Dear Dr. Ukwandu,

Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process.

Please submit your revised manuscript by Apr 26 2025 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org . When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.

• A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'.
• A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'.
• An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'.

If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter.

If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols . Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols .

We look forward to receiving your revised manuscript.

Kind regards,

Taimur Bakhshi

Academic Editor

PLOS ONE

Journal Requirements:

When submitting your revision, we need you to address these additional requirements.

1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at 

https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and 

https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf

2. We noticed you have some minor occurrence of overlapping text with the following previous publication(s), which needs to be addressed:

Journal of Fuzzy Systems and Control, Vol. 2, No 3, 2024 ISSN: 2986-6537, DOI: 10.59247/jfsc.v2i3.267

https://unidel.edu.ng/cms/uploads/publications/unidel_pub_1733046009.pdf?

In your revision ensure you cite all your sources (including your own works), and quote or rephrase any duplicated text outside the methods section. Further consideration is dependent on these concerns being addressed.

3. Please note that PLOS ONE has specific guidelines on code sharing for submissions in which author-generated code underpins the findings in the manuscript. In these cases, we expect all author-generated code to be made available without restrictions upon publication of the work. Please review our guidelines at https://journals.plos.org/plosone/s/materials-and-software-sharing#loc-sharing-code and ensure that your code is shared in a way that follows best practice and facilitates reproducibility and reuse.

Additional Editor Comments:

Please revise and resubmit the manuscript according to reviewers' comments. Thank you.

[Note: HTML markup is below. Please do not edit.]

Reviewers' comments:

Reviewer's Responses to Questions

Comments to the Author

1. Is the manuscript technically sound, and do the data support the conclusions?

Reviewer #1: Partly

Reviewer #2: Yes

Reviewer #3: Partly

**********

2. Has the statistical analysis been performed appropriately and rigorously? -->?>

Reviewer #1: Yes

Reviewer #2: Yes

Reviewer #3: Yes

**********

3. Have the authors made all data underlying the findings in their manuscript fully available??>

The PLOS Data policy

Reviewer #1: Yes

Reviewer #2: Yes

Reviewer #3: Yes

**********

4. Is the manuscript presented in an intelligible fashion and written in standard English??>

Reviewer #1: Yes

Reviewer #2: Yes

Reviewer #3: No

**********

Reviewer #1: - Abstract: The abstract should succinctly summarize the objectives, methods, key results, and conclusions of the study. Ensure it clearly outlines the significance of the research.

- Introduction: Strengthen the framing of the research question. Provide a more comprehensive literature review to justify the study's necessity, outlining gaps that the research addresses.

- Study Design: Clearly define the study design. When applicable, include controls and randomization methods to enhance the reliability of the findings.

- Sample Size: Justification of the sample size through power analysis should be included to demonstrate the adequacy of the study to detect statistically significant differences.

- Data Collection: Describe in detail how data were collected, including any instruments or questionnaires used, and their validation processes. This allows for replication and verification of the results.

- Statistical Methods: Clearly outline the statistical methods used for data analysis, including assumptions, and provide a rationale for choosing those methods. If applicable, ensure that results are presented with appropriate confidence intervals and p-values.

- Results Presentation: The results section should be structured clearly, often using tables and figures for better readability. Each visual should include a descriptive caption and must be referenced in the text.

- Interpretation of Findings: Contextualize findings with respect to existing literature. Address any contradictions with previous studies and provide explanations.

- Limitations: Explicitly acknowledge potential limitations of the study. Discuss how these limitations might affect the interpretation of results.

- Ensure the conclusion succinctly returns to the significance of the findings and offers clear recommendations for practitioners and suggestions for future research.

- All cited works should be current and relevant. Ensure that the referencing format is consistent with the journal’s guidelines, which can be crucial for publication.

- Ensure that all figures and tables are of high quality and have appropriate legends. This visual data must complement the textual descriptions and provide clarity.

While the manuscript outlines a technically sound approach utilizing transfer learning for DDoS detection and presents data supporting its findings, a full assessment would require more detailed information about the experimental controls, replication, and sample sizes used. The mention of using well-established classifiers and the dataset of 314,102 instances indicates a rigorous framework, but specifics on those experimental aspects would clarify the robustness of the conclusions drawn.

