Jul 2026· International Conference on Computer Aided Design· pp. 1-6· 0 citations· 25 references
Abstract
Distributed Denial of Service (DDoS) attacks pose a significant threat to network availability, necessitating robust detection mechanisms. This paper investigates the efficacy of Long Short-Term Memory (LSTM) networks and Autoregressive Integrated Moving Average (ARIMA) models for distinguishing between benign and malicious DDoS traffic. Using the comprehensive CIC-IDS 2017 dataset, this study aims to evaluate and compare the predictive performance of these distinct modeling approaches. Our methodology involved preprocessing the CIC-IDS 2017 dataset, extracting relevant features, and performing feature engineering to create new, informative features for time-series analysis and classification. An LSTM neural network was meticulously designed and trained to capture intricate temporal patterns and dependencies in network traffic flows. Concurrently, an ARIMA model was developed to provide a statistical baseline, focusing on its capacity to model linear relationships. Experimental results demonstrated a significant performance disparity. The LSTM model achieved a remarkable accuracy of 99% in identifying DDoS attacks, showcasing its superior capability in discerning subtle anomalies. In contrast, the ARIMA model yielded an accuracy of 89%. This difference underscores the advantages of LSTM networks; their recurrent architecture excels at recognizing and learning from non-linear relationships and long-term dependencies prevalent in dynamic network traffic. While traditional statistical methods like ARIMA capture some temporal aspects, they are less adept at modeling complex, evolving cyber threats. This research highlights deep learning approaches, specifically LSTMs, as crucial for enhancing the precision and reliability of real-time DDoS attack detection, offering a more resilient defense against contemporary cyber threats.
The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations
A deep learning-based approach for reliable DDoS attack detection and classification into distinct classes goes beyond the state-of-the-art binary classification approach by incorporating the multi-class classification at various levels that help to distinguish particular DDoS attack categories.
Haythem Hayouni, Wala Ben Rhouma· Journal of Communications So...· 0 citations
This article proposes an advanced method for network intrusion detection using a combination of recurrent neural networks (RNNs), specifically long short-term memory (LSTM), gated recurrent units (GRU), and bidirectional long short-term memory (BiLSTM) models, enhanced by synthetic minority oversampling technique (SMOTE) to address class imbalance in datasets like network security laboratory–knowledge discovery in databases (NSL-KDD). The method aims to accurately classify network traffic by learning temporal patterns of both normal and malicious activities. SMOTE is employed to balance the dataset, ensuring that underrepresented attack types receive adequate model attention, thereby improving model robustness. The proposed models (LSTM, GRU, and BiLSTM) are trained and evaluated on the NSL-KDD dataset, with hyperparameter tuning performed through RandomizedSearchCV for optimal performance. The results show a significant improvement in accuracy, precision, recall, and F1-score, with BiLSTM demonstrating the highest performance, achieving near-perfect classification results (99.5% accuracy). This method not only mitigates the issue of class imbalance but also leverages the power of RNNs for sequence modeling, offering a promising solution for effective intrusion detection in modern networks.
Prajwalasimha Sindugatta Nagaraja, Navya Rajashekara, Pushpa Bangalore Ramesh et al.· IAES International Journal o...· 0 citations
Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.
Huanchi Luo, Gen Li, Yong Tang· Discover Computing· 0 citations
Over the past decades, distributed denial of service attacks have been one of the most devastating security threats, disrupting many services that rely heavily on the Internet and leading to significant economic losses for various sectors. Identifying DDoS attacks poses a significant challenge that must be addressed through detection methods before effective mitigation strategies can be deployed. Detection of these attacks requires sophisticated technical solutions to discern malicious traffic from legitimate network activity in real-time. According to the work in this paper, a hybrid model combining Machine Learning and Deep Learning algorithms is introduced to enhance the detection of DDoS attacks. This hybrid model employs two main stages. The Gradient Boosting (GB) Machine Learning algorithm has been utilized in the first stage for efficient feature selection and computational complexity reduction. In the second stage, the Gated Recurrent Units (GRU) Deep learning algorithm has been employed to improve attack detection by capturing temporal dependencies and complex patterns. The hybrid model (GB-GRU) capitalizes on the strengths of both traditional machine learning and deep learning algorithms. The proposed hybrid model’s effectiveness is validated using the CICDoS2019 dataset, showing promising results in DDoS attack detection scenarios. Experimental results indicate that the proposed hybrid model achieves high detection performance with an accuracy rate of 99.96%, a False Positive Rate (FPR) of 0.2, less computational complexity compared to existing algorithms, and a test time of 5.729s.
E. Hossny, Amal M. Al-Eryani, F. Omara· Cluster Computing· 0 citations