ShallowNet: A Lightweight Neural Network Approach for Efficient Flow-Level DDoS Detection

Abstract

Distributed Denial-of-Service (DDoS) attacks across cloud, edge, and Internet-of-Things infrastructures have intensified the need for detectors that are accurate, computationally efficient, and deployable at resource-constrained monitoring points. Much of the intrusion-detection literature implicitly links detection quality to architectural depth, larger parameter spaces, and richer learned representations. This paper examines a narrower hypothesis: for binary flow-level DDoS detection, a carefully engineered shallow pipeline can retain high detection quality while maintaining a compact computational footprint. We propose ShallowNet, a single-hidden-layer neural detector integrated with leakage-aware data partitioning, training-only normalization, principled feature selection, class-imbalance-aware optimization, early stopping, and calibration-guided threshold selection. The evaluation extends beyond standard held-out accuracy by incorporating cross-day temporal transfer, leave-one-attack-family-out robustness testing, controlled baseline comparison, systematic pipeline ablation, and probability-calibration analysis. The results show both the empirical utility and the limits of the approach: class concentration in widely used benchmark datasets can make aggregate metrics overly optimistic, and generalization degrades most sharply when the test traffic contains attack signatures absent from training. These findings suggest that, in lightweight binary flow-level DDoS detection, disciplined pipeline design can be as important as model depth and that stress-tested evaluation should accompany high benchmark accuracy claims.