A Hybrid Deep Learning Framework For Early Detection Of Distributed Denial-Of-Service Attacks In Communication Networks

Rahul Vijay Kotawadekar; Dr. Suhasini Vijaykumar; Bhushan S. Deore; Amit S. Tiwari; Jitendra P. Sonawane; Monu; Kyaw Myo Tun

doi:10.29284/9tw8q990

Authors

Rahul Vijay Kotawadekar Research Scholar, Department of Computer Applications, Bharati Vidyapeeth's Institute of Management & Information Technology, Navi Mumbai, India 400614, Affiliated to University of Mumbai
Dr. Suhasini Vijaykumar Professor and Principal, Department of Computer Applications, Bharati Vidyapeeth's Institute of Management & Information Technology, Navi Mumbai, India
Bhushan S. Deore Assistant Professor, Department of Electronics and Communication Engineering, Ramrao Adik Institute of Technology, D. Y. Patil Deemed to be University, Navi Mumbai, India
Amit S. Tiwari Assistant Professor, Department of Electronics and Computer Science Engineering, Shah and Anchor Kutchhi Engineering College, Mumbai, India
Jitendra P. Sonawane Assistant Professor, Department of Electronics and Communication Engineering, Ramrao Adik Institute of Technology, D.Y. Patil Deemed to be University, Navi Mumbai, Mumbai
Monu Assistant Professor, School of Information Science, Department of Computer Science & Engineering, Presidency University, Bengaluru, India
Kyaw Myo Tun Masters in Information Technology INTI International University, Malaysia

DOI:

https://doi.org/10.29284/9tw8q990

Keywords:

Distributed Denial-of-Service (DDoS) Detection, Hybrid Deep Learning (CNN–LSTM), CIC-DdoS2019 Dataset, Sliding Window Traffic Modeling, Episode-Based Early Detection.

Abstract

DDoS attacks can be discussed as a significant cybersecurity threat because, despite their quick activation, they can turn network resources to overflow within a few seconds. Most current detection studies however have high accuracy when the datasets are highly imbalanced, which is not realistic in the operation demands of early warning. The proposed study suggests a hybrid deep learning model that would utilize Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks to enhance the reliability of the classification process and the ability to predict attacks by time. Experiments were performed with CIC-DDoS2019 dataset and 28 selected flow level features. A strict sliding window strategy (W = 60, S = 10) was used to convert network flows into sequential samples, for which windows were considered as attacks only whenever all the 60 flows were malicious. Two models were tested, CNN model alone and the proposed CNN - LSTM model. Results show that CNN--LSTM had a better performance at window level, which achieved ROC-AUC=0.982, PR-AUC=0.962, Macro-F1=0.976 than CNN-only (ROC-AUC=0.845, PR-AUC=0.809, Macro-F1=0.786). Under natural test conditions (97.8% attack windows), CNN--LSTM achieves an accuracy of 0.993 and Macro-F1 = 0.924. However, row-truth episode-based evaluation resulted in the miss rate of 0.746 for both the models, making it clear that it is difficult to detect attacks at their earliest onset. Overall, the findings confirm that CNN-LSTM improves performance in classification and strict episode-based evaluation results show that true onset-level early detection is still a challenging problem.

References

[1]. A. Ahmim, F. Maazouzi, M. Ahmim, S. Namane, and I. B. Dhaou, “Distributed denial of service attack detection for the Internet of Things using hybrid deep learning model,” IEEE Access, vol. 11, pp. 119862–119875, 2023.

[2]. M. Ramzan, M. Shoaib, A. Altaf, S. Arshad, F. Iqbal, Á. K. Castilla, and I. Ashraf, “Distributed denial of service attack detection in network traffic using deep learning algorithm,” Sensors, vol. 23, no. 20, p. 8642, 2023.

[3]. W. G. Gadallah, H. M. Ibrahim, and N. M. Omar, “A deep learning technique to detect distributed denial of service attacks in software-defined networks,” Computers & Security, vol. 137, p. 103588, 2024.

[4]. S. Mohan, S. Nandhini, and K. Gunaseelan, “Detection of denial-of-service attack using a novel hybrid learning technique,” Journal of Information Security and Applications, vol. 92, p. 104081, 2025.

[5]. F. M. Aswad, A. M. S. Ahmed, N. A. M. Alhammadi, B. A. Khalaf, and S. A. Mostafa, “Deep learning in distributed denial-of-service attacks detection method for Internet of Things networks,” Journal of Intelligent Systems, vol. 32, no. 1, p. 20220155, 2023.

[6]. N. Jayakrishna and N. N. Prasanth, “A hybrid deep learning model for detection and mitigation of DDoS attacks in VANETs,” Scientific Reports, vol. 15, no. 1, p. 34170, 2025.

[7]. A. Sharma, S. Rani, S. H. Shah, R. Sharma, F. Yu, and M. M. Hassan, “An efficient hybrid deep learning model for denial of service detection in cyber physical systems,” IEEE Transactions on Network Science and Engineering, vol. 10, no. 5, pp. 2419–2428, 2023.

[8]. T. H. Aldhyani and H. Alkahtani, “Cyber security for detecting distributed denial of service attacks in agriculture 4.0: Deep learning model,” Mathematics, vol. 11, no. 1, p. 233, 2023.

[9]. E. Deniz and S. Serttaş, “Deep learning-based distributed denial of service detection system in the cloud network,” Journal of Scientific Reports-A, no. 055, pp. 16–33, 2023.

[10]. A. Yadav, M. Kaur, C. Sharma, and D. Prashar, “Next-gen distributed denial-of-service detection and mitigation in software-defined networking using hybrid machine learning approach,” in Soft Computing in Smart Manufacturing and Materials. Elsevier, 2025, pp. 97–133.

[11]. Y. A. Abid, J. Wu, G. Xu, S. Fu, and M. Waqas, “Multilevel deep neural network approach for enhanced distributed denial-of-service attack detection and classification in software-defined Internet of Things networks,” IEEE Internet of Things Journal, vol. 11, no. 14, pp. 24715–24725, 2024.

[12]. N. S. Musa, N. M. Mirza, S. H. Rafique, A. M. Abdallah, and T. Murugan, “Machine learning and deep learning techniques for distributed denial of service anomaly detection in software defined networks—current research solutions,” IEEE Access, vol. 12, pp. 17982–18011, 2024.

[13]. S. Abiramasundari and V. Ramaswamy, “Distributed denial-of-service (DDOS) attack detection using supervised machine learning algorithms,” Scientific Reports, vol. 15, no. 1, p. 13098, 2025.

[14]. T. Farid and M. Sirat, “Hybrid of supervised learning and optimization algorithm for optimal detection of IoT distributed denial of service attacks,” International Journal of Innovative Computing, vol. 13, no. 1, pp. 1–12, 2023.

[15]. S. Berríos, S. Garcia, P. Hermosilla, and H. Allende-Cid, “A machine-learning-based approach for the detection and mitigation of distributed denial-of-service attacks in Internet of Things environments,” Applied Sciences, vol. 15, no. 11, p. 6012, 2025.

[16]. S. Venkatraman, S. Kanthimathi, K. S. Jayasankar, T. P. Jiljith, and R. Jashwanth, “A novel self-attention-enabled weighted ensemble-based convolutional neural network framework for distributed denial of service attack classification,” IEEE Access, vol. 12, pp. 151515–151531, 2024.

[17]. M. A. O. Rabah, H. Drid, Y. Medjadba, and M. Rahouti, “Detection and mitigation of distributed denial of service attacks using ensemble learning and honeypots in a novel SDN-UAV network architecture,” IEEE Access, 2024.

[18]. N. Mahajan, A. Chauhan, H. Kumar, S. Kaushal, and A. K. Sangaiah, “A deep learning approach to detection and mitigation of distributed denial of service attacks in high availability intelligent transport systems,” Mobile Networks and Applications, vol. 27, no. 4, pp. 1423–1443, 2022.

[19]. H. Aydın, Z. Orman, and M. A. Aydın, “A long short-term memory (LSTM)-based distributed denial of service (DDoS) detection and defense system design in public cloud network environment,” Computers & Security, vol. 118, p. 102725, 2022.

[20]. N. A. Al-Shukaili, M. L. M. Kiah, and I. Ahmedy, “Optimizing feature selection and deep learning techniques for precise detection of low-rate distributed denial of service (LDDoS) attack,” Discover Internet of Things, vol. 5, no. 1, p. 80, 2025.

[21]. M. H. Zaib, F. Bashir, K. N. Qureshi, S. Kausar, M. Rizwan, and G. Jeon, “Deep learning based cyber bullying early detection using distributed denial of service flow,” Multimedia Systems, vol. 28, no. 6, pp. 1905–1924, 2022.

[22]. A. Fathima, G. S. Devi, and M. Faizaanuddin, “Improving distributed denial of service attack detection using supervised machine learning,” Measurement: Sensors, vol. 30, p. 100911, 2023.

[23]. H. Elubeyd and D. Yiltas-Kaplan, “Hybrid deep learning approach for automatic DoS/DDoS attacks detection in software-defined networks,” Applied Sciences, vol. 13, no. 6, p. 3828, 2023.

[24]. F. L. Becerra-Suarez, I. Fernández-Roman, and M. G. Forero, “Improvement of distributed denial of service attack detection through machine learning and data processing,” Mathematics, vol. 12, no. 9, p. 1294, 2024.

[25]. C. R. Babu, M. Suneetha, M. A. Ahmed, P. R. Babu, M. K. Ishak, H. K. Alkahtani, and S. M. Mostafa, “Hybridization of synergistic swarm and differential evolution with graph convolutional network for distributed denial of service detection and mitigation in IoT environment,” Scientific Reports, vol. 14, no. 1, p. 30868, 2024.

[26]. R. Aboalela, K. H. Allehaibi, N. Alsaadi, A. S. Alorfi, L. A. Maghrabi, E. B. Ashary, et al., “Harnessing feature pruning with optimal deep learning-based distributed denial of service cyberattack detection on IoT environment,” Alexandria Engineering Journal, vol. 120, pp. 584–597, 2025.

[27]. U. Islam, A. Muhammad, R. Mansoor, M. S. Hossain, I. Ahmad, E. T. Eldin, et al., “Detection of distributed denial of service (DDoS) attacks in IoT based monitoring system of banking sector using machine learning models,” Sustainability, vol. 14, no. 14, p. 8374, 2022.

[28]. Y. B. Sanap and P. G. Aher, “Deep learning method for detecting and mitigating distributed denial of service attacks with imbalanced data,” in Proceedings of the 2024 International Conference on Integrated Circuits and Communication Systems (ICICACS), Feb. 2024, pp. 1–8.

[29]. N. J. Shohan, G. Tanbhir, F. Elahi, A. Ullah, and M. N. Sakib, “Enhancing network security: A hybrid approach for detection and mitigation of distributed denial-of-service attacks using machine learning,” in International Conference on Advanced Network Technologies and Intelligent Computing, Cham, Switzerland: Springer Nature Switzerland, Dec. 2023, pp. 81–95.

[30]. I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, “Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy,” in Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India, 2019, pp. 1–8, doi: 10.1109/CCST.2019.8888419.