Adaptive Transformer-Gated Feature Selection With Cnn–Bilstm Hybrid Network For Efficient Ddos Attack Detection
DOI:
https://doi.org/10.29284/s2gavn02Keywords:
Distributed Denial of Service; Application-Layer DDoS; Transformer Attention; Dynamic Feature Selection; CNN–BiLSTM; Class Imbalance; Intrusion Detection SystemAbstract
Application-layer Distributed Denial of Service (DDoS) attacks continue to pose a serious risk to service availability, primarily due to their stealthy low-rate nature, protocol-level diversity, and highly non-stationary traffic characteristics [1]. In such rapidly evolving and heavily class-imbalanced scenarios, conventional machine-learning pipelines coupled with static feature-selection methods often fail to maintain consistent detection performance [2]. To mitigate these shortcomings, this study presents a composite deep-learning architecture that leverages Convolutional Neural Networks (CNN) to learn spatial feature representations, Bidirectional Long Short-Term Memory (BiLSTM) networks to capture temporal dependencies, and a Transformer-based attention mechanism to perform adaptive, instance-specific feature reweighting. Rather than discarding features through hard selection, the Transformer attention module continuously adjusts the contribution of all input attributes at the sample level, enabling flexible prioritization of discriminative features throughout the training process [3,4]. The proposed framework is implemented and evaluated on the CIC-DDoS2019 benchmark under pronounced class imbalance, where performance assessment relies on imbalance-aware evaluation metrics—including Balanced Accuracy, G-Mean, Matthews Correlation Coefficient, and Cohen’s Kappa—alongside inference-time measurement. Empirical comparisons reveal that incorporating Transformer-driven feature weighting substantially improves minority-class detection capability, enhances statistical consistency, and strengthens generalization across multiple attack categories when compared to static feature-selection techniques and strong CNN/BiLSTM-based baselines with or without attention mechanisms [2,4,5]. Collectively, these results demonstrate that augmenting a CNN–BiLSTM backbone with Transformer attention yields a resilient and scalable detection model for application-layer DDoS attacks.
References
[1]. Dhangar DN. A novel mechanism to fortify application layer against distributed denial of service (DDoS) attack. International Journal of Intelligent Systems and Applications in Engineering. 2024.
[2]. Aktar S, Nur AY. Towards DDoS attack detection using deep learning approach. Computers&Security.2023;129:103251.https://doi.org/10.1016/j.cose.2023.103251
[3]. Long Z, Yan H, Shen G, Zhang X, He H, Cheng L. A transformer-based network intrusion detection approach for cloud security. Journal of Cloud Computing. 2024;13:5.
[4]. Dai W, Li X, Ji W, He S. Network intrusion detection method based on CNN-BiLSTM-attention model. IEEE Access. 2024;12:53099–53111. https://doi.org/10.1109/ACCESS.2024.3384528
[5]. Momand A, Jan SU, Ramzan N. ABCNN-IDS: Attention-based convolutional neural network for intrusion detection in IoT networks. Wireless Personal Communications. 2024;136:1981–2003.
[6]. Sadhwani S, Khan MAH, Muthalagu R, Pawar PM, Suresh K. A hybrid BiLSTM-CNN approach for intrusion detection for IoT applications. Scientific Reports. 2025;16:155. https://doi.org/10.1038/s41598-025-29079-y
[7]. Kemp C, Calvert C, Khoshgoftaar TM, Leevy JL. An approach to application-layer denial-of-service detection. Journal of Big Data. 2023;10.
[8]. Alotaibi A, Alshamrani M. An RFE/Ridge-ML/DL-based anomaly intrusion detection approach. ICT Express. 2024;10(2):345–352.
[9]. Alenezi MA, Alshehri MD, Alshamrani M, Alotaibi A. Deep learning-based network anomaly detection and classification in an imbalanced cloud environment. Procedia Computer Science. 2024;231:123–130.
[10]. Chicco D, Jurman G. The advantages of the Matthews correlation coefficient over F1 score and accuracy in binary classification evaluation. BMC Genomics. 2020;21:6.
[11]. Sharafaldin I, Lashkari AH, Ghorbani AA. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proceedings of the International Conference on Information Systems Security and Privacy (ICISSP); 2018.
[12]. Vaswani A, Shazeer N, Parmar N, Uszkoreit J, Jones L, Gomez AN, Kaiser Ł, Polosukhin I. Attention is all you need. In: Advances in Neural Information Processing Systems; 2017.
[13]. Zhang Y, Wang L, Sun Y, Chen Z. Attention-based deep learning framework for imbalanced network intrusion detection. IEEE Access. 2023;11:124987–125001. https://doi.org/10.1109/ACCESS.2023.3321456
[14]. Bahdanau D, Cho K, Bengio Y. Neural machine translation by jointly learning to align and translate. In: Proceedings of the International Conference on Learning Representations (ICLR); 2015.
[15]. Alshamrani M, Alotaibi A, Alhaidari F. Explainable attention-based deep learning model for network intrusion detection. Computers & Security. 2024;135:103654. https://doi.org/10.1016/j.cose.2024.103654
[16]. C. Zhang, J. Li, N. Wang, and D. Zhang, “Research on intrusion detection method based on transformer and CNN–BiLSTM in Internet of Things,” Sensors, vol. 25, no. 9, Art. no. 2725, 2025, doi: 10.3390/s25092725.
[17]. P. Sathaporn, W. Krungseanmuang, V. Chaowalittawin, C. Benjangkaprasert, and B. Purahong, “DDoS detection using a hybrid CNN–RNN model enhanced with multi-head attention for cloud infrastructure,” Applied Sciences, vol. 15, no. 21, Art. no. 11567, 2025, doi: 10.3390/app152111567.
[18]. M. Umer, M. Tahir, S. Sardaraz, et al., “Network intrusion detection model using wrapper-based feature selection and multi-head attention transformers,” Scientific Reports, vol. 15, Art. no. 28718, 2025, doi: 10.1038/s41598-025-11348-5.
[19]. V. Govindarajan and J. H. Muzamal, “Advanced cloud intrusion detection framework using graph-based features, transformers and contrastive learning,” Scientific Reports, vol. 15, Art. no. 20511, 2025, doi: 10.1038/s41598-025-07956-w.
[20]. A. Almadhor, S. Alsubai, N. Kryvinska, et al., “Evaluating large transformer models for anomaly detection of resource-constrained IoT devices for intrusion detection systems,” Scientific Reports, vol. 15, Art. no. 37972, 2025, doi: 10.1038/s41598-025-21826-5.
[21]. M. Farhan, et al., “Deep learning-based network intrusion detection using multiple image transformers,” Scientific Reports, vol. 15, Art. no. 08770, 2025, doi: 10.1038/s41598-025-08770-0.
[22]. H. Kheddar, “Transformers and large language models for efficient cyber-threat detection: a survey,” Information Fusion, vol. 104, Art. no. 103347, 2025, doi: 10.1016/j.inffus.2025.103347.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
