A novel multi-scale CNN and Bi-LSTM arbitration dense network model for low-rate DDoS attack detection

Area of Science:

• Cloud Computing Security
• Network Intrusion Detection
• Machine Learning for Cybersecurity

Background:

• Low-rate distributed denial of service (LDDoS) attacks present significant security risks to cloud computing networks.
• These stealthy attacks degrade network service quality and create data scale challenges.
• Existing detection models struggle with accuracy and time efficiency for LDDoS attacks, especially with limited datasets.

Purpose of the Study:

• To propose a novel model for effectively learning and detecting LDDoS attack behaviors.
• To address the limitations of existing methods in terms of detection accuracy and time consumption.
• To develop a robust solution for identifying stealthy, low-rate attack traffic.

Main Methods:

• A multi-scale Convolutional Neural Networks (CNN) and bidirectional Long-short Term Memory (bi-LSTM) arbitration dense network (MSCBL-ADN) model was developed.
• CNN was utilized for initial spatial feature extraction, complemented by bi-LSTM for temporal relationship analysis.
• An arbitration network was employed to re-weight feature importance, followed by a 2-block dense network for final classification.

Main Results:

• The proposed MSCBL-ADN model demonstrated significant improvements in detection accuracy.
• The model exhibited superior time performance compared to existing state-of-the-art methods.
• Experimental results on the ISCX-2016-SlowDos dataset validated the model's effectiveness.

Conclusions:

• The MSCBL-ADN model offers a highly effective solution for detecting LDDoS attacks in cloud environments.
• The model achieves high accuracy and efficiency, even under conditions of limited data and time constraints.
• This research contributes a valuable advancement in the field of network security and intrusion detection.