The manuscript mentions utilizing methods such as SMOTE-Tomek for data balancing and highlights performance metrics like accuracy and F1-score for evaluation. However, without more detailed information regarding the specific statistical methods used, their assumptions, controls, and thoroughness of the analysis, it is difficult to fully ascertain the rigor of the statistical analysis. Additional clarity on these points would provide a better evaluation of the appropriateness of the statistical analysis performed.

Reviewer #2: This manuscript falls within the scope of the journal but several comments and suggestions that the manuscript should address:

1. Clearly articulate the novel contributions of the proposed ensemble compared to existing DDoS detection approaches, especially the role of transfer learning with a boosted meta-learner.

2. Expand the related work section to include a deeper comparison with alternative methods for SIP-VoIP DDoS detection and highlight how this approach advances the state‐of‐the‐art.

3. Provide more details about the dataset, including its limitations, distribution of classes, and any potential biases introduced during data collection or preprocessing.

4. Clarify the rationale behind choosing the specific base classifiers (BiLSTM, BiGRU, and Random Forest) and explain how their complementary strengths improve overall detection performance.

5. Describe in detail the hyperparameter tuning process (e.g., grid search, cross-validation) for all components, including the ensemble’s meta-learner.

6. Address concerns of potential overfitting given the near-perfect performance metrics; consider incorporating additional validation methods or independent test datasets.

7. Discuss the impact of the SMOTE-Tomek balancing technique compared with other data augmentation methods and justify its selection..

Reviewer #3: Review of the Paper: "Adaptive DDoS Detection Mode in Software-Defined SIP-VoIP Using Transfer Learning with Boosted Meta-Learner"

The paper proposes a transfer learning-based DDoS detection model for SIP-VoIP using BiGRU, BiLSTM, Random Forest, and XGBoost. While the topic is relevant and the approach promising, several areas require major revision to enhance clarity, justification, and practical applicability.

Key Revisions Needed:

• Classifier Justification: Explain why BiGRU, BiLSTM, and Random Forest were chosen over other models. Compare with alternative deep learning classifiers.

• Dataset & Preprocessing: Provide details on feature selection, normalization, and handling of class imbalance. Clarify preprocessing steps.

• Related Work: Expand comparison with existing SIP-VoIP DDoS detection models and highlight novelty.

• Results & Explainability: Discuss false positives, false negatives, and model interpretability. Include confusion matrices, ROC curves, or SHAP analysis to strengthen insights.

• Abstract & Conclusion: Add specific performance metrics and emphasize practical implications. Ensure clear takeaways.

• Practical Deployment: Address real-time implementation, IDS integration, and robustness against adversarial attacks.

• Grammar & Readability: Improve structure, clarify research gaps, and refine writing for better comprehension.

Recommendation: Major Revision

The paper presents a strong concept but requires significant improvements in methodology, dataset details, result interpretation, and writing clarity before it can be considered for publication.

**********

what does this mean? ). If published, this will include your full peer review and any attached files.

If you choose “no”, your identity will remain anonymous but your review may still be made public.

Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our Privacy Policy

Reviewer #1: No

Reviewer #2: No

Reviewer #3: No

**********

[NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.]

While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/ . PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org . Please note that Supporting Information files do not need this step.

Attachments

Attachment

Submitted filename: review.docx

PLOS ONE

Dear Dr. Ukwandu,

Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process.

Please update the manuscript according to reviewer's comments and have this re-submitted. Thank you.

Please submit your revised manuscript by Jun 29 2025 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org . When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.

• A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'.
• A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'.
• An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'.

If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols . Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols .

We look forward to receiving your revised manuscript.

Kind regards,

Dr. Taimur Bakhshi

Academic Editor

PLOS ONE

Journal Requirements:

Please review your reference list to ensure that it is complete and correct. If you have cited papers that have been retracted, please include the rationale for doing so in the manuscript text, or remove these references and replace them with relevant current references. Any changes to the reference list should be mentioned in the rebuttal letter that accompanies your revised manuscript. If you need to cite a retracted article, indicate the article’s retracted status in the References list and also include a citation and full reference for the retraction notice.

Additional Editor Comments:

You are requested to resubmit an updated manuscript, considering the reviewers comments on priority. Thank you.

[Note: HTML markup is below. Please do not edit.]

Reviewers' comments:

Reviewer's Responses to Questions

Comments to the Author

Reviewer #1: All comments have been addressed

Reviewer #2: All comments have been addressed, some additional items have been highlighted.

