Aug 2026· Concurrency and Computation· Vol 38· 0 citations· 13 references
TL;DR
Experimental results demonstrate that the proposed approach can detect low‐intensity IPv6 DDoS attacks with high accuracy and ROC‐AUC values, and protocol‐based multi‐class analyses reveal that the model can meaningfully distinguish between TCP, UDP, and ICMP‐based attacks.
Abstract
With the widespread adoption of IPv6 network infrastructures, the early detection of Distributed Denial of Service (DDoS) attacks has become increasingly critical for network security. Particularly in low‐intensity attack scenarios, the fact that attack traffic is largely embedded within normal network traffic limits the effectiveness of traditional detection methods. This study proposes a deep learning‐based approach for early‐stage DDoS attack detection in IPv6 environments. In the proposed method, 100 × 256 traffic matrices obtained from raw IPv6 packets and created over sequential 100‐packet windows are used. These matrices are modeled using a Convolutional Neural Network (CNN) architecture enhanced with an attention mechanism (Convolutional Block Attention Module—CBAM). The training process was carried out using a curriculum learning strategy, in which the attack intensity was gradually reduced from 15% to 1%. The ablation analyses performed reveal that the effectiveness of the attention mechanism increases significantly when used in conjunction with the gradual learning strategy. Experimental results demonstrate that the proposed approach can detect low‐intensity IPv6 DDoS attacks with high accuracy and ROC‐AUC values. Furthermore, protocol‐based multi‐class analyses reveal that the model can meaningfully distinguish between TCP, UDP, and ICMP‐based attacks. Practically, the proposed approach offers a viable solution for early warning systems, network monitoring platforms, and automatic attack prevention mechanisms in IPv6‐based networks.
Comparative evaluation against existing machine learning and deep learning approaches indicates that the proposed framework achieves competitive accuracy while maintaining deployment-oriented processing speeds, suggesting that the CNN-GRU model is well-suited for SDN security monitoring under controlled experimental conditions.
Victor Anaga, B. Stephen, E. Adediji et al.· E3S Web of Conferences· 0 citations
Distributed Denial of Service (DDoS) attacks remain one of the most serious threats to modern network infrastructures, as they overwhelm systems with massive traffic and disrupt legitimate services. Traditional intrusion detection systems often struggle to detect complex and evolving attack patterns due to their reliance on manual feature engineering and limited learning capability. To address this issue, this study proposes a hybrid deep learning model that integrates Convolutional Neural Networks (CNN) and Bidirectional Gated Recurrent Units (BiGRU) for efficient DDoS attack detection. The CNN component is used to automatically extract important spatial features from network traffic data, while the BiGRU layer captures temporal dependencies and sequential patterns in the traffic flows. The proposed model is evaluated using the CICDDoS2019 dataset, which contains realistic benign and attack traffic across multiple DDoS categories. Experimental results demonstrate that the model achieves high performance in both binary and multiclass classification tasks, obtaining an accuracy of 99.82% for binary detection and 99.21% for multiclass classification. The results indicate that the hybrid CNN–BiGRU architecture effectively improves detection accuracy and provides a reliable approach for intelligent network intrusion detection systems.
Unknown authors· International journal of com...· 0 citations
A deep learning-based intrusion detection framework that utilizes flow-level statistical features and a hybrid Convolutional Neural Network–Bidirectional Long Short-Term Memory (CNN–BiLSTM) architecture to capture both spatial and temporal characteristics of network traffic is proposed.
H. Hussein, Saad Raad, A. Qasim· Al-Noor Journal of Engineeri...· 0 citations
The increasing development of the Internet of Things has led to several security threats and vulnerabilities associated with interconnected networks and, thus, makes them suitable targets for DDoS attacks. The increased dimensionality of traffic in the context of the Internet of Things makes IDS hard because deep learning models running independently are unable to adequately address the complexity associated with the interaction between network attributes. In this context, this research suggests a new architecture based on deep learning methods for binary classifications and featuring hybridization of multi-layer 1D-CNNs with LSTM networks. To reduce computational resources needed for training on IoT-based datasets, the ANOVA F-test is implemented to choose the key features before training. The proposed architecture includes dual convolutional layers having 64 and 128 filters, respectively, that allow to analyze the hierarchical spatial structures. Next, the data from convolutional layers is passed to the LSTM layer that analyzes high-order structural dependencies within feature maps generated at earlier stages. The proposed model was trained using the CICIoT2023 benchmark and showed superior performance compared to a standalone architecture featuring either CNNs or LSTM networks. Across five independent trials, the model achieved a mean accuracy of 98.72% ± 0.06%, with a precision of 98.91% and a recall of 98.65%. Furthermore, the proposed hybrid architecture shows high computational efficiency, achieving a remarkably low inference time of 0.15 ms per sample and a compact model footprint of 0.30 MB. These metrics confirm the model's suitability for deployment on resource-constrained IoT edge devices, providing a robust balance between high detection accuracy and low architectural complexity. These findings confirm that the constructive collaboration between spatial and structural feature modeling provides a robust, stable, and scalable solution for mitigating DDoS threats in modern IoT ecosystems.
Vinaykumar N Soni, A. Jha· International Journal of Ele...· 0 citations
A Hybrid Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM) model for effective IoT malware detection is proposed, which enhances detection capability for both known and zero-day attacks.
