Spotting and Mitigating DDoS Attacks Using Deep Learning for Online Traffic Analysis

Shirinjani, Mojtaba; Amiri, Mojtaba; Salehi, Amirhosein; Arefi Jamal, Pouria; Khazaei Laki, Rasoul; Sadegh Esfahani, Seyed Hatef; Ahmadi, Siavash; Koochak Shooshtari, Masoumeh; Aref, Mohammad Reza

doi:10.22042/isecure.2025.217461

Spotting and Mitigating DDoS Attacks Using Deep Learning for Online Traffic Analysis

Document Type : Research Article

Authors

Mojtaba Shirinjani ¹

Mojtaba Amiri ²

Amirhosein Salehi ¹

Pouria Arefi Jamal ³

Rasoul Khazaei Laki ⁴

Seyed Hatef Sadegh Esfahani ¹

Siavash Ahmadi ⁵

Masoumeh Koochak Shooshtari ⁵

Mohammad Reza Aref ¹

¹ Information Systems and Security Lab, EE Department, Sharif University of Technology, Tehran, Iran

² School of Electrical and Computer Engineering, Tehran University, Tehran, Iran

³ Department of Computer Engineering, Sharif University of Technology, Tehran, Iran

⁴ Department of Computer Engineering, Amirkabir University of Technology, Tehran, Iran

⁵ Electronics Research Institute, Sharif University of Technology, Tehran, Iran

https://doi.org/10.22042/isecure.2025.217461

Abstract

Distributed Denial of Service (DDoS) attacks threaten server and network availability with minimal resources. These attacks mimic legitimate traffic, evading Intrusion Detection Systems (IDS) and Intrusion Prevention Systems(IPS). The primary challenge in countering DDoS attacks is achieving early detection as close to their origin. In addition, the persistence of malicious traffic hidden within legitimate traffic remains a common challenge for various mitigation techniques. This paper introduces a modular approach for identifying and mitigating DDoS attacks in both online and offline settings, using deep learning and rule-based techniques. We train the IDS with VGG16, GoogLeNet, Support Vector Machines (SVM), and Random Forest (RF) and evaluate them using the CICDDoS2019 dataset. Our experiments show a detection accuracy of 99.87% offline and 99.67% online. Our methodology outperforms state-of-the-art approaches in offline detection, particularly with VGG16 and GoogLeNet. In our online setup, the mitigation module successfully addresses all attacks detected by our anti-DDoS solution.

