Comparative Evaluation of LSTM, BiLSTM, CNN-LSTM, Random Forest, and XGBoost for Detection of Distributed Denial of Service (DDoS) Attacks Using the CICDDoS2019 Dataset
TL;DR
The results confirm that temporal deep learning architectures substantially outperform classical ML models in detecting multi-class DDoS patterns, with the performance gap being most pronounced for low-frequency and easily confused attack classes such as DRDOS_LDAP, DRDOS_MSSQL, and UDP-LAG.
Abstract
Distributed Denial of Service (DDoS) attacks continue to pose a severe and escalating threat to networked digital infrastructure, with global attack volumes rising by over 53% in 2024 alone. While machine learning approaches have demonstrated improved detection performance over traditional rule-based systems, many existing models treat network traffic samples as independent observations and fail to capture the temporal dependencies that characterise real-world DDoS behaviour. This study addresses this gap by developing and evaluating an LSTM-based deep learning model for DDoS attack detection and comparing it against Bidirectional LSTM (BiLSTM), CNN-LSTM, Random Forest, and XGBoost models using the publicly available CICDDoS2019 dataset. The task is formulated as a 19-class problem: BENIGN traffic plus 18 distinct DDoS attack labels present in the dataset, including reflection-based (DrDoS) and exploitation-based attack variants. The study employs a methodologically rigorous, leakage-free pipeline that preserves the natural class imbalance for two low-frequency attack types while applying stratified per-class sampling, post-split mutual information feature selection, Min-Max normalisation fitted on training data only, and chronological sliding-window reshaping into time-step tensors. Experimental results show that LSTM achieves a weighted F1-score of 0.847 and a macro one-vs-rest ROC-AUC of 0.992, outperforming BiLSTM (F1: 0.832, AUC: 0.992) and CNN-LSTM (F1: 0.840, AUC: 0.992), while Random Forest and XGBoost trail by 25–30 percentage points (F1: 0.552 and 0.549, respectively). The results confirm that temporal deep learning architectures substantially outperform classical ML models in detecting multi-class DDoS patterns, with the performance gap being most pronounced for low-frequency and easily confused attack classes such as DRDOS_LDAP, DRDOS_MSSQL, and UDP-LAG. The study produces a benchmark other researchers can reproduce, and it gives practical grounds for deploying LSTM detection where budgets are tight. An LSTM trained under a leakage-free pipeline is realistic for Tanzanian public institutions and e-Government platforms to run.