Detection of UDP-Based Volumetric DDoS Attacks in IoT Environments Using LSTM with Temporal Attention Mechanism

Internet of Things (IoT) environments, similarly to traditional network infrastructures, are highly vulnerable to volumetric Distributed Denial of Service (DDoS) attacks. Detecting such attacks remains challenging due to their bursty and short-lived nature, particularly in User Datagram Protocol (UDP) flood traffic, which often blends into normal traffic fluctuations. Conventional deep learning (DL) approaches, particularly Long Short-Term Memory (LSTM) networks, assign uniform importance to all time steps, limiting their ability to capture temporally localized burst patterns critical for identifying UDP-based volumetric attacks. To address this limitation, this study proposes LSTM-IoT, an attention-enhanced intrusion detection framework that integrates a temporal attention mechanism into an LSTM architecture. The model selectively emphasizes informative time intervals while suppressing irrelevant temporal segments, improving discrimination between benign and attack traffic. Evaluated on UDP traffic flows from the CICDDoS2019 dataset, LSTM-IoT achieves a detection accuracy of 99.93%, outperforming a baseline LSTM model. The results confirm that the proposed DL-based model effectively detects UDP-based volumetric DDoS attacks in IoT environments.