software-Defined Networking and the Internet of Things (SD-IoT) enhances network orchestration but exposes centralized controllers and application-layer services to sophisticated, multi-stage cyber threats such as structural web injections and stealthy application-layer floods. This study aims to develop and validate the PISMA framework, an integrated defense mechanism designed to bridge programmable data planes with intelligence-driven control layers to achieve real-time, accurate threat detection and precision mitigation without causing collateral service disruptions. The framework incorporates P4-programmable in-switch feature extraction, sliding-window behavioral aggregation, a hybrid deep learning classification engine combining convolutional representations with bidirectional recurrent neural networks, and confidence-aware policy orchestration. Comprehensive experimental evaluations were conducted across a hybrid emulation testbed using five benchmark security datasets (CICIoT2023, ToN_IoT, IoT-ID20, UNSW-NB15, and Edge-IIoTset) to assess classification performance, error rates, and operational response times. Across the benchmark evaluations, PISMA consistently outperformed alternative ensemble baselines, achieving a peak binary classification accuracy of 98.75%, an F1-score of 98.59%, a Matthews Correlation Coefficient of 0.97, and an Area Under Curve of 0.99, while keeping false positive and false negative rates below 1.5%. Furthermore, multi-class categorizations for SQL injection, cross-site scripting, command injection, and HTTP floods maintained recognition rates exceeding 96.8% with an ultra-low total mitigation response time averaging 1.12 milliseconds. The findings demonstrate that combining programmable data-plane telemetry with hybrid deep learning and confidence-aware policy enforcement successfully neutralizes application-layer intrusions, eliminates centralized processing bottlenecks, and preserves high service continuity in resource-constrained IoT networks.