A Deep Learning Framework Integrating CNN-GRU Architectures for Real-Time DDoS Detection in Multi-Cloud Enterprise Environments

Abstract

Distributed Denial-of-Service (DDoS) attacks continue to rank among the most disruptive and economically damaging threats confronting modern enterprises, and their impact is magnified in multi-cloud deployments where workloads, traffic patterns and trust boundaries are distributed across heterogeneous providers. Conventional signature-based and threshold-driven defences struggle to keep pace with volumetric, protocol and low-rate application-layer attacks because they cannot model the joint spatial and temporal structure of malicious flows. This paper proposes a hybrid deep learning framework that integrates one-dimensional Convolutional Neural Networks (CNN) with Gated Recurrent Units (GRU) for accurate, real-time DDoS detection across multi-cloud enterprise environments. The CNN stage extracts discriminative spatial features from per-flow statistical descriptors, while the stacked GRU stage captures the temporal evolution of traffic so that slow and bursty attacks are recognised with equal reliability. The model is trained and evaluated on the CIC-DDoS2019 benchmark augmented with multi-cloud telemetry, using a rigorously stratified split and a feature-selection pipeline that reduces dimensionality from 80 to 41 attributes. The proposed CNN-GRU classifier attains 99.24% accuracy, 99.18% precision, 99.05% recall, a 99.11% F1-score and a 0.997 ROC-AUC, while sustaining a sub-10 ms inference latency at line rate. It consistently outperforms support vector machines, random forests, standalone 1D-CNN, standalone GRU and a CNN-LSTM baseline. The results demonstrate that the framework is suitable for production-grade, low-latency mitigation pipelines spanning AWS, Microsoft Azure and Google Cloud.