An Adaptive Multi-Model Learning Approach for Spatio-Temporal DDoS Attack Classification in Modern Networks

Abstract

The recent surge in the use of cloud computing, Internet of Things (IoT), and software-defined networks has contributed to a major increase in the rate and sophistication of Distributed Denial-of-Service (DDoS) attacks. Conventional intrusion detection strategies and unidimensional deep learning approaches do not address the dynamic, coordinated, and time-varying features of the contemporary network traffic and performance, which leads to lower detection rates and large false positive rates. This paper proposes an adaptive multi-model deep learning framework for accurate DDoS attack classification. The method incorporates the multi-modal network analysis, which implies the integration of statistical flow properties, temporal traffic dynamics, and structural interaction data. A hybrid architecture is implemented, which uses a CNN-BiLSTM network to predict temporal relationships, a Graph Attention Network (GAT) to obtain coordination of attack traffic at a distributed level, and a Transformer encoder to obtain global contextual dependencies. A dynamically adaptive fusion mechanism that is based on attention is used to combine the outputs of these models and the most pertinent features are given priority depending on the changing traffic conditions. A large-scale benchmark experiments on intrusion detection data sets illustrate that the proposed framework is superior in detection accuracy, generalization as well as false positive rates than the current methods. The model is computationally efficient and it can be deployed in the cloud, edge, and IoT-enabled network environment in real time.