Optimizing a Hybrid Deep Learning Model for DDoS Detection Using DBSCAN and PSO
DOI:
https://doi.org/10.29207/resti.v9i6.6383Keywords:
attack detection, DBSCAN, DdoS, hybrid deep learning, PSOAbstract
This study proposes a hybrid deep learning approach that combines Gated Recurrent Units (GRUs) and Convolutional Neural Networks (CNNs) for Distributed Denial of Service (DDoS) cyberattack detection. The model, called DBSCAN–GRU–CNN, uses density-based clustering (DBSCAN) to select relevant features and reduce execution time. The dataset for this study was obtained from live penetration testing, where a series of simulated attacks was performed on a monitored network. To evaluate the performance of the proposed model, several comparison models were used, including DBSCAN–GRU–CNN (Single Hidden Layer), DBSCAN–GRU–CNN (Double Hidden Layers), DBSCAN–GRU–CNN (With Regularization), DBSCAN–GRU–CNN–PSO, GRU–CNN, GRU–CNN (With Hyperparameter Tuning), and Random Forest (Tuned Model). Variations of the model tested were made by adding hidden layers, regularization, optimization with Particle Swarm Optimization (PSO), and hyperparameter tuning. Experimental results show that the DBSCAN–GRU–CNN–PSO model provided optimal performance with a 99.3% accuracy, a 99% precision, a 98.9% recall, and a 99% F1-score, while the model with hyperparameter tuning achieved a 99% accuracy. By adding PSO, the model achieved optimized weights, better generalization, and excellent accuracy in DDoS detection.
Downloads
References
R. Efendi, T. Wahyono, and I. R. Widiasari, “DBSCAN SMOTE LSTM: Effective Strategies for Distributed Denial of Service Detection in Imbalanced Network Environments,” Big Data and Cognitive Computing, vol. 8, no. 9, p. 118, Sep. 2024, doi: 10.3390/bdcc8090118.
F. Salatino, M. G. Spina, M. Tropea, and F. De Rango, “Detecting DDoS Attacks Through AI driven SDN Intrusion Detection System,” in 2024 IEEE 21st Consumer Communications & Networking Conference (CCNC), IEEE, Jan. 2024, pp. 990–993. doi: 10.1109/CCNC51664.2024.10454798.
J. Mirkovic and P. Reiher, “A taxonomy of DDoS attack and DDoS defense mechanisms,” ACM SIGCOMM Computer Communication Review, vol. 34, no. 2, pp. 39–53, Apr. 2004, doi: 10.1145/997150.997156.
S. Wang, K. Gomez, K. Sithamparanathan, M. R. Asghar, G. Russello, and P. Zanna, “Mitigating DDoS Attacks in SDN-Based IoT Networks Leveraging Secure Control and Data Plane Algorithm,” Applied Sciences, vol. 11, no. 3, p. 929, Jan. 2021, doi: 10.3390/app11030929.
Y. Cui et al., “Towards DDoS detection mechanisms in Software-Defined Networking,” Journal of Network and Computer Applications, vol. 190, p. 103156, Sep. 2021, doi: 10.1016/j.jnca.2021.103156.
T. E. Ali, Y.-W. Chong, and S. Manickam, “Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review,” Applied Sciences, vol. 13, no. 5, p. 3183, Mar. 2023, doi: 10.3390/app13053183.
J. Zupan, “Introduction to Artificial Neural Network (ANN) Methods: What They Are and How to Use Them,” Acta Chim Slov, vol. 41, Jan. 1994.
M. G. Gaber, M. Ahmed, and H. Janicke, “Malware Detection with Artificial Intelligence: A Systematic Literature Review,” ACM Comput Surv, vol. 56, no. 6, pp. 1–33, Jun. 2024, doi: 10.1145/3638552.
R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, and S. Venkatraman, “Robust Intelligent Malware Detection Using Deep Learning,” IEEE Access, vol. 7, pp. 46717–46738, 2019, doi: 10.1109/ACCESS.2019.2906934.
O. Aslan and A. A. Yilmaz, “A New Malware Classification Framework Based on Deep Learning Algorithms,” IEEE Access, vol. 9, pp. 87936–87951, 2021, doi: 10.1109/ACCESS.2021.3089586.
M. Gupta, C. Akiri, K. Aryal, E. Parker, and L. Praharaj, “From ChatGPT to ThreatGPT: Impact of Generative AI in Cybersecurity and Privacy,” IEEE Access, vol. 11, pp. 80218–80245, 2023, doi: 10.1109/ACCESS.2023.3300381.
R. Verma, M. Jailia, M. Kumar, and B. Kaliraman, “CNN-Based Detection of DDoS Attacks in Multi-Cloud Environments,” in 2024 International Conference on Communication, Computer Sciences and Engineering (IC3SE), IEEE, May 2024, pp. 1011–1016. doi: 10.1109/IC3SE62002.2024.10593351.
E. Aydin and S. Bahtiyar, “OCIDS: An Online CNN-Based Network Intrusion Detection System for DDoS Attacks with IoT Botnets,” in 2021 14th International Conference on Security of Information and Networks (SIN), IEEE, Dec. 2021, pp. 1–8. doi: 10.1109/SIN54109.2021.9699288.
T. Dhirta and A. Sharma, “Unveiling the Effectiveness of CNN-based Models for Multiclass DDoS Attack Detection and Classification: A Comparative Analysis,” in 2023 International Conference on Data Science, Agents & Artificial Intelligence (ICDSAAI), IEEE, Dec. 2023, pp. 1–8. doi: 10.1109/ICDSAAI59313.2023.10452429.
P. C et al., “1D CNN Based Model for Detection of DDoS Attack,” in 2024 2nd International Conference on Device Intelligence, Computing and Communication Technologies (DICCT), IEEE, Mar. 2024, pp. 1–6. doi: 10.1109/DICCT61038.2024.10533005.
I. Ahmad, M. Imran, A. Qayyum, M. S. Ramzan, and M. O. Alassafi, “An Optimized Hybrid Deep Intrusion Detection Model (HD-IDM) for Enhancing Network Security,” Mathematics, vol. 11, no. 21, p. 4501, Oct. 2023, doi: 10.3390/math11214501.
A. Casolaro, V. Capone, G. Iannuzzo, and F. Camastra, “Deep Learning for Time Series Forecasting: Advances and Open Problems,” Information, vol. 14, no. 11, p. 598, Nov. 2023, doi: 10.3390/info14110598.
N. Li, H. Sheng, P. Wang, Y. Jia, Z. Yang, and Z. Jin, “Modeling Categorized Truck Arrivals at Ports: Big Data for Traffic Prediction,” IEEE Transactions on Intelligent Transportation Systems, vol. 24, no. 3, pp. 2772–2788, Mar. 2023, doi: 10.1109/TITS.2022.3219882.
A. Shewalkar, D. Nyavanandi, and S. A. Ludwig, “Performance Evaluation of Deep Neural Networks Applied to Speech Recognition: RNN, LSTM and GRU,” Journal of Artificial Intelligence and Soft Computing Research, vol. 9, no. 4, pp. 235–245, Oct. 2019, doi: 10.2478/jaiscr-2019-0006.
A. Casolaro, V. Capone, G. Iannuzzo, and F. Camastra, “Deep Learning for Time Series Forecasting: Advances and Open Problems,” Information, vol. 14, no. 11, p. 598, Nov. 2023, doi: 10.3390/info14110598.
W. Shu, K. Cai, and N. N. Xiong, “A Short-Term Traffic Flow Prediction Model Based on an Improved Gate Recurrent Unit Neural Network,” IEEE Transactions on Intelligent Transportation Systems, vol. 23, no. 9, pp. 16654–16665, Sep. 2022, doi: 10.1109/TITS.2021.3094659.
J. Wojtkiewicz, M. Hosseini, R. Gottumukkala, and T. L. Chambers, “Hour-Ahead Solar Irradiance Forecasting Using Multivariate Gated Recurrent Units,” Energies (Basel), vol. 12, no. 21, p. 4055, Oct. 2019, doi: 10.3390/en12214055.
X.-B. Jin, X.-H. Yu, X.-Y. Wang, Y.-T. Bai, T.-L. Su, and J.-L. Kong, “Deep Learning Predictor for Sustainable Precision Agriculture Based on Internet of Things System,” Sustainability, vol. 12, no. 4, p. 1433, Feb. 2020, doi: 10.3390/su12041433.
F. R. Alharbi and D. Csala, “Short-Term Wind Speed and Temperature Forecasting Model Based on Gated Recurrent Unit Neural Networks,” in 2021 3rd Global Power, Energy and Communication Conference (GPECOM), IEEE, Oct. 2021, pp. 142–147. doi: 10.1109/GPECOM52585.2021.9587479.
J. Zang et al., “Prediction Model of Carbon Dioxide Concentration in Pig House Based on Deep Learning,” Atmosphere (Basel), vol. 13, no. 7, p. 1130, Jul. 2022, doi: 10.3390/atmos13071130.
A. Yildirim, M. Bilgili, and A. Ozbek, “One-hour-ahead solar radiation forecasting by MLP, LSTM, and ANFIS approaches,” Meteorology and Atmospheric Physics, vol. 135, no. 1, p. 10, Feb. 2023, doi: 10.1007/s00703-022-00946-x.
N. H. Saadoon Al-Sarray, A. Demirhan, and J. Rahebi, “Detection of distributed denial-of-service (DDoS) attacks with crow search optimization algorithm and artificial neural network,” IET Conference Proceedings, vol. 2024, no. 23, pp. 193–198, Jan. 2025, doi: 10.1049/icp.2024.4423.
