PUBLICATION 4

Abstract

Distributed Denial-of-Service (DDoS) attacks remain one of the most significant threats to the availability and reliability of modern computer networks. Their distributed nature, rapidly changing traffic patterns, and increasing use of sophisticated application and protocol-level techniques make conventional signature- and threshold-based detection increasingly inadequate. Deep learning (DL) offers an alternative because it can learn complex representations from network traffic and automatically identify patterns associated with malicious behaviour. This study proposes a deep-learning approach for real-time detection and classification of DDoS attacks. The proposed framework integrates network-flow acquisition, data preprocessing, feature optimization, deep representation learning, attack classification, and real-time decision-making. A hybrid CNN-LSTM architecture is proposed as the principal model because convolutional layers can extract discriminative local traffic patterns while Long Short-Term Memory (LSTM) layers can capture temporal dependencies in sequential network behaviour. The framework is designed to perform both binary detection—distinguishing benign traffic from DDoS traffic—and multiclass classification of individual DDoS attack families. CIC-DDoS2019 is proposed as the primary benchmark because it contains realistic benign traffic and multiple DDoS attack categories, with more than 80 flow-level features extracted from captured traffic. The study emphasizes not only classification performance but also detection latency, computational overhead, false-positive rate, and model generalization. Recent literature indicates growing interest in CNN, LSTM, attention mechanisms, and Transformer architectures for DDoS detection, while persistent challenges include class imbalance, concept drift, scalability, and real-time deployment. The proposed framework addresses these challenges by combining temporal deep learning with lightweight preprocessing and systematic evaluation.

Keywords: Distributed Denial-of-Service, DDoS, deep learning, CNN, LSTM, real-time detection, attack classification, network security, intrusion detection, cybersecurity.

Introduction

The rapid expansion of Internet-based services has created a highly interconnected digital environment in which businesses, governments, financial institutions, educational organizations, healthcare providers, and individuals depend on continuous network availability. This dependence has also increased the consequences of cyberattacks that target service availability. Distributed Denial-of-Service (DDoS) attacks are particularly important because they exploit multiple sources to generate coordinated malicious traffic against a target. The objective is generally to exhaust bandwidth, processing capacity, memory, connection tables, or application resources, thereby preventing legitimate users from accessing the targeted service. The problem is becoming increasingly complex because DDoS attacks are no longer restricted to simple high-volume floods. Attackers can combine multiple techniques, vary traffic rates, distribute activity across many sources, or target application-layer services. Consequently, traffic associated with an attack may sometimes resemble legitimate user behaviour. Traditional intrusion-detection systems rely heavily on predefined signatures, rules, thresholds, and manually engineered statistical indicators. These approaches remain useful, but they can be ineffective against previously unseen attacks and dynamic traffic patterns. Machine learning has consequently become an important research direction. Deep learning is particularly attractive because it can learn hierarchical representations from large amounts of network data. A recent review in Expert Systems with Applications identifies CNN, LSTM, autoencoder, and other deep-learning approaches as major directions in DDoS detection while emphasizing unresolved issues concerning generalization, computational cost, and real-world deployment. ([ScienceDirect][1])The distinction between detection and classification is important. Detection determines whether traffic is benign or malicious, whereas classification attempts to identify the particular attack family. For operational cybersecurity, both capabilities can be valuable. Detecting an attack quickly allows mitigation to begin, while classification can help security personnel select an appropriate response. The present study therefore proposes a deep-learning framework designed to address both tasks in real time.

Problem Statement

The increasing volume and diversity of network traffic make manual DDoS detection impractical. A conventional system that waits for a fixed threshold to be exceeded may detect obvious attacks but fail against low-rate or slowly evolving attacks. Similarly, signature-based systems may struggle with attack variants that do not match known signatures.Deep learning provides a potential solution, but several research problems remain.First, many deep-learning studies emphasize classification accuracy while providing limited evidence concerning actual real-time performance.Second, models trained on benchmark datasets may not generalize effectively to new environments.Third, DDoS datasets can exhibit severe class imbalance, which can cause accuracy to provide an overly optimistic assessment.Fourth, DDoS classification involves temporal behaviour. Treating each network flow as an independent observation may discard useful information about how an attack develops over time.Fifth, increasingly sophisticated architectures can introduce significant computational overhead. A model with excellent accuracy may therefore be unsuitable for high-speed network environments if inference takes too long.Consequently, the central problem addressed by this study is:How can a deep-learning system accurately detect and classify diverse DDoS attacks in real time while maintaining low detection latency, manageable computational requirements, and reliable generalization?

