2026· E3S Web of Conferences· 0 citations· 11 references
TL;DR
Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Abstract
Software Defined Networking (SDN) introduces centralized control mechanisms that improve network programmability and management; however, this architectural shift also exposes the control plane to critical security threats, particularly Distributed Denial of Service (DDoS) attacks. This paper presents a hybrid deep learning–based detection framework that integrates Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) to enhance DDoS detection in SDN environments. The proposed CNN-GRU architecture combines spatial feature extraction with temporal traffic modeling to improve detection accuracy while maintaining practical inference latency. Experiments conducted using the CICIDS2018 dataset demonstrate that the proposed model achieves an overall classification accuracy of 99.98%, with precision and recall values exceeding 99.9% across both benign and attack traffic classes. The model records an average detection latency of approximately 219.8 ms per traffic instance, offering a favorable balance between detection performance and computational efficiency. Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds. These results suggest that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
A deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic is proposed.
H. Hussein, Saad Raad, Ali Qasim· Al-Noor Journal of Engineeri...· 0 citations
A Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection is proposed, which enhances detection capability for both known and zero-day attacks.
A comprehensive evaluation of deep learning architectures for DDoS attack detection in AMI environments, focusing on Convolutional Neural Network, CNN-Long Short-Term Memory (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU) hybrid approaches.
S. Bassey, P. Asuquo, Victor Anaga et al.· E3S Web of Conferences· 0 citations
With the widespread adoption of IPv6 network infrastructures, the early detection of Distributed Denial of Service (DDoS) attacks has become increasingly critical for network security. Particularly in low‐intensity attack scenarios, the fact that attack traffic is largely embedded within normal network traffic limits the effectiveness of traditional detection methods. This study proposes a deep learning‐based approach for early‐stage DDoS attack detection in IPv6 environments. In the proposed method, 100 × 256 traffic matrices obtained from raw IPv6 packets and created over sequential 100‐packet windows are used. These matrices are modeled using a Convolutional Neural Network (CNN) architecture enhanced with an attention mechanism (Convolutional Block Attention Module—CBAM). The training process was carried out using a curriculum learning strategy, in which the attack intensity was gradually reduced from 15% to 1%. The ablation analyses performed reveal that the effectiveness of the attention mechanism increases significantly when used in conjunction with the gradual learning strategy. Experimental results demonstrate that the proposed approach can detect low‐intensity IPv6 DDoS attacks with high accuracy and ROC‐AUC values. Furthermore, protocol‐based multi‐class analyses reveal that the model can meaningfully distinguish between TCP, UDP, and ICMP‐based attacks. Practically, the proposed approach offers a viable solution for early warning systems, network monitoring platforms, and automatic attack prevention mechanisms in IPv6‐based networks.
Enes Açıkgözoğlu· Concurrency and Computation· 0 citations
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations
