Enhanced DDoS Attack Detection Using Shepard Interpolation Neural Network with Artificial Rabbit Optimizer and SMOTE Balancing on Kaggle Dataset

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.

Deep learning techniques for DDoS attack detection: Concepts, analyses, challenges, and future directions

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

Abstract: DDoS attacks also known as distributed denial of service (DDoS) attacks have emerged as one of the most serious and fastest-growing threats on the Internet. Denial-of-service (DDoS) attacks are an example of cyber-attacks that target a specific system or network in an attempt to render it inaccessible or unusable for a period of time. As a result improving the detection of diverse types of DDoS cyber threats with better algorithms and higher accuracy while keeping the computational cost under control has become the most significant component of detecting DDoS cyber threats. DDoS (distributed denial-of-service) attack originates from many sources scattered over multiple network locations. DoS attacks are primarily motivated by the desire to significantly degrade the performance or completely consume a certain resource and a process to exploit a machine defect and cause failure of a processing or exhausting the system resources by exploiting a system flaw. Yet another method of assaulting the target system is to flood the network and monopolies it so preventing anyone else from utilizing it. DDoS attack has a high impact on crashing the network resources making the target servers unable to support the valid users.

Distributed Denial of Service (DDoS) attacks pose a significant threat to network applications. Many countermeasures have been proposed to tackle such attacks. This paper focuses on DDoS mitigation techniques, the practical way to filter attack traffic and keep victims alive. To rate limit attack traffic with as little normal traffic affected as possible, not just the amount of increased volume, but also how increased traffic is propagated in the network, denoted by traffic increasing patterns, is considered. In this paper, we propose unfair rate limiting (URL), in which traffic aggregates are given different priority by extracting increasing patterns and analyzing their relationship with DDoS attacks. Aggregates more likely to include attacks traffic are punished harder during mitigation. Two URL mechanisms are presented, Local URL (LoURL) and Collaborative URL (CoURL). LoURL works locally, while CoURL deals with locally indeterminate patterns based on global information, and thus achieves more effective mitigation. We evaluate the performance of proposed mechanisms through simulation. The simulation results show that both LoURL and CoURL can effectively mitigate DDoS attacks. CoURL outperforms LoURL with regard to the percentage of filtered attack traffic.

Deep learning (DL) has emerged as a powerful tool for intelligent cyberattack detection, especially Distributed Denial-of-Service (DDoS) in Software-Defined Networking (SDN), where rapid and accurate traffic classification is essential for ensuring security. This paper presents a comprehensive evaluation of six deep learning models (Multilayer Perceptron (MLP), one-dimensional Convolutional Neural Network (1D-CNN), Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), Recurrent Neural Network (RNN), and a proposed hybrid CNN-GRU model) for binary classification of network traffic into benign or attack classes. The experiments were conducted on an SDN traffic dataset initially exhibiting class imbalance. To address this, Synthetic Minority Over-sampling Technique (SMOTE) was applied, resulting in a balanced dataset of 24,500 samples (12,250 benign and 12,250 attacks). A robust preprocessing pipeline followed, including missing value verification (no missing values were found), feature normalization using StandardScaler to standardize numerical values, reshaping the data into 3D format to fit temporal models like CNN and GRU, and stratified train-test split (80% training, 20% testing) to maintain class distribution. The CNN-GRU model integrates a 1D convolutional layer for spatial pattern extraction and a GRU layer for temporal sequence learning, followed by dense layers with dropout regularization. The model was trained using the Adam optimizer with early stopping to prevent overfitting. Among all models, the CNN-GRU hybrid achieved perfect test performance, with 100% accuracy, 1.0000 precision, recall, and F1-score, and an ROC AUC of 1.0000. It also demonstrated exceptional generalization, achieving a mean cross-validation (CV) accuracy of 99.70% ± 0.09% and a mean AUC of 1.0000 ± 0.0000 across 5-fold stratified cross-validation. While individual models such as GRU, 1D-CNN, and LSTM also showed strong performance, the CNN-GRU hybrid consistently outperformed them in both accuracy and stability. These results validate the effectiveness of combining convolutional and recurrent architectures, augmented with data balancing via SMOTE, for highly accurate SDN-based intrusion detection.Supplementary InformationThe online version contains supplementary material available at 10.1038/s41598-025-13754-1.

