An Intelligent Deep Learning Framework for Distributed Denial-of-Service (DDoS) Attack Detection

Abstract

Distributed Denial-of-Service (DDoS) attacks have emerged as one of the most damaging and costly threats to networks in the current era, and they target the bandwidth, processing power, and application-layer services, while their attack strategies are becoming increasingly sophisticated and difficult to detect as time passes. Traditional approaches based on simple statistical thresholds or fixed signature rules may fail when the attackers change their strategies or conduct multi-vector attacks, because they are not robust or reliable enough to handle complex attacks. In this paper, I propose DL-DDoSNet, a novel deep learning-based framework for DDoS attack detection, which is robust, reliable, and accurate, and it is based on a Temporal Convolutional Network (TCN) encoder, a Bidirectional Long Short-Term Memory (BiLSTM) module, and a channel-wise self-attention mechanism. The TCN encoder and the BiLSTM module learn the rich spatiotemporal relationships in the network traffic data, while the channel-wise self-attention mechanism helps the model focus on the most informative channels to improve the detection accuracy. In addition, a hybrid feature selection method is proposed before feeding the data into the proposed DL-DDoSNet model, which uses the Information Gain to rank the features, and the Binary Grey Wolf Optimizer (BGWO) to select the optimal subset, so that the dimensionality of the data is reduced while the most discriminative traffic features are preserved, thereby improving the performance and efficiency of the model. The proposed method is evaluated using two benchmark datasets, CIC-DDoS2019 and CAIDA UCSD, that are commonly used in the literature, and the results show that the proposed framework achieves a detection accuracy of 99.21%, F1-score of 99.14%, precision of 99.09%, and a false positive rate of 0.61%, outperforming eight state-of-the-art baseline methods, because it can effectively handle complex DDoS attacks. An extensive ablation study is conducted to demonstrate the contribution of each component of the architecture to the overall performance, and real-time throughput tests show that DL-DDoSNet is fast and efficient enough to be deployed online in real-world production network environments, therefore it has the potential to be used in practice.