Aim and Objectives

1 Aim: This study aims to develop and evaluate a deep-learning framework for real-time detection and classification of DDoS attacks in modern computer networks.2 Objectives: The study specifically seeks to:1. identify network-flow characteristics associated with DDoS attacks;2. develop a deep-learning model for real-time DDoS detection;3. develop a multiclass classification mechanism for distinguishing DDoS attack families; 4. investigate the effectiveness of CNN and LSTM architectures for DDoS detection; 5. examine whether combining CNN and LSTM improves classification performance; 6. evaluate the proposed model using benchmark DDoS datasets; 7. measure detection latency and computational requirements; 8. examine the effects of class imbalance and feature reduction; and, 9. assess the generalization of the proposed model across different datasets.

Research Questions

The research is guided by the following questions: RQ1: Which network-flow characteristics provide the most useful information for real-time DDoS detection? RQ2: How effectively can deep-learning models distinguish DDoS traffic from legitimate network traffic?RQ3: Does a CNN-LSTM architecture outperform individual CNN and LSTM models for DDoS classification? RQ4: How accurately can the proposed model distinguish among different DDoS attack families? RQ5: What is the detection latency of the proposed deep-learning framework? RQ6: How does the proposed model perform when evaluated on traffic from an unseen dataset or network environment?

Literature Review

1 Deep Learning and DDoS Detection. Deep learning is a subset of machine learning that uses multilayer neural networks to learn increasingly abstract representations of data. A simplified neural-network model can be expressed as:h=f(WX+b), where \(X\) represents input traffic features, \(W\) represents learned weights, \(b\) represents bias, and \(f\) represents an activation function. Unlike conventional machine-learning approaches that often require extensive manual feature engineering, deep-learning models can learn useful representations directly from appropriately prepared data. Recent research reviews identify this automatic representation-learning capability as one of the principal reasons for applying deep learning to DDoS detection. ([ScienceDirect][1])However, deep learning does not automatically guarantee better cybersecurity performance. Model architecture, preprocessing, training data, class balance, evaluation design, and deployment environment all influence results.2 Convolutional Neural Networks Convolutional Neural Networks (CNNs) are commonly associated with image processing, but they can also be applied to structured network-traffic representations.A convolution operation can be represented as: Y(i)=\sum_{j=1}^{k}W(j)X(i+j) +b. The convolutional layer learns local patterns in the input. In DDoS detection, these patterns may represent relationships among traffic features or local temporal patterns within a sequence of observations.CNNs are attractive because they can provide efficient feature extraction and can be parallelized effectively.3 Long Short-Term Memory Networks. DDoS attacks frequently exhibit temporal characteristics. Traffic may increase progressively, fluctuate between bursts, or maintain abnormal behaviour over successive intervals.LSTM networks are designed to model such sequential dependencies. An LSTM maintains an internal state through gating mechanisms. The principal equations include:f_t=\sigma(W_f[h_{t-1},x_t]+b_f)i_t=\sigma(W_i[h_{t-1},x_t]+b_i)C_t=f_t*C_{t-1}+i_t*\tilde{C}_to_t=\sigma(W_o[h_{t-1},x_t]+b_o)h_t=o_t*\tanh(C_t)These mechanisms enable the model to retain information about relevant previous observations.For DDoS detection, this means an LSTM can potentially identify attack patterns that become apparent only when several consecutive traffic observations are considered.