Keywords

DDoS Mitigation

Deep Learning

Network Security

Traffic Analysis

[1] Imperva. The imperva global ddos threat landscape report 2023. Technical report, Imperva, 2023.
[2] A Dhanapal and P Nithyanandam. The slow http ddos attacks: Detection, mitigation and prevention in the cloud environment. Scalable Comput. Pract. Exp., 20(4):669–685, 2019.
[3] Nisha TN and Dhanya Pramod. Insider intrusion detection techniques: A state-of-the-art review. Journal of Computer Information Systems, 64(1):106–123, 2024.
[4] Francisco Sales de Lima Filho, Frederico AF Silveira, Agostinho de Medeiros Brito Junior, Genoveva Vargas-Solar, and Luiz F Silveira. Smart detection: an online approach for dos/ddos attack detection using machine learning. Security and Communication Networks, 2019:1–15, 2019.
[5] Yuan Cao, Yuan Gao, Rongjun Tan, Qingbang Han, and Zhuotao Liu. Understanding internet ddos mitigation from academic and industrial perspectives. IEEE Access, 6:66641–66648, 2018.
[6] Hossein Hadian Jazi, Hugo Gonzalez, Natalia Stakhanova, and Ali A Ghorbani. Detecting http-based application layer dos attacks on web servers in the presence of sampling. Computer Networks, 121:25–36, 2017.
[7] Weizhi Meng, Wenjuan Li, Chunhua Su, Jianying Zhou, and Rongxing Lu. Enhancing trust management for wireless intrusion detection via traffic sampling in the era of big data. Ieee Access, 6:7234–7243, 2017.
[8] Kazeem B Adedeji, Adnan M Abu-Mahfouz, and Anish M Kurien. Ddos attack and detection methods in internetenabled networks: Concept, research perspectives, and challenges. Journal of Sensor and Actuator Networks, 12(4):51, 2023.
[9] Mahendra Mehra, Mayank Agarwal, R Pawar, and Deven Shah. Mitigating denial of service attack using captcha mechanism. In Proceedings of the International Conference & Workshop on Emerging Trends in Technology, pages 284–287, 2011.
[10] Tony TN Miu, WL Lee, Alan KL Chung, Daniel XP Luo, Albert KT Hui, and Judy WS Wong. Kill’em all–ddos protection total annihilation!, 2013.
[11] Syarifah Bahiyah Rahayu, Arniyati Ahmad, and Siti Hajar Zainal Rashid. Defensive programming: Developing a web application with a secure coding practices. In AIP Conference Proceedings, volume 2617. AIP Publishing, 2022.
[12] Sunny Behal, Krishan Kumar, and Monika Sachdeva. D-face: An anomaly based distributed approach for early detection of ddos attacks and flash events. Journal of Network and Computer Applications, 111:49–63, 2018.
[13] Steven Simpson, Syed Noorulhassan Shirazi, Angelos Marnerides, Simon Jouet, Dimitrios Pezaros, and David Hutchison. An inter-domain collaboration scheme to remedy ddos attacks in computer networks. IEEE Transactions on Network and Service Management, 15(3):879–893, 2018.
[14] Zhuotao Liu, Yuan Cao, Min Zhu, and Wei Ge. Umbrella: Enabling isps to offer readily deployable and privacy preserving ddos prevention services. IEEE Transactions on Information Forensics and Security, 14(4):1098–1108, 2018.
[15] Muhammad Aamir and Syed Mustafa Ali Zaidi. Clustering based semi-supervised machine learning for ddos attack classification. Journal of King Saud University-Computer and Information Sciences, 33(4):436–446, 2021.
[16] Hani Elubeyd and Derya Yiltas-Kaplan. Hybrid deep learning approach for automatic dos/ddos attacks detection in software-defined networks. Applied Sciences, 13(6):3828, 2023.
[17] Sheeraz Ahmed, Zahoor Ali Khan, Syed Muhammad Mohsin, Shahid Latif, Sheraz Aslam, Hana Mujlid, Muhammad Adil, and Zeeshan Najam. Effective and efficient ddos attack detection using deep learning algorithm, multi-layer perceptron. Future Internet, 15(2):76, 2023.
[18] Muhammad Yeasir Arafat, Muhammad Morshed Alam, and Mohammad Fakrul Alam. A practical approach and mitigation techniques on application layer ddos attack in web server. International Journal of Computer Applications, 131(1):13–20, 2015.
[19] Gabriel Macia-Fernandez, Jes´us E D´ıaz-Verdejo, and Pedro Garc´ıa-Teodoro. Evaluation of a low-rate dos attack against application servers. computers & security, 27(7-8):335–354, 2008.
[20] Gabriel Maci´a-Fern´andez, Rafael A Rodr´ıguez-G´omez, and Jes´us E D´ıaz-Verdejo. Defense techniques for low-rate dos attacks against application servers. Computer Networks, 54(15):2711–2727, 2010.
