Optimized Hybrid IDS Using HBA, LightGBM, and LSTM for DDoS Attack Detection

Abstract

The rapid growth of digital networks has made online platforms more vulnerable to Distributed Denial ofService (DDoS) attacks. These attacks can cause serious service interruptions and performance degradation. TraditionalIntrusion Detection Systems (IDSs) often struggle with poor detection accuracy, frequent false alerts, and delays inrecognizing ongoing attacks. This study proposes an improved hybrid IDS that uses the Honey Badger Algorithm(HBA) to choose essential traffic features, Light Gradient Boosting Machine (LightGBM) for accurate and fastclassification, and Long Short-Term Memory (LSTM) networks to analyze time-based traffic patterns. The system wastested with the CICDDoS2019 dataset using 10-fold cross-validation. To ensure generalization and robustness, theproposed IDS was further validated on the NSL-KDD dataset. Comparative analysis demonstrates superior detectionaccuracy, faster convergence, and reduced false positive rates compared to traditional and recent hybrid IDS models.The study emphasizes novelty, includes multiple dataset evaluations, and presents ablation testing to demonstratereliability. Results show that the model achieves more than 98% detection accuracy with a low false positive rate andquick processing time. Hence the proposed IDS provides a scalable and real-time-capable framework for modern DDoSdetection across diverse network environments.