Learning to Detect: An Enhanced DNN Model with Adaptive Attention for Classifying DDoS Traffic

This research proposes an enhanced Deep