[21] Jesus Arturo Perez-Diaz, Ismael Amezcua Valdovinos, Kim-Kwang Raymond Choo, and Dakai Zhu. A flexible sdn-based architecture for identifying and mitigating low-rate ddos attacks using machine learning. IEEE Access, 8:155859–
155872, 2020.
[22] Kriti Bhushan and BB Gupta. Hypothesis test for low-rate ddos attack detection in cloud computing environment. Procedia computer science, 132:947–955, 2018.
[23] IR Divyasree and K Selvamani. Dad: Domain adversarial defense system against ddos attacks in cloud. IEEE Transactions on Network and Service Management, 19(1):554–568, 2021.
[24] Haosu Cheng, Jianwei Liu, Tongge Xu, Bohan Ren, Jian Mao, and Wei Zhang. Machine learning based low-rate ddos attack detection for sdn enabled iot networks. International Journal of Sensor Networks, 34(1):56–69, 2020.
[25] P. Deepalakshmi Sudar, K. Muthamil. Flow-based detection and mitigation of low-rate ddos attack in sdn environment using machine learning techniques. In IoT and Analytics for Sensor Networks: Proceedings of ICWSNUCA 2021. Springer Singapore, 2022., pages 193–205. Springer, 2022.
[26] Iman Sharafaldin, Arash Habibi Lashkari, Saqib Hakak, and Ali A Ghorbani. Developing realistic distributed denial of service (ddos) attack dataset and taxonomy. In 2019 international carnahan conference on security technology (ICCST), pages 1–8. IEEE, 2019.
[27] Khundrakpam Johnson Singh and Tanmay De. An approach of ddos attack detection using classifiers. In Emerging Research in Computing, Information, Communication and Applications: ERCICA 2015, Volume 1, pages 429–437. Springer, 2015.
[28] Arnaud Rosay, Florent Carlier, Elo¨ıse Cheval, and Pascal Leroux. From cic-ids2017 to lycosids2017: A corrected dataset for better performance. In IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, pages 570–575, 2021.
[29] Rami J Alzahrani and Ahmed Alzahrani. Security analysis of ddos attacks using machine learning algorithms in networks traffic. Electronics, 10(23):2919, 2021.
[30] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.
[31] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1–9, 2015.
[32] Yao Yu, Lei Guo, Ye Liu, Jian Zheng, and YUE Zong. An efficient sdn-based ddos attack detection and rapid response platform in vehicular networks. IEEE access, 6:44570–44579, 2018.
[33] Mahmoud Said El Sayed, Nhien-An Le-Khac, Marianne A Azer, and Anca D Jurcut. A flow-based anomaly detection approach with feature selection method against ddos attacks in sdns. IEEE Transactions on Cognitive Communications and Networking, 8(4):1862–1880, 2022.
[34] Heena Kousar, Mohammed Moin Mulla, Pooja Shettar, and DG Narayan. Detection of ddos attacks in software defined network using decision tree. In 2021 10th IEEE International Conference on Communication Systems and Network Technologies (CSNT), pages 783–788. IEEE, 2021.
[35] Liang Tan, Yue Pan, Jing Wu, Jianguo Zhou, Hao Jiang, and Yuchuan Deng. A new framework for ddos attack detection and defense in sdn environment. IEEE Access, 8:161908–161919, 2020.
[36] Ivan Cviti´c, Dragan Perakovic, Brij B Gupta, and Kim-Kwang Raymond Choo. Boosting-based ddos detection in internet of things systems. IEEE Internet of Things Journal, 9(3):2109–2123, 2021.
[37] Jieren Cheng, Yifu Liu, Xiangyan Tang, Victor S Sheng, Mengyang Li, and Junqi Li. Ddos attack detection via multi-scale convolutional neural network. Computers, Materials & Continua, 62(3), 2020.
[38] Meng Wang, Yiqin Lu, and Jiancheng Qin. A dynamic mlp-based ddos attack detection method using feature selection and feedback. Computers & Security, 88:101645, 2020.
[39] Omerah Yousuf and Roohie Naaz Mir. Ddos attack detection in internet of things using recurrent neural network. Computers and Electrical Engineering, 101:108034, 2022.
[40] Saif ur Rehman, Mubashir Khaliq, Syed Ibrahim Imtiaz, Aamir Rasool, Muhammad Shafiq, Abdul Rehman Javed, Zunera Jalil, and Ali Kashif Bashir. Diddos: An approach for detection and identification of distributed denial of service(ddos) cyberattacks using gated recurrent units(gru). Future Generation Computer Systems, 118:453–466, 2021.
[41] Xiaoyu Liang and Taieb Znati. A long short-term memory enabled framework for ddos detection. In 2019 IEEE global communications conference(GLOBECOM), pages 1–6. IEEE, 2019.