S. O. Al-mamory and Z. M. Algelal, “A modified DBSCAN clustering algorithm for proactive detection of DDoS attacks,” in 2017 Annual Conference on New Trends in Information & Communications Technology Applications (NTICT), IEEE, Mar. 2017, pp. 304–309. doi: 10.1109/NTICT.2017.7976107.
A. Girma, M. Garuba, and R. Goel, “Advanced Machine Language Approach to Detect DDoS Attack Using DBSCAN Clustering Technology with Entropy,” 2018, pp. 125–131. doi: 10.1007/978-3-319-54978-1_17.
M. Alduailij, Q. W. Khan, M. Tahir, M. Sardaraz, M. Alduailij, and F. Malik, “Machine-Learning-Based DDoS Attack Detection Using Mutual Information and Random Forest Feature Importance Method,” Symmetry (Basel), vol. 14, no. 6, p. 1095, May 2022, doi: 10.3390/sym14061095.
S. Raza, L. Wallgren, and T. Voigt, “SVELTE: Real-time intrusion detection in the Internet of Things,” Ad Hoc Networks, vol. 11, no. 8, pp. 2661–2674, Nov. 2013, doi: 10.1016/j.adhoc.2013.04.014.
P. Kasinathan, C. Pastrone, M. A. Spirito, and M. Vinkovits, “Denial-of-Service detection in 6LoWPAN based Internet of Things,” in 2013 IEEE 9th International Conference on Wireless and Mobile Computing, Networking and Communications (WiMob), IEEE, Oct. 2013, pp. 600–607. doi: 10.1109/WiMOB.2013.6673419.
C. Cervantes, D. Poplade, M. Nogueira, and A. Santos, “Detection of sinkhole attacks for supporting secure routing on 6LoWPAN for Internet of Things,” in 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM), IEEE, May 2015, pp. 606–611. doi: 10.1109/INM.2015.7140344.
D. Midi, A. Rullo, A. Mudgerikar, and E. Bertino, “Kalis — A System for Knowledge-Driven Adaptable Intrusion Detection for the Internet of Things,” in 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), IEEE, Jun. 2017, pp. 656–666. doi: 10.1109/ICDCS.2017.104.
V. Sharma, I. You, K. Yim, I.-R. Chen, and J.-H. Cho, “BRIoT: Behavior Rule Specification-Based Misbehavior Detection for IoT-Embedded Cyber-Physical Systems,” IEEE Access, vol. 7, pp. 118556–118580, 2019, doi: 10.1109/ACCESS.2019.2917135.
B. Xu, L. Sun, X. Mao, R. Ding, and C. Liu, “IoT Intrusion Detection System Based on Machine Learning,” Electronics (Basel), vol. 12, no. 20, p. 4289, Oct. 2023, doi: 10.3390/electronics12204289.
S. Vanitha and P. Balasubramanie, “Improved Ant Colony Optimization and Machine Learning Based Ensemble Intrusion Detection Model,” Intelligent Automation & Soft Computing, vol. 36, no. 1, pp. 849–864, 2023, doi: 10.32604/iasc.2023.032324.
F. Rehman, F. Mushtaq, and H. Zaman, “A Host-based Intrusion Detection: Using Signature-based and AI-driven Anomaly Detection for Enhanced Cybersecurity*,” in 2024 4th International Conference on Digital Futures and Transformative Technologies (ICoDT2), IEEE, Oct. 2024, pp. 1–7. doi: 10.1109/ICoDT262145.2024.10740248.
A. Hussain, E. Marín Tordera, X. Masip-Bruin, and H. C. Leligou, “Rule-Based With Machine Learning IDS for DDoS Attack Detection in Cyber-Physical Production Systems (CPPS),” IEEE Access, vol. 12, pp. 114894–114911, 2024, doi: 10.1109/ACCESS.2024.3445261.
N. Ahuja, G. Singal, D. Mukhopadhyay, and N. Kumar, “Automated DDOS attack detection in software defined networking,” Journal of Network and Computer Applications, vol. 187, p. 103108, Aug. 2021, doi: 10.1016/j.jnca.2021.103108.
Downloads
Published
Issue
Section
License
Copyright in each article belongs to the author
- The author acknowledges that the RESTI Journal (System Engineering and Information Technology) is the first publisher to publish with a license Creative Commons Attribution 4.0 International License.
- Authors can enter writing separately, arrange the non-exclusive distribution of manuscripts that have been published in this journal into other versions (eg sent to the author's institutional repository, publication in a book, etc.), by acknowledging that the manuscript has been published for the first time in the RESTI (Rekayasa Sistem dan Teknologi Informasi) journal ;