The Internet of Things enabled Wireless Sensor Networks (IoT-enabled WSNs) are highly susceptible to a wide range of Distributed Denial of Service (DDoS) attacks. While several methods have been developed to identify and mitigate these attacks, creating a unified strategy to counter multi-layer DDoS attacks remains a challenge due to the diverse nature of threats presented at different layers of IoT communication networks. To address this, a new protocol called Multi-Layer DDoS threat Detection and Mitigation (MLDDM) has been proposed. MLDDM's core capability lies in its audit trail analysis of trusted networks. By continuously calculating trust parameters across various IoT layers, the trust-based network tree analysis method evaluates each sensor node within the network. This analysis is then used to detect and prevent DDoS attacks. The MLDDM is a comprehensive approach designed to detect and mitigate DDoS attacks across the application, transport, internet, and edge layers. The proposed multi-layer trust-based network tree method analyzes each node to determine whether it is a potential attacker, identifying DDoS threats and their root causes. Once a DDoS attack is detected, MLDDM disconnects the affected nodes from the IoT-enabled WSNs until the next scheduled check. Simulation results demonstrate that the MLDDM protocol outperforms existing solutions in terms of throughput, Packet Delivery Rate (PDR), energy efficiency, communication latency, and overhead.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.

The exponential growth of interconnected systems across the Internet of Things (IoT), Software-Defined Networks (SDN), and cloud environments has led to a drastic increase in the scale and advancement of Distributed Denial of Service (DDoS) attacks. Conventional defences based on machine learning are often static, traffic-centric, and lack adaptivity to dynamic network behaviour, resulting in high false-positive rates and delay in mitigation responses. To address these challenges, this paper presents a conceptual framework for an AI-driven, context-aware DDoS detection and mitigation system. The proposed approach employs a optimized Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) model for efficient, real-time detection of DDoS attacks. The model captures spatial and temporal correlations in traffic while incorporating contextual parameters such as Quality of Service (QoS), Service Level Agreement (SLA) priority, and workload telemetry. These contextual attributes enable the model to distinguish legitimate network fluctuations from malicious activities, so that the false positive rate will be reduced without compromising accuracy. For adaptive response, a Reinforcement Learning (RL)-based mitigation layer—exploiting Deep Q-Network (DQN) and Actor–Critic (AC) variants—continuously learns optimal mitigation actions based on real-time feedback. The interaction between detection and mitigation components forms a context-aware feedback loop, enabling dynamic policy refinement and continuous system improvement. Comprehensive literature analysis reveals that existing AI-based DDoS defense mechanisms lack integration between detection and mitigation, and often overlook contextual intelligence. The proposed framework bridges this gap by introducing a self-adaptive, feedback-driven defense system capable of maintaining detection precision, low latency, and QoS preservation in heterogeneous environments.

Fiber optic networks (FONs) are considered the backbone of telecom companies worldwide. However, the network elements of FONs are scattered over a wide area and managed through a centralized controller based on intelligent devices and the internet of things (IoT), with actuators used to perform specific tasks at remote locations. During the COVID-19 pandemic, many telecom companies advised their employees to manage the network using the public internet (e.g., working from home while connected to an IoT network). Theses IoT devices mostly have weak security algorithms that are easily taken-over by hackers, and therefore can generate Distributed Denial of Service (DDoS) attacks in FONs. A DDoS attack is one of the most severe cyberattack types, and can negatively affect the stability and quality of managing networks. Nowadays, software-defined networks (SDN) constitute a new approach that simplifies how the network can be managed through a centralized controller. Moreover, machine learning algorithms allow the detection of incoming malicious traffic with high accuracy. Therefore, combining SDN and ML approaches can lead to detecting and stopping DDoS attacks quickly and efficiently, especially compared to traditional methods. In this paper, we evaluated six ML models: Logistic Regression, K-Nearest Neighbor, Support Vector Machine, Naive Bayes, Decision Tree, and Random Forest. The accuracy reached 100% while detecting DDoS attacks in FON with two approaches: (1) using SVM with three features (SOS, SSIP, and RPF) and (2) using Random Forest with five features (SOS, SSIP, RPF, SDFP, and SDFB). The training time for the first approach was 14.3 s, whereas the second approach only requires 0.18 s; hence, the second approach was utilized for deployment.

