Detection of DDoS Attacks in Networks Using Deep Learning Based on Long Short-Term Memory (LSTM)

Abstract

HTTP Flood attacks remain difficult to detect because they operate at the application layer, resemble legitimate user requests, and generate burst-based temporal traffic patterns. Previous DDoS detection studies often rely on outdated datasets, process network flows as independent records, insufficiently address class imbalance, and provide limited interpretability for security analysts. This study proposes a sequence-aware and explainable deep learning framework for HTTP Flood detection using Long Short-Term Memory (LSTM). Reconstructed HTTP traffic from the UNSW-NB15 dataset was processed through proxy labeling, data cleaning, feature normalization, and sliding-window transformation to convert flow-level records into temporal sequences. Class weighting and SMOTE oversampling were evaluated to mitigate imbalance, while SHAP and LIME were used to explain model decisions. The proposed LSTM model achieved an attack recall of 94.8%, a false negative rate of 5.2%, balanced accuracy of 94.3%, MCC of 0.824, and ROC-AUC of 0.975. The results show that temporal representation improves detection of bursty HTTP Flood behavior, whereas class weighting provides a better balance between attack sensitivity and false-alarm control. Explainability analysis further confirms that the model relies on technically meaningful indicators, including packet rate, flow duration, traffic asymmetry, and service concentration. This framework supports interpretable early-warning detection for application-layer DDoS attacks.