2026· E3S Web of Conferences· Vol 735, pp. 03010· 0 citations· 11 references
TL;DR
Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Abstract
Software Defined Networking (SDN) introduces centralized control mechanisms that improve network programmability and management; however, this architectural shift also exposes the control plane to critical security threats, particularly Distributed Denial of Service (DDoS) attacks. This paper presents a hybrid deep learning–based detection framework that integrates Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) to enhance DDoS detection in SDN environments. The proposed CNN-GRU architecture combines spatial feature extraction with temporal traffic modeling to improve detection accuracy while maintaining practical inference latency. Experiments conducted using the CICIDS2018 dataset demonstrate that the proposed model achieves an overall classification accuracy of 99.98%, with precision and recall values exceeding 99.9% across both benign and attack traffic classes. The model records an average detection latency of approximately 219.8 ms per traffic instance, offering a favorable balance between detection performance and computational efficiency. Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds. These results suggest that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
The proliferation of distributed systems has fundamentally transformed how organizations manage their computational infrastructure, yet this advancement has simultaneously exposed critical vulnerabilities to Denial of Service (DoS) attacks. Traditional detection mechanisms struggle to identify sophisticated attack patterns in real-time, particularly within cloud-based and edge computing environments. This research introduces an enhanced detection framework leveraging deep learning architectures, specifically combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks to analyze network traffic patterns. Through experimental validation on a dataset comprising 2.3 million network packets collected from enterprise distributed systems, our proposed model achieved a detection accuracy of 98.7%, significantly outperforming conventional machine learning approaches. The system demonstrates remarkable capability in identifying zero-day attack variants while maintaining minimal false positive rates below 1.2%. Implementation across three distinct cloud environments revealed average detection latency of 47 milliseconds, making it viable for real-time deployment. This research contributes to cybersecurity literature by establishing a scalable, adaptive framework that addresses the evolving threat landscape facing distributed computing infrastructure, offering practical implications for system administrators and security professionals managing large-scale networked environments.
S. Muthukumar, A.K. Ashfauk Ahamed· International journal of com...· 0 citations
The increasing adoption of encryption in modern communication networks has reduced the effectiveness of traditional intrusion detection systems that rely on packet payload inspection. Consequently, there is a growing demand for payload-agnostic intrusion detection approaches capable of analyzing network behavior without accessing packet contents. This study proposes a deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic. The framework was evaluated using the UNSW-NB15 and CIC-IDS2018 benchmark datasets under both in-dataset and cross-dataset evaluation settings. Experimental results demonstrated excellent classification performance in in-dataset experiments, achieving high accuracy and area under the curve (AUC) values. A threshold calibration strategy was further employed to reduce false-positive rates and improve operational reliability. However, cross-dataset evaluation revealed a considerable decline in detection performance, highlighting the impact of domain shift on model generalization across heterogeneous network environments. These findings demonstrate the effectiveness of flow-level statistical features for intrusion detection while emphasizing the importance of developing more robust learning strategies to improve generalization beyond single-dataset training.
H. Hussein, Saad Raad, Ali Qasim· Al-Noor Journal of Engineeri...· 0 citations
The rapid expansion of the Internet of Things (IoT) has intensified security concerns. Many IoT devices operate with limited computational resources and inadequate built-in protection. This makes them vulnerable to malware attacks such as Distributed Denial-of-Service (DDoS), botnets, and ransomware. Traditional signature-based detection techniques struggle to identify evolving and previously unseen threats, highlighting the need for intelligent detection mechanisms. This study proposes a Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection. The CNN component extracts spatial features from network traffic, including packet-level and flow-based characteristics. The LSTM component captures temporal dependencies and sequential attack patterns. By integrating spatial and temporal learning, the hybrid architecture enhances detection capability for both known and zero-day attacks. Experimental results demonstrate superior performance compared to standalone CNN and LSTM models, achieving 99.92% accuracy, precision, recall, and F1-score, with a ROC-AUC of 0.999703.
Advanced Metering Infrastructure (AMI) networks in smart grids face evolving cybersecurity threats, with Distributed Denial of Service (DDoS) attacks posing critical risks to network availability and operational integrity. This paper presents a comprehensive evaluation of deep learning architectures for DDoS attack detection in AMI environments, focusing on Convolutional Neural Network (CNN), CNN-Long Short-Term Memory (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU) hybrid approaches. Using a dataset of 72,007 AMI samples enhanced with realistic DDoS attack simulations covering six attack categories, we implemented extensive feature engineering generating 3,398 features optimized to 75 discriminative indicators. The methodology incorporates synthetic attack generation maintaining 30% attack ratio with stratified data partitioning for robust evaluation. The results gotten from experiments demonstrate that the CNN architecture achieves excellent performance with 86.52% accuracy, 91.08% precision, and 85.73% F1-score, requiring only 23.7 minutes training time and 291,841 parameters. The CNN-LSTM hybrid shows competitive performance with 85.82% accuracy and enhanced temporal modeling capabilities. Both architectures significantly outperform the more complex CNN-GRU variant, establishing CNN-based approaches as optimal for AMI security applications. This research contributes evidence-based architectural guidance for AMI threat detection systems, demonstrating practical deployment solutions that balance detection accuracy with computational efficiency for real-world utility environments.
S. Bassey, P. Asuquo, Victor Anaga et al.· E3S Web of Conferences· 0 citations
With the widespread adoption of IPv6 network infrastructures, the early detection of Distributed Denial of Service (DDoS) attacks has become increasingly critical for network security. Particularly in low‐intensity attack scenarios, the fact that attack traffic is largely embedded within normal network traffic limits the effectiveness of traditional detection methods. This study proposes a deep learning‐based approach for early‐stage DDoS attack detection in IPv6 environments. In the proposed method, 100 × 256 traffic matrices obtained from raw IPv6 packets and created over sequential 100‐packet windows are used. These matrices are modeled using a Convolutional Neural Network (CNN) architecture enhanced with an attention mechanism (Convolutional Block Attention Module—CBAM). The training process was carried out using a curriculum learning strategy, in which the attack intensity was gradually reduced from 15% to 1%. The ablation analyses performed reveal that the effectiveness of the attention mechanism increases significantly when used in conjunction with the gradual learning strategy. Experimental results demonstrate that the proposed approach can detect low‐intensity IPv6 DDoS attacks with high accuracy and ROC‐AUC values. Furthermore, protocol‐based multi‐class analyses reveal that the model can meaningfully distinguish between TCP, UDP, and ICMP‐based attacks. Practically, the proposed approach offers a viable solution for early warning systems, network monitoring platforms, and automatic attack prevention mechanisms in IPv6‐based networks.
Enes Açıkgözoğlu· Concurrency and Computation· 0 citations
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations