Feature-guided transformer approach for detecting distributed denial of service attacks
TL;DR
A transformer-based classifier for DDoS detection on the CIC-DDoS2019 dataset demonstrates stable convergence and generalization across folds, highlighting the strength of attention mechanisms in capturing feature dependencies, while also pointing to future directions such as real-time deployment, explainability, and resilience to zero-day attacks.
Abstract
Distributed denial of service (DDoS) attacks continues to pose serious risks to modern networks, with their growing intensity making early detection both critical and challenging. Conventional machine learning (ML) models often struggle with the nonlinear and highly dynamic nature of attack traffic, which motivates the use of advanced architectures. In this study investigate a transformer-based classifier for DDoS detection on the CIC-DDoS2019 dataset. The workflow included preprocessing, feature scaling, and domain-guided feature selection. Logistic regression (LR) was employed as a baseline, achieving 92.1% accuracy and F1-score of 0.90, thereby revealing the limitations of linear models. The transformer, after hyperparameter tuning and 5-fold cross-validation, reached an average accuracy of 99.95% with precision, recall, and F1-scores all above 99.9%. The model demonstrated stable convergence and generalization across folds. These results highlight the strength of attention mechanisms in capturing feature dependencies, while also pointing to future directions such as real-time deployment, explainability, and resilience to zero-day attacks.