A new DDoS attack detection model based on improved stacked autoencoder and gated recurrent unit for software defined network

Abstract With the widespread adoption of Software Defined Networking (SDN), detecting Distributed Denial of Service (DDoS) attacks has become an urgent challenge in SDN maintenance and Security. Given the diversity of DDoS attack types, we face significant challenges. This paper proposes a model called ARSAE-QGRU, which is based on integrating attention mechanisms and residual connections within a stacked autoencoder for DDoS attack detection. By introducing attention mechanisms and residual connections into the stacked autoencoder (SAE), the model effectively conveys more valuable information and facilitates gradient propagation, allowing it to learn low-dimensional representations better. It also combines the learned low-dimensional representations with traffic features to generate data for DDoS attack training. Furthermore, incorporating Gated Recurrent Unit aids in a more in-depth understanding of the temporal characteristics of traffic data, resulting in improved detection accuracy. This model demonstrates outstanding performance on the CICDDoS2019 and CICIDS2017 datasets, achieving accuracy rates of 97.2% and 97.9%, respectively. Moreover, when applied to datasets in SDN environments, it reaches an even higher accuracy rate of 99.8%. This research provides a reliable solution for high-dimensional data processing and DDoS attack detection within SDN, addressing the urgent challenges in these domains.