Proposed CNN-LSTM Framework

The central contribution proposed in this study is a hybrid CNN-LSTM architecture. The conceptual process is: Network Traffic↓Flow Extraction↓Data Cleaning↓Feature Selection↓Normalization↓Temporal Window Construction↓CNN Feature Extraction↓LSTM Temporal Learning↓Dense Classification Layer↓DDoS Detection↓DDoS Attack Classification. The CNN component extracts informative patterns from network-flow observations, while the LSTM component captures relationships across consecutive observations. This combination is theoretically appropriate because DDoS traffic contains both feature-level patterns and temporal patterns. Recent research has investigated CNN-BiLSTM architectures with attention for DDoS detection and reported strong performance on CIC-DDoS2019 and Edge-IIoT. Such work demonstrates the continuing movement toward hybrid architectures that combine spatial/local feature extraction with temporal modelling. ([ScienceDirect][2])

Dataset and Data Preparation

1 CIC-DDoS2019CIC-DDoS2019 is proposed as the principal dataset. The dataset contains benign traffic and multiple DDoS attack families, including NTP, DNS, LDAP, MSSQL, NetBIOS, SNMP, SSDP, UDP, UDP-Lag, WebDDoS, SYN, and TFTP. It was generated using realistic background traffic and contains network-flow information extracted from packet captures. More than 80 traffic features were generated using CICFlowMeter-V3. Importantly, the dataset includes separate training and testing attack scenarios. This makes it useful for evaluating whether a model can generalize beyond the exact attack traffic used during training. 2. Data Preprocessing. The preprocessing pipeline should include:1. removal of duplicated records;2. treatment of missing and infinite values;3. removal of irrelevant identifiers;4. categorical encoding;5. feature normalization;6. feature selection;7. class-balancing procedures; and8. temporal sequencing.Normalization can be expressed as:x'=\frac{x-\mu}{\sigma}where \(x\) is the original feature, \(\mu\) is the mean, and \(\sigma\) is the standard deviation.This is particularly important for neural networks because features with substantially different scales can negatively affect training.

Binary Detection and Multiclass Classification

The proposed framework performs two related tasks.1 Binary Detection: The first stage determines whether traffic is: Y\in\{Benign, DDoS \}. This stage prioritizes rapid detection.2 Multiclass Classification: If traffic is classified as DDoS, the second stage determines the likely attack family: Y\in\{DNS, LDAP, UDP, SYN, NTP, \ ldots \}. This hierarchical structure is preferable to forcing the model to distinguish all classes simultaneously because the initial decision is simpler and operationally more important. For example: Stage 1: Is this traffic malicious?Stage 2: What type of DDoS behaviour does it represent? This architecture may also reduce computational requirements because detailed classification is performed only for suspicious traffic

Real-Time Detection Architecture

Real-time detection requires more than a highly accurate classifier. The proposed system divides traffic into short sequential windows: W_t=[X_{t-k},..., X_t]. Each window is processed by the CNN-LSTM model. The system generates: P_t=P(DDoS|W_t). If P_t> \ tau, where \(\tau\) is the detection threshold, the system generates a DDoS alert. However, relying on a single observation may create false positives. Therefore, the proposed framework uses temporal persistence. For example: P_t>\tau,\quad P_{t+1}>\tau,\quad P_{t+2}>\taucan increase confidence that the traffic represents a genuine attack. This provides an important distinction between instantaneous anomaly detection and temporal attack recognition.

Performance Evaluation

The proposed study should evaluate the framework using multiple metrics.AccuracyAccuracy=\frac{TP+TN}{TP+TN+FP+FN} Precision Precision=\frac{TP}{TP+FP} Recall Recall=\frac{TP}{TP+FN} F1-scoreF1=2\frac{Precision\times Recall}{Precision+Recall}False-Positive Rate FPR=\frac{FP}{FP+TN} Detection Latency Detection latency should be calculated as: L=T_{alert}-T_{attack}where \(T_{attack}\) represents the point at which measurable malicious behaviour begins and \(T_{alert}\) represents the time at which the detection system produces a reliable alert. For a real-time system, this metric may be as important as accuracy. Computational Cost: The research should also measure: model size; CPU utilization; GPU utilization where applicable; memory consumption; throughput; inference time per traffic window. This prevents the study from describing a model as "real-time" without demonstrating its operational feasibility.

Comparative Experimental Design

The proposed CNN-LSTM should be compared against appropriate baseline models.