An Intelligent Intrusion Detection Framework for DDoS Attack Recognition using Deep Neural Networks

Abstract

DDoS attacks will likely always remain an important cybersecurity threat as they disrupt network services by flooding target systems with massive amounts of traffic. Identifying and mitigating modern DDoS attacks with traditional methods or machine learning systems is problematic due to rapidly changing and complex network traffic patterns. This study designs an innovative application of AI to DDoS attack detection for precisely distinguishing between malicious and benign network packets based on the integration of the Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) networks. The spatial DDoS attack traffic features are captured with the CNN component of the model and the temporal DDoS attack traffic features are captured with the LSTM component of the model. Evaluation of model performance was conducted with the publicly available CIC-IDS2017 and CIC-DDoS2019 datasets. There were multiple data cleaning steps that had to be finished before starting the modeling process. Data cleaning had to be done to remove pesky records that slowed down modeling without adding any relevant contribution to the data. Here, data normalization was performed, and the relevant attributes were selected. Following that, the performance of the proposed CNN-LSTM model was compared to that of the other popular machine learning models: Support Vector Machine (SVM) and Random Forest (RF). The performance results of the experiments showed that the proposed system had a 99.18% accuracy, 99.11% precision, 99.03% recall, and F1-score of 99.07% with a low false positive of $0.89 \%$. These results provide proof that the proposed system is successful in understanding the complicated structure of network traffic and solves the problem of DDoS Attack traffic detection and classification in a reliable and effective manner.