An Intelligent Deep Learning Framework For Early Detection Of Distributed Denial-Of-Service Attacks

Sujit Sutradhar; Vinit Grewal; Dr. Geetika Parmar; Dr. S. Kanchana; Manish Shrivastava; P. Kavitha

doi:10.29284/4j3j9q88

Authors

Sujit Sutradhar Deputy Manager. IT Department ICFAI University, Tripura
Vinit Grewal Assistant Professor, Department of Engineering and Technology, GNDU REGIONAL CAMPUS, Jalandhar Add:114, University Enclave, Phase 1, Jalandhar
Dr. Geetika Parmar Assistant Professor, Department of Computer Science and Applications, Dr Vishwanath Karad MIT World Peace University, Pune, Maharashtra, India
Dr. S. Kanchana Assistant Professor, Department of Computer Science, Faculty of Science and Humanities, SRM Institute of Science and Technology, Kattankulathur, Tamil Nadu 603203, India
Manish Shrivastava Associate Professor, Computer Science and Engineering Department, Guru Ghasidas University, Bilaspur, CG
P. Kavitha Assistant Professor, Department of Mathematics, Amrita School of Physical Sciences, Coimbatore, Amrita Vishwa Vidyapeetham - 641112 - India

DOI:

https://doi.org/10.29284/4j3j9q88

Keywords:

DDoS detection, deep learning, temporal validation, class imbalance, early-stage detection.

Abstract

Distributed Denial-of-Service (DDoS) attacks remain a critical threat to modern network infrastructures, particularly in cloud and software-defined networking environments. This study proposes a temporal-aware deep learning framework for early detection of DDoS attacks using flow-based traffic features from the CIC-DDoS2019 dataset. A subset of 500,000 traffic flows was utilized, including BENIGN, DrDoS_NetBIOS, and DrDoS_SSDP classes. To ensure realistic evaluation, a strict chronological data-splitting strategy was applied to prevent temporal leakage, and class-weighted optimization was incorporated to address severe imbalance. A feed-forward deep neural network was implemented and evaluated against Logistic Regression and Random Forest baselines. Experimental results demonstrate strong detection performance in the binary configuration, with stable macro F1-scores and high attack recall under imbalance-aware training. Progressive timestamp-based evaluation further confirms that malicious traffic can be reliably detected during early stages of observation, with minimal performance degradation across increasing portions of the traffic timeline. A feature ablation study indicates that static flow-level statistical attributes provide strong discriminative signals. The findings highlight the importance of temporal-aware validation and imbalance-sensitive optimization for realistic and deployment-oriented DDoS detection systems.

References

1. Asad, M., Asim, M., Javed, T., Beg, M.O., Mujtaba, H. and Abbas, S., 2020. Deepdetect: detection of distributed denial of service attacks using deep learning. The Computer Journal, 63(7), pp.983-994.

2. Yuan, X., Li, C. and Li, X., 2017. DeepDefense: identifying DDoS attack via deep learning. In 2017 IEEE International Conference on Smart Computing (SMARTCOMP), pp. 1–8. IEEE.

3. Li, C., Wu, Y., Yuan, X., Sun, Z., Wang, W., Li, X. and Gong, L., 2018. Detection and defense of DDoS attack–based on deep learning in OpenFlow‐based SDN. International Journal of Communication Systems, 31(5), e3497.

4. Niyaz, Q., Sun, W. and Javaid, A.Y., 2016. A deep learning based DDoS detection system in software-defined networking (SDN). arXiv preprint, arXiv:1611.07400.

5. Doriguzzi-Corin, R., Millar, S., Scott-Hayward, S., Martinez-del-Rincon, J. and Siracusa, D., 2020. LUCID: A practical, lightweight deep learning solution for DDoS attack detection. IEEE Transactions on Network and Service Management, 17(2), pp.876–889.

6. Mittal, M., Kumar, K. and Behal, S., 2023. Deep learning approaches for detecting DDoS attacks: A systematic review. Soft Computing, 27(18), pp.13039–13075.

7. Elsayed, M.S., Le-Khac, N.A., Dev, S. and Jurcut, A.D., 2020. DDoSNet: A deep-learning model for detecting network attacks. In 2020 IEEE 21st International Symposium on A World of Wireless, Mobile and Multimedia Networks (WoWMoM), pp. 391–396. IEEE.

