Jul 2026· International Conference on Computer Aided Design· pp. 1-6· 0 citations· 25 references
Abstract
Distributed Denial of Service (DDoS) attacks pose a significant threat to network availability, necessitating robust detection mechanisms. This paper investigates the efficacy of Long Short-Term Memory (LSTM) networks and Autoregressive Integrated Moving Average (ARIMA) models for distinguishing between benign and malicious DDoS traffic. Using the comprehensive CIC-IDS 2017 dataset, this study aims to evaluate and compare the predictive performance of these distinct modeling approaches. Our methodology involved preprocessing the CIC-IDS 2017 dataset, extracting relevant features, and performing feature engineering to create new, informative features for time-series analysis and classification. An LSTM neural network was meticulously designed and trained to capture intricate temporal patterns and dependencies in network traffic flows. Concurrently, an ARIMA model was developed to provide a statistical baseline, focusing on its capacity to model linear relationships. Experimental results demonstrated a significant performance disparity. The LSTM model achieved a remarkable accuracy of 99% in identifying DDoS attacks, showcasing its superior capability in discerning subtle anomalies. In contrast, the ARIMA model yielded an accuracy of 89%. This difference underscores the advantages of LSTM networks; their recurrent architecture excels at recognizing and learning from non-linear relationships and long-term dependencies prevalent in dynamic network traffic. While traditional statistical methods like ARIMA capture some temporal aspects, they are less adept at modeling complex, evolving cyber threats. This research highlights deep learning approaches, specifically LSTMs, as crucial for enhancing the precision and reliability of real-time DDoS attack detection, offering a more resilient defense against contemporary cyber threats.
The rapid growth of digital communication technologies and interconnected network infrastructures has increased the frequency and sophistication of cyber threats. Traditional Network Intrusion Detection Systems (NIDS), which primarily depend on signature-based and rule-based approaches, often struggle to detect zero-day attacks and evolving intrusion patterns. This study presents the design and implementation of a hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) deep learning-based Network Intrusion Detection System to improve the detection accuracy and reliability of malicious network activities. The proposed system combines the feature-extraction capabilities of CNNs with the temporal sequence-learning capabilities of LSTMs to identify both spatial and sequential characteristics of network traffic. The CICIDS2017 benchmark dataset was utilised for system training and evaluation. Data preprocessing techniques such as removing missing values, feature scaling, label encoding, and Synthetic Minority Oversampling Technique (SMOTE) balancing were applied to improve data quality and class distribution. The model was implemented using Python, TensorFlow, Keras, Scikit-learn, NumPy, and Pandas within a Google Colab environment. The processed dataset was partitioned into 80% for training and 20% for testing. Experimental results demonstrated high intrusion detection performance with an accuracy of 98.48%, precision of 97.75%, recall of 99.23%, F1-score of 98.49%, and a false alarm rate of 2.28%. In addition to the deep learning model, a web-based user interface was developed to support traffic prediction, performance monitoring, and management of prediction history. The findings indicate that hybrid deep learning techniques can improve network security by enhancing intrusion detection capability while reducing false alarms.
A. O. Jimoh-Mahmud, Abubakar Dayyabu, Abubakar Sadiq Idris et al.· FUDMA Journal of Sciences· 0 citations
: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.
D. K., M. K· Proceedings of the 1st Inter...· 0 citations
—DDoS attacks continue to pose a severe problem in today’s computer security due to their ability to significantly impact the network’s functionality and deplete computing and communication resources. This paper proposes a deep learning-based approach for reliable DDoS attack detection and classification into distinct classes. The suggested framework goes beyond the state-of-the-art binary classification approach by incorporating the multi-class classification at various levels that help to distinguish particular DDoS attack categories. Three different deep learning models are examined. In the first model, the Multi-Layer Perceptron (MLP) is utilized to extract informative patterns from the flow-based network features. In the second model, the combination of one-dimensional convolutional layers with the Deep Neural Network (CNN1D-DNN) is employed to analyze local patterns and perform traffic classification. Finally, in the third model, the RNN-LSTM architecture is used to analyze the temporal dependencies of the traffic data. Experiments are performed on the CIC-DDoS-2019 dataset, which includes benign traffic and several types of DDoS attacks. The feature selection and balancing techniques are applied in order to minimize the impact of the redundant information and class imbalance problem. Evaluation results under the binary, 7-class, and 13-class detection scenarios show the high detection accuracy that exceeds 99% in all of the tested configurations with the low number of false positives. Comparison with the recently developed DDoS detection techniques confirms the efficiency of the proposed approach for the precise network attack classification.
Haythem Hayouni, Wala Ben Rhouma· Journal of Communications So...· 0 citations
This article proposes an advanced method for network intrusion detection using a combination of recurrent neural networks (RNNs), specifically long short-term memory (LSTM), gated recurrent units (GRU), and bidirectional long short-term memory (BiLSTM) models, enhanced by synthetic minority oversampling technique (SMOTE) to address class imbalance in datasets like network security laboratory–knowledge discovery in databases (NSL-KDD). The method aims to accurately classify network traffic by learning temporal patterns of both normal and malicious activities. SMOTE is employed to balance the dataset, ensuring that underrepresented attack types receive adequate model attention, thereby improving model robustness. The proposed models (LSTM, GRU, and BiLSTM) are trained and evaluated on the NSL-KDD dataset, with hyperparameter tuning performed through RandomizedSearchCV for optimal performance. The results show a significant improvement in accuracy, precision, recall, and F1-score, with BiLSTM demonstrating the highest performance, achieving near-perfect classification results (99.5% accuracy). This method not only mitigates the issue of class imbalance but also leverages the power of RNNs for sequence modeling, offering a promising solution for effective intrusion detection in modern networks.
Prajwalasimha Sindugatta Nagaraja, Navya Rajashekara, Pushpa Bangalore Ramesh et al.· IAES International Journal o...· 0 citations
Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.
Huanchi Luo, Gen Li, Yong Tang· Discover Computing· 0 citations
Over the past decades, distributed denial of service attacks have been one of the most devastating security threats, disrupting many services that rely heavily on the Internet and leading to significant economic losses for various sectors. Identifying DDoS attacks poses a significant challenge that must be addressed through detection methods before effective mitigation strategies can be deployed. Detection of these attacks requires sophisticated technical solutions to discern malicious traffic from legitimate network activity in real-time. According to the work in this paper, a hybrid model combining Machine Learning and Deep Learning algorithms is introduced to enhance the detection of DDoS attacks. This hybrid model employs two main stages. The Gradient Boosting (GB) Machine Learning algorithm has been utilized in the first stage for efficient feature selection and computational complexity reduction. In the second stage, the Gated Recurrent Units (GRU) Deep learning algorithm has been employed to improve attack detection by capturing temporal dependencies and complex patterns. The hybrid model (GB-GRU) capitalizes on the strengths of both traditional machine learning and deep learning algorithms. The proposed hybrid model’s effectiveness is validated using the CICDoS2019 dataset, showing promising results in DDoS attack detection scenarios. Experimental results indicate that the proposed hybrid model achieves high detection performance with an accuracy rate of 99.96%, a False Positive Rate (FPR) of 0.2, less computational complexity compared to existing algorithms, and a test time of 5.729s.
E. Hossny, Amal M. Al-Eryani, F. Omara· Cluster Computing· 0 citations