2026· Journal of Communications Software and Systems· Vol 22, pp. 551-560· 0 citations· 25 references
TL;DR
A deep learning-based approach for reliable DDoS attack detection and classification into distinct classes goes beyond the state-of-the-art binary classification approach by incorporating the multi-class classification at various levels that help to distinguish particular DDoS attack categories.
Abstract
—DDoS attacks continue to pose a severe problem in today’s computer security due to their ability to significantly impact the network’s functionality and deplete computing and communication resources. This paper proposes a deep learning-based approach for reliable DDoS attack detection and classification into distinct classes. The suggested framework goes beyond the state-of-the-art binary classification approach by incorporating the multi-class classification at various levels that help to distinguish particular DDoS attack categories. Three different deep learning models are examined. In the first model, the Multi-Layer Perceptron (MLP) is utilized to extract informative patterns from the flow-based network features. In the second model, the combination of one-dimensional convolutional layers with the Deep Neural Network (CNN1D-DNN) is employed to analyze local patterns and perform traffic classification. Finally, in the third model, the RNN-LSTM architecture is used to analyze the temporal dependencies of the traffic data. Experiments are performed on the CIC-DDoS-2019 dataset, which includes benign traffic and several types of DDoS attacks. The feature selection and balancing techniques are applied in order to minimize the impact of the redundant information and class imbalance problem. Evaluation results under the binary, 7-class, and 13-class detection scenarios show the high detection accuracy that exceeds 99% in all of the tested configurations with the low number of false positives. Comparison with the recently developed DDoS detection techniques confirms the efficiency of the proposed approach for the precise network attack classification.
Over the past decades, distributed denial of service attacks have been one of the most devastating security threats, disrupting many services that rely heavily on the Internet and leading to significant economic losses for various sectors. Identifying DDoS attacks poses a significant challenge that must be addressed through detection methods before effective mitigation strategies can be deployed. Detection of these attacks requires sophisticated technical solutions to discern malicious traffic from legitimate network activity in real-time. According to the work in this paper, a hybrid model combining Machine Learning and Deep Learning algorithms is introduced to enhance the detection of DDoS attacks. This hybrid model employs two main stages. The Gradient Boosting (GB) Machine Learning algorithm has been utilized in the first stage for efficient feature selection and computational complexity reduction. In the second stage, the Gated Recurrent Units (GRU) Deep learning algorithm has been employed to improve attack detection by capturing temporal dependencies and complex patterns. The hybrid model (GB-GRU) capitalizes on the strengths of both traditional machine learning and deep learning algorithms. The proposed hybrid model’s effectiveness is validated using the CICDoS2019 dataset, showing promising results in DDoS attack detection scenarios. Experimental results indicate that the proposed hybrid model achieves high detection performance with an accuracy rate of 99.96%, a False Positive Rate (FPR) of 0.2, less computational complexity compared to existing algorithms, and a test time of 5.729s.
E. Hossny, Amal M. Al-Eryani, F. Omara· Cluster Computing· 0 citations
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
This study examines a one-dimensional Convolutional Neural Network and a hybrid model, investigating how both architectures can detect network attacks in binary and multiclass classification settings, and provides actionable insights for practitioners choosing between deep learning and classical approaches under real-world NIDS deployment constraints.
The increasing development of the Internet of Things has led to several security threats and vulnerabilities associated with interconnected networks and, thus, makes them suitable targets for DDoS attacks. The increased dimensionality of traffic in the context of the Internet of Things makes IDS hard because deep learning models running independently are unable to adequately address the complexity associated with the interaction between network attributes. In this context, this research suggests a new architecture based on deep learning methods for binary classifications and featuring hybridization of multi-layer 1D-CNNs with LSTM networks. To reduce computational resources needed for training on IoT-based datasets, the ANOVA F-test is implemented to choose the key features before training. The proposed architecture includes dual convolutional layers having 64 and 128 filters, respectively, that allow to analyze the hierarchical spatial structures. Next, the data from convolutional layers is passed to the LSTM layer that analyzes high-order structural dependencies within feature maps generated at earlier stages. The proposed model was trained using the CICIoT2023 benchmark and showed superior performance compared to a standalone architecture featuring either CNNs or LSTM networks. Across five independent trials, the model achieved a mean accuracy of 98.72% ± 0.06%, with a precision of 98.91% and a recall of 98.65%. Furthermore, the proposed hybrid architecture shows high computational efficiency, achieving a remarkably low inference time of 0.15 ms per sample and a compact model footprint of 0.30 MB. These metrics confirm the model's suitability for deployment on resource-constrained IoT edge devices, providing a robust balance between high detection accuracy and low architectural complexity. These findings confirm that the constructive collaboration between spatial and structural feature modeling provides a robust, stable, and scalable solution for mitigating DDoS threats in modern IoT ecosystems.
Vinaykumar N Soni, Ashwinikumar Jha· International Journal of Ele...· 0 citations
The rapid growth of digital communication technologies, cloud computing, and Internet of Things (IoT) devices has
increased both the frequency and sophistication of cyber-attacks, making effective intrusion detection an essential component of
modern cybersecurity systems. Traditional signature-based intrusion detection systems (IDS) are effective against known attacks
but fail to detect previously unseen or evolving threats. This study investigates the application of deep learning models for binary
network intrusion detection using the NSL-KDD benchmark dataset. Three standalone architectures, Convolutional Neural
Networks (CNN), Long Short-Term Memory (LSTM) networks, and Deep Neural Networks (DNN), are implemented and
evaluated, alongside a CNN-LSTM Hybrid model that integrates spatial and sequential learning, and a DNN-LSTM Ensemble
model that combines independently trained DNN and LSTM predictions through weighted averaging. Following data cleaning,
categorical encoding, normalization, and Random Forest-based feature selection (41 features reduced to 20), all models were
trained and evaluated under identical conditions using Accuracy, Precision, Recall, F1-Score, ROC-AUC, training time, and
inference time. The standalone DNN model achieved the best overall performance, with 80.98% accuracy, 97.08% precision,
68.66% recall, 80.43% F1-score, and 96.11% ROC-AUC, while also requiring the shortest training time (39.69 s). The CNNLSTM Hybrid model attained the highest precision (97.23%) but did not outperform the standalone architectures overall, and
the DNN-LSTM Ensemble produced balanced but not superior results. These findings indicate that carefully designed
standalone architectures can match or exceed the performance of more complex hybrid and ensemble models for binary
intrusion detection, while incurring substantially lower computational cost. The study contributes a controlled, commonframework comparison of five deep learning architectures and provides practical guidance for selecting computationally
efficient models for anomaly-based intrusion detection.
Ketki Naik, Sanjeev Ghosh· International Journal for Re...· 0 citations