DDoS attack detection using CNN-BiLSTM with attention mechanism

In today’s interconnected world, nearly every aspect of modern life relies on internet-based services. However, the widespread adoption of these services has led to a significant increase in cyberattacks, particularly Distributed Denial of Service (DDoS) attacks—which pose a major threat to the stability of critical infrastructure. Therefore, timely and accurate detection of DDoS attacks is essential for cybersecurity. Although deep learning has shown promise in intrusion detection, existing systems often struggle with multiclass DDoS classification, class imbalance, and adaptability to evolving traffic patterns—especially in resource-constrained IoT and IIoT environments. To address these challenges, this study proposes a novel lightweight hybrid deep learning model that integrates Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (BiLSTM) networks, and an attention mechanism to enhance feature extraction and improve classification performance. The model is evaluated on two benchmark datasets, CICDDoS2019 and Edge-IIoT, achieving classification accuracies of 99.78% and 98.84%, and ROC-AUC scores of 100% and 99.98%, respectively. Comparative analysis with baseline models and prior studies highlights the model’s robustness, efficiency, and suitability for real-time deployment in diverse and constrained environments.