In this paper, we demonstrate the integration of a SiP switching platform to improve real-world Distributed Denial of Service (DDoS) defense systems. We demonstrate how DDoS mitigation in the optical domain can be transparent to network and application layers, allowing for reconfiguration and tuning. Additionally, we show how optical domain DoS mitigation provides significant cost reduction-with a 1/3 cost reduction-compared to traditional mitigation using electronic counterparts. Our approach is ideal for data-center deployments, and our testbed topology mirrors a standard data center set up.

Distributed Denial of Service (DDoS) attacks have emerged as one of the most pervasive and damaging threats to network security, disrupting services and incurring substantial financial costs. Machine learning (ML) has been widely explored as a potential solution to enhance DDoS detection and mitigation. This systematic review evaluates the effectiveness of ML techniques in detecting DDoS attacks, synthesizing findings from studies published between 2004 and 2024. The review analyzes models such as Random Forest, Support Vector Machines (SVM), and K-Nearest Neighbors (K-NN) based on key performance metrics like accuracy, precision, recall, and F1-score. A comprehensive search of multiple databases, including Web of Science, IEEE, Scopus, ScienceDirect, and Google Scholar, resulted in 19 studies that met inclusion criteria. The findings show that ensemble methods, particularly Random Forest, consistently outperformed other models in terms of detection rates, mainly due to their ability to handle large feature sets and reduce overfitting. Support Vector Machines also performed well in specific scenarios. However, their effectiveness was sometimes limited by computational complexity and the dataset size. K-Nearest Neighbors showed mixed results, depending on the nature of the attack patterns. This review emphasizes the potential of ensemble learning approaches for DDoS detection, demonstrating their robustness in dynamic environments. The review identifies key gaps in the existing research, including the need for better feature selection and exploring deep learning techniques to enhance DDoS detection accuracy and adaptability further. This study contributes valuable insights into the strengths and limitations of ML-based DDoS detection models, offering a foundation for future advancements in the field. It underscores the importance of continued research into hybrid and deep learning models to address the evolving and increasingly sophisticated nature of DDoS attacks in real-world applications.

Many organizations and service providers have started shifting from traditional server-cluster infrastructure to cloud-based infrastructure. The threat of Distributed Denial of Service (DDoS) attack continues to wreak havoc in these cloud infrastructures. In addition to DDoS attacks, a new form of attack known as Economic Denial of Sustainability (EDoS) attack has emerged in recent years. EDoS which is unique to cloud infrastructure may not be easily detected as with DDoS. Although EDoS attack is small at the moment, it is expected to grow in the near future in tandem with the growth in cloud usage. As EDoS has a major impact economically, it can considered to be more serious than DDoS and many defence and mitigation mechanisms have been proposed to combat these attacks. This paper introduces EDoS and how it differs from DDoS. The existing mitigation techniques are described and the drawbacks of these techniques are explained.

Software Defined Network (SDN) is the new era of networking technology based on a centralized controller that separates the switch hardware from its operating software. The most important challenge is the security of SDN and the most prominent attack is the Distributed Denial of Service (DDoS) attack. Some of the research work done so far detects DDoS attacks using a threshold, which is usually assumed without proper scientific reason and hence may not be always accurate. The mitigation techniques used by some researchers block the host from sending the network traffic beyond a threshold, by installing drop rules in the flow table of the switch connected to that host. Doing so will not only block the attack traffic but also the genuine ones from other applications of that host. In this paper, we propose a model that calculates the threshold limit for the type of applications sending data to a particular switch, in real-time using a machine learning (ML) model, and determines whether that application traffic is DDoS traffic. After the detection, only application type sending DDoS traffic is blocked while other genuine applications are allowed to send the network traffic without any interruption. The use of a dynamic threshold, based on the current network traffic, will help in detecting DDoS efficiently.

A novel approach for accurate detection of the DDoS attacks in SDN-based SCADA systems based on deep recurrent neural networks