A Hybrid Deep Learning Framework For Early Detection Of Distributed Denial-Of-Service Attacks In Communication Networks

DDoS attacks can be discussed as a significant cybersecurity threat because, despite their quick activation, they can turn network resources to overflow within a few seconds. Most current detection studies however have high accuracy when the datasets are highly imbalanced, which is not realistic in the operation demands of early warning. The proposed study suggests a hybrid deep learning model that would utilize Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) networks to enhance the reliability of the classification process and the ability to predict attacks by time. Experiments were performed with CIC-DDoS2019 dataset and 28 selected flow level features. A strict sliding window strategy (W = 60, S = 10) was used to convert network flows into sequential samples, for which windows were considered as attacks only whenever all the 60 flows were malicious. Two models were tested, CNN model alone and the proposed CNN - LSTM model. Results show that CNN--LSTM had a better performance at window level, which achieved ROC-AUC=0.982, PR-AUC=0.962, Macro-F1=0.976 than CNN-only (ROC-AUC=0.845, PR-AUC=0.809, Macro-F1=0.786). Under natural test conditions (97.8% attack windows), CNN--LSTM achieves an accuracy of 0.993 and Macro-F1 = 0.924. However, row-truth episode-based evaluation resulted in the miss rate of 0.746 for both the models, making it clear that it is difficult to detect attacks at their earliest onset. Overall, the findings confirm that CNN-LSTM improves performance in classification and strict episode-based evaluation results show that true onset-level early detection is still a challenging problem.