Feature-Enhanced Detection of DDoS Attacks in Network Traffic Using LSTM and ARIMA Models

Abstract

Distributed Denial of Service (DDoS) attacks pose a significant threat to network availability, necessitating robust detection mechanisms. This paper investigates the efficacy of Long Short-Term Memory (LSTM) networks and Autoregressive Integrated Moving Average (ARIMA) models for distinguishing between benign and malicious DDoS traffic. Using the comprehensive CIC-IDS 2017 dataset, this study aims to evaluate and compare the predictive performance of these distinct modeling approaches. Our methodology involved preprocessing the CIC-IDS 2017 dataset, extracting relevant features, and performing feature engineering to create new, informative features for time-series analysis and classification. An LSTM neural network was meticulously designed and trained to capture intricate temporal patterns and dependencies in network traffic flows. Concurrently, an ARIMA model was developed to provide a statistical baseline, focusing on its capacity to model linear relationships. Experimental results demonstrated a significant performance disparity. The LSTM model achieved a remarkable accuracy of 99% in identifying DDoS attacks, showcasing its superior capability in discerning subtle anomalies. In contrast, the ARIMA model yielded an accuracy of 89%. This difference underscores the advantages of LSTM networks; their recurrent architecture excels at recognizing and learning from non-linear relationships and long-term dependencies prevalent in dynamic network traffic. While traditional statistical methods like ARIMA capture some temporal aspects, they are less adept at modeling complex, evolving cyber threats. This research highlights deep learning approaches, specifically LSTMs, as crucial for enhancing the precision and reliability of real-time DDoS attack detection, offering a more resilient defense against contemporary cyber threats.