A Time-Aware Mutual Information Feature Selection and LGA-Driven Approach for ICMPv6 DDoS Attack Detection

As the IPv6 protocol gains extensive deployment, ICMPv6—its core element in network configuration and route discovery—has emerged as a high-risk target for distributed denial-of-service (DDoS) attacks. Conventional ICMPv6 DDoS detection strategies often fail to balance precision and timeliness when faced with high-dimensional traffic and intricate temporal patterns. In response, we propose a detection framework integrating Time-Aware Mutual Information (TMI) feature selection with an LSTM-GRU-Attention (LGA) hybrid model for ICMPv6 DDoS attacks. By applying TMI within sliding windows, we compute and average the mutual information between features and attack labels, effectively reducing feature dimensionality while preserving temporal correlations. The resulting subset of critical features is then input into the LGA model, which leverages LSTM and GRU in parallel to capture both long-and short-term dependencies, while a self-attention module provides enhanced global context. Our experiments indicate that, relative to conventional feature selection and detection approaches, the proposed method achieves substantial gains in accuracy and F1 score, with a marked decrease in inference delay, thus satisfying the real-time defense requirements in IPv6 network environments.