Feature-guided transformer approach for detecting distributed denial of service attacks

An Interpretable Neural Network Approach for Improved Denial-of-Service Attack Classification in Cloud Environments

A hybrid machine and deep learning model for detecting DDoS attacks

Over the past decades, distributed denial of service attacks have been one of the most devastating security threats, disrupting many services that rely heavily on the Internet and leading to significant economic losses for various sectors. Identifying DDoS attacks poses a significant challenge that must be addressed through detection methods before effective mitigation strategies can be deployed. Detection of these attacks requires sophisticated technical solutions to discern malicious traffic from legitimate network activity in real-time. According to the work in this paper, a hybrid model combining Machine Learning and Deep Learning algorithms is introduced to enhance the detection of DDoS attacks. This hybrid model employs two main stages. The Gradient Boosting (GB) Machine Learning algorithm has been utilized in the first stage for efficient feature selection and computational complexity reduction. In the second stage, the Gated Recurrent Units (GRU) Deep learning algorithm has been employed to improve attack detection by capturing temporal dependencies and complex patterns. The hybrid model (GB-GRU) capitalizes on the strengths of both traditional machine learning and deep learning algorithms. The proposed hybrid model’s effectiveness is validated using the CICDoS2019 dataset, showing promising results in DDoS attack detection scenarios. Experimental results indicate that the proposed hybrid model achieves high detection performance with an accuracy rate of 99.96%, a False Positive Rate (FPR) of 0.2, less computational complexity compared to existing algorithms, and a test time of 5.729s.

Imbalanced intrusion detection method using parrot optimization and DDIM-enhanced hybrid CNN-transformer

Accurate detection of rare attacks is a vital task in network intrusion detection. Although deep learning has superior feature representation capability and has become a mainstream technology in this field, existing methods still perform poorly in identifying rare attacks under long-tailed imbalanced multi-class traffic distribution, which remains a critical bottleneck in real-world deployment. This paper proposes an intrusion detection framework integrating improved parrot optimization (IPO), latent denoising diffusion implicit models (DDIM) and a hybrid CNN-Transformer. IPO balances global exploration and local exploitation via an annealing-greedy mechanism to select highly discriminative low-dimensional features, providing low-noise input for VAE-based Latent-DDIM to generate semantically consistent minority samples and alleviate class imbalance. The hybrid CNN-Transformer model captures local statistical patterns and global dependencies through multi-scale feature fusion, forming an end-to-end closed loop of “feature optimization-data augmentation-model modeling”. Experiments on NSL-KDD show that our method improves accuracy by 6.66%, F1-score by 8.01%, and recall rates of U2R and R2L attacks by 15% and 84.2% respectively compared with the best baseline. Moreover, IPO outperforms other mainstream intelligent algorithms in global optimal solution seeking with swifter convergence. On the dataset enhanced by the IPO-DDIM joint augmentation strategy, the hybrid CNN-Transformer obtains 3.93% higher accuracy and 6.24% higher F1-score, which sufficiently demonstrates the comprehensive superiority of the constructed framework.

Deep Learning–Based Real-Time Detection of Distributed Denial-of-Service Attacks in Network Traffic

: DDoS attacks have remained very troublesome in terms of the availability and reliability of online services through flooding network infrastructures with malicious traffic. Conventional signature-based and rule-based detection methods are not always useful to deal with the magnitude, variety and dynamism of these attacks. To overcome these problems, this piece of work proposes a deep learning-based real-time detection framework of DDoS attacks in network traffic. The suggested model combines both Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) networks in order to identify discriminative spatial characteristics of traffic patterns and sequence dependencies in the flow of packets, respectively. A hybrid CNN-LSTM model is trained and tested on a publicly available dataset on DDoS traffic and performance measured based on Accuracy, Precision, Recall, F1-score, and ROC-AUC. In order to have transparency, explainable AI (XAI) techniques like SHAP or LIME are used to explain the predictions of the model. To be deployed, the structure includes a Streamlit-based interface that enables real-time traffic simulation, live packet-level prediction, and detection result visualization. The results of the experiments indicate the usefulness of the offered method in attaining impressive detection and providing real-time monitoring of the DDoS threats, which can be applied practically.

AN ENHANCED SYSTEM FOR DETECTION OF DENIAL OF SERVICE ATTACKS IN DISTRIBUTED SYSTEMS USING DEEP LEARNING

The proliferation of distributed systems has fundamentally transformed how organizations manage their computational infrastructure, yet this advancement has simultaneously exposed critical vulnerabilities to Denial of Service (DoS) attacks. Traditional detection mechanisms struggle to identify sophisticated attack patterns in real-time, particularly within cloud-based and edge computing environments. This research introduces an enhanced detection framework leveraging deep learning architectures, specifically combining Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks to analyze network traffic patterns. Through experimental validation on a dataset comprising 2.3 million network packets collected from enterprise distributed systems, our proposed model achieved a detection accuracy of 98.7%, significantly outperforming conventional machine learning approaches. The system demonstrates remarkable capability in identifying zero-day attack variants while maintaining minimal false positive rates below 1.2%. Implementation across three distinct cloud environments revealed average detection latency of 47 milliseconds, making it viable for real-time deployment. This research contributes to cybersecurity literature by establishing a scalable, adaptive framework that addresses the evolving threat landscape facing distributed computing infrastructure, offering practical implications for system administrators and security professionals managing large-scale networked environments.

Multi-Class Network Intrusion Detection: Machine and Deep Learning Benchmark with Live Stream Deployment