Jun 2026· International Journal of Advanced Research in Science, Communication and Technology· pp. 279· 0 citations· 11 references
TL;DR
A hybrid deep learning framework that integrates one-dimensional Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) for accurate, real-time DDoS detection across multi-cloud enterprise environments and is suitable for production-grade, low-latency mitigation pipelines spanning AWS, Microsoft Azure and Google Cloud.
Abstract
Distributed Denial-of-Service (DDoS) attacks continue to rank among the most disruptive and economically damaging threats confronting modern enterprises, and their impact is magnified in multi-cloud deployments where workloads, traffic patterns and trust boundaries are distributed across heterogeneous providers. Conventional signature-based and threshold-driven defences struggle to keep pace with volumetric, protocol and low-rate application-layer attacks because they cannot model the joint spatial and temporal structure of malicious flows. This paper proposes a hybrid deep learning framework that integrates one-dimensional Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) for accurate, real-time DDoS detection across multi-cloud enterprise environments. The CNN stage extracts discriminative spatial features from per-flow statistical descriptors, while the stacked GRU stage captures the temporal evolution of traffic so that slow and bursty attacks are recognised with equal reliability. The model is trained and evaluated on the CIC-DDoS2019 benchmark augmented with multi-cloud telemetry, using a rigorously stratified split and a feature-selection pipeline that reduces dimensionality from 80 to 41 attributes. The proposed CNN-GRU classifier attains 99.24% accuracy, 99.18% precision, 99.05% recall, a 99.11% F1-score and a 0.997 ROC-AUC, while sustaining a sub-10 ms inference latency at line rate. It consistently outperforms support vector machines, random forests, standalone 1D-CNN, standalone GRU and a CNN-LSTM baseline. The results demonstrate that the framework is suitable for production-grade, low-latency mitigation pipelines spanning AWS, Microsoft Azure and Google Cloud.
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations
Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Victor Anaga, B. Stephen, E. Adediji et al.· E3S Web of Conferences· 0 citations
Over the past decades, distributed denial of service attacks have been one of the most devastating security threats, disrupting many services that rely heavily on the Internet and leading to significant economic losses for various sectors. Identifying DDoS attacks poses a significant challenge that must be addressed through detection methods before effective mitigation strategies can be deployed. Detection of these attacks requires sophisticated technical solutions to discern malicious traffic from legitimate network activity in real-time. According to the work in this paper, a hybrid model combining Machine Learning and Deep Learning algorithms is introduced to enhance the detection of DDoS attacks. This hybrid model employs two main stages. The Gradient Boosting (GB) Machine Learning algorithm has been utilized in the first stage for efficient feature selection and computational complexity reduction. In the second stage, the Gated Recurrent Units (GRU) Deep learning algorithm has been employed to improve attack detection by capturing temporal dependencies and complex patterns. The hybrid model (GB-GRU) capitalizes on the strengths of both traditional machine learning and deep learning algorithms. The proposed hybrid model’s effectiveness is validated using the CICDoS2019 dataset, showing promising results in DDoS attack detection scenarios. Experimental results indicate that the proposed hybrid model achieves high detection performance with an accuracy rate of 99.96%, a False Positive Rate (FPR) of 0.2, less computational complexity compared to existing algorithms, and a test time of 5.729s.
E. Hossny, Amal M. Al-Eryani, F. Omara· Cluster Computing· 0 citations
The rapid growth of networked and cloud-connected infrastructure has widened the attack surface available to
adversaries, exposing enterprise and IoT environments to increasingly stealthy and evolving intrusions. Signature-based
and shallow machine-learning intrusion detection systems (IDS) generalize poorly to zero-day and low-frequency attack
classes and typically treat traffic features independently, ignoring both the spatial correlation among flow attributes and the
temporal evolution of a connection. This paper proposes a novel Hybrid CNN-BiLSTM Attention-based Ensemble
Framework (CBAF) that unifies three complementary representations of network traffic. A one-dimensional feature vector
is first reshaped into a two-dimensional matrix and passed through convolutional layers that learn local spatial correlations
among protocol, packet, and byte-level attributes. The resulting feature maps are fed into a Bidirectional Long Short-Term
Memory (BiLSTM) network that models the forward and backward temporal dependencies characteristic of multi-stage
attacks. A self-attention layer then assigns adaptive importance weights to the most discriminative time steps and features,
improving both detection accuracy and interpretability. The attention-weighted representation is finally passed to a stacked
Random Forest meta-classifier that consolidates the deep and shallow decision boundaries to reduce false positives. The
framework further incorporates SMOTE-based oversampling to counter the severe class imbalance found in benchmark
intrusion datasets. Experiments on NSL-KDD, CICIDS2017, and UNSW-NB15 show that the proposed CBAF achieves
97.6% accuracy and a 0.96 F1-score, outperforming Logistic Regression, Support Vector Machine, Random Forest, and a
plain CNN-LSTM baseline, while maintaining real-time inference latency suitable for deployment in security operations
centers (SOCs).
Vishwaradhya K., Annappa S. S., L. C.· International Journal of Inn...· 0 citations
A Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection is proposed, which enhances detection capability for both known and zero-day attacks.