A High-Performance Deep Learning Model for DDoS Attack Detection

Abstract

—DDoS attacks continue to pose a severe problem in today’s computer security due to their ability to significantly impact the network’s functionality and deplete computing and communication resources. This paper proposes a deep learning-based approach for reliable DDoS attack detection and classification into distinct classes. The suggested framework goes beyond the state-of-the-art binary classification approach by incorporating the multi-class classification at various levels that help to distinguish particular DDoS attack categories. Three different deep learning models are examined. In the first model, the Multi-Layer Perceptron (MLP) is utilized to extract informative patterns from the flow-based network features. In the second model, the combination of one-dimensional convolutional layers with the Deep Neural Network (CNN1D-DNN) is employed to analyze local patterns and perform traffic classification. Finally, in the third model, the RNN-LSTM architecture is used to analyze the temporal dependencies of the traffic data. Experiments are performed on the CIC-DDoS-2019 dataset, which includes benign traffic and several types of DDoS attacks. The feature selection and balancing techniques are applied in order to minimize the impact of the redundant information and class imbalance problem. Evaluation results under the binary, 7-class, and 13-class detection scenarios show the high detection accuracy that exceeds 99% in all of the tested configurations with the low number of false positives. Comparison with the recently developed DDoS detection techniques confirms the efficiency of the proposed approach for the precise network attack classification.