Reviewer #3: All comments have been addressed, some minor items have been highlighted.

**********

2. Is the manuscript technically sound, and do the data support the conclusions??>

Reviewer #1: Yes

Reviewer #2: (No Response)

Reviewer #3: Yes

**********

3. Has the statistical analysis been performed appropriately and rigorously? -->?>

Reviewer #1: Yes

Reviewer #2: (No Response)

Reviewer #3: Yes

**********

4. Have the authors made all data underlying the findings in their manuscript fully available??>

The PLOS Data policy

Reviewer #1: Yes

Reviewer #2: (No Response)

Reviewer #3: Yes

**********

5. Is the manuscript presented in an intelligible fashion and written in standard English??>

Reviewer #1: Yes

Reviewer #2: Yes

Reviewer #3: Yes

**********

Reviewer #1: - You need to provide a more thorough justification for choosing BiGRU, BiLSTM, and Random Forest over other potential models. Did you compare their performance with alternative deep learning classifiers? Including comparative analysis or reference results can strengthen your argument for your chosen classifiers.

- While you reference where preprocessing details can be found, you should explicitly state your feature selection criteria, normalization techniques, and methods for handling class imbalance directly in the main text. Make it easy for readers to understand each step without having to refer to other sections extensively.

- Expand upon the existing literature in the field of SIP-VoIP DDoS detection. Current citations seem limited. To clarify your contribution and novelty, you should discuss how your approach differs from or improves upon previous work.

- A deeper analysis of your results is required. Discuss the implications of any false positives and false negatives you encountered and how they affect the model's reliability. Including visual aids such as confusion matrices and ROC curves is essential here, along with a discussion on model interpretability and potential avenues for improvement.

- In the Abstract, be sure to include specific performance metrics such as accuracy, precision, recall, and F1-score of your models. In your conclusion, highlight the practical implications of your work and how it can be applied in real-world scenarios, ensuring clear takeaways for the reader.

- Address how your DDoS detection model can be implemented in real-time and integrated into existing IDS frameworks. Discuss its robustness against adversarial attacks more comprehensively. This section should convince readers of the feasibility of your approach in a practical setting.

- Focus on improving the overall structure and flow of the writing. Ensure technical jargon and terminology are clearly defined upon first use and maintain consistency throughout. This will aid comprehension for readers who may not be familiar with the subject matter.

- If you have visual data representation (e.g., graphs or tables), ensure they are properly labeled and referenced in the text. Each figure/table should have a clear legend or caption explaining what it represents.

Reviewer #2: The manuscript is under journal scope but need to some modifications should be addressed as follows:

1. Provide a detailed justification for selecting these classifiers, including a comparison with alternative deep learning or machine learning models. Highlight their strengths and relevance to the problem being addressed.

2. Describe the dataset in detail, including its size, source, and characteristics.

3. Include confusion matrices, ROC curves, precision-recall curves, or SHAP (SHapley Additive exPlanations) analysis to provide deeper insights into model performance.

4. Update the abstract to include key performance metrics (e.g., accuracy, F1-score, AUC-ROC).

5. Discuss the robustness of the system against adversarial attacks and propose strategies to enhance security.

6. Refine the language to ensure clarity and readability.

Reviewer #3: (No Response)

**********

what does this mean? ). If published, this will include your full peer review and any attached files.

If you choose “no”, your identity will remain anonymous but your review may still be made public.

Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our Privacy Policy

Reviewer #1: No

Reviewer #2: No

Reviewer #3: No

**********

[NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.]

While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/ . PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org

Adaptive DDoS Detection Mode in Software-Defined SIP-VoIP Using Transfer Learning with Boosted Meta-Learner

PONE-D-25-00389R2

Dear Authors

We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements.

Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication.

An invoice will be generated when your article is formally accepted. Please note, if your institution has a publishing partnership with PLOS and your article meets the relevant criteria, all or part of your publication costs will be covered. Please make sure your user information is up-to-date by logging into Editorial Manager at Editorial Manager®  and clicking the ‘Update My Information' link at the top of the page. If you have any questions relating to publication charges, please contact our Author Billing department directly at authorbilling@plos.org.

If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org.

Kind regards,

Dr. Taimur Bakhshi

Academic Editor

PLOS ONE

Additional Editor Comments (optional):

Thank you for addressing pervious comments, I am pleased to process this further.