Enhanced Detection and Classification Models for Distributed Denial-of-Service Using Time-Based Features in Cybersecurity - Yusuf T. BAFFA; Muhammad Y. MUHAMMAD; Aliyu SHUAIBU (FUDMA Journal of Engineering and Technology, 2025)
Distributed Denial-of-Service (DDoS) attacks continue to pose a critical threat to network infrastructure, necessitating robust, advanced and efficient detection systems. This study explores the application of deep learning (DL) models, specifically DNN, DCNN, CNN-LSTM, and CNN-BiLSTM, into intrusion detection systems (IDS) to enhance their ability to detect and classify diverse DDoS attacks. Utilizing the CICDDoS2019 dataset, a comprehensive pre-processing pipeline was applied, including feature elimination, duplicate and zero-value removal and downsampling to address class imbalance. The dataset was partitioned into binary and multiclass tasks, and two feature sets were analysed: a 70-feature baseline set and a 25-feature time-based set. Experiments were conducted across three scenarios: binary classification (DDoS vs. benign), 12-class attack detection, and 13-class classification (attacks + benign). Key findings demonstrate the integration of time-based features significantly enhanced detection precision for stealthy, low-rate attacks such as UDPLag (F1 = 0.99%), detection recall from 0.9965 to 0.9998 and effectively resolved false positives for attacks like Portmap. CNN-BiLSTM showed superior performance in capturing temporal dependencies, particularly for time-sensitive attacks, achieving 0.99% F1-score (13-class) with 20% FP reduction for UDPLag due to its bidirectional processing capability. The study underscores the importance of temporal feature engineering and the superiority of hybrid deep learning models for robust and scalable DDoS intrusion detection. The findings contribute to advancing deep learning-based IDS frameworks, ensuring improved resilience against evolving cyber threats.