8. Haider, S., Akhunzada, A., Mustafa, I., Patel, T.B., Fernandez, A., Choo, K.K.R. and Iqbal, J., 2020. A deep CNN ensemble framework for efficient DDoS attack detection in software defined networks. IEEE Access, 8, pp.53972–53983.

9. Ujjan, R.M.A., Pervez, Z., Dahal, K., Bashir, A.K., Mumtaz, R. and González, J., 2020. Towards sFlow and adaptive polling sampling for deep learning based DDoS detection in SDN. Future Generation Computer Systems, 111, pp.763–779.

10. Akgun, D., Hizal, S. and Cavusoglu, U., 2022. A new DDoS attacks intrusion detection model based on deep learning for cybersecurity. Computers & Security, 118, 102748.

11. Aktar, S. and Nur, A.Y., 2023. Towards DDoS attack detection using deep learning approach. Computers & Security, 129, 103251.

12. Amma, N.G.B. and Subramanian, S., 2018. Vcdeepfl: Vector convolutional deep feature learning approach for identification of known and unknown denial of service attacks. In TENCON 2018 – 2018 IEEE Region 10 Conference, pp. 0640–0645. IEEE.

13. Alghazzawi, D., Bamasag, O., Ullah, H. and Asghar, M.Z., 2021. Efficient detection of DDoS attacks using a hybrid deep learning model with improved feature selection. Applied Sciences, 11(24), 11634.

14. Kumar, D., Pateriya, R.K., Gupta, R.K., Dehalwar, V. and Sharma, A., 2023. DDoS detection using deep learning. Procedia Computer Science, 218, pp.2420–2429.

15. Elubeyd, H. and Yiltas-Kaplan, D., 2023. Hybrid deep learning approach for automatic DoS/DDoS attacks detection in software-defined networks. Applied Sciences, 13(6), 3828.

16. Nugraha, B. and Murthy, R.N., 2020. Deep learning-based slow DDoS attack detection in SDN-based networks. In 2020 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), pp. 51–56. IEEE.

17. Wei, Y., Jang-Jaccard, J., Sabrina, F., Singh, A., Xu, W. and Camtepe, S., 2021. Ae-mlp: A hybrid deep learning approach for ddos detection and classification. IEEE Access, 9, pp.146810–146821.

18. Jamwal, A., 2025. CIC-DDoS 2019 dataset combined [dataset]. Kaggle. Available at: https://www.kaggle.com/datasets/anikaitjamwal/cic-ddos-2019-dataset-combined (Accessed: 11 February 2026).

19. Hnamte, V., Najar, A.A., Nhung-Nguyen, H., Hussain, J. and Sugali, M.N., 2024. DDoS attack detection and mitigation using deep neural network in SDN environment. Computers & Security, 138, 103661.

20. Bahashwan, A.A., Anbar, M., Manickam, S., Al-Amiedy, T.A., Aladaileh, M.A. and Bin-Salem, A.A., 2025. A deep learning-based mechanism for detecting variable-rate DDoS attacks in software-defined networks. Mobile Networks and Applications, 30(1), pp.12–41.

21. Pajila, P.J., Robinson, Y.H., Allimuthu, U., Julie, E.G., Jaffrin, L. and Sheena, B.G., 2025. Enhanced autoencoder and deep neural network (AE&DNN) method for ddos attack recognition. Wireless Networks, 31(4), pp.3277–3295.

22. Zaidoun, A.S. and Lachiri, Z., 2025. A hybrid deep learning model for multi-class DDoS detection in SDN networks. Annals of Telecommunications, pp.1–14.

23. Mandela, N. and Etyang, F., 2025. Comparative analysis of deep learning models for effective denial of service (DoS) attack detection in network security. Journal of Electrical Systems and Information Technology, 12(1), 73.

24. Shieh, C.S., Lin, W.W., Nguyen, T.T., Chen, C.H., Horng, M.F. and Miu, D., 2021. Detection of unknown ddos attacks with deep learning and gaussian mixture model. Applied Sciences, 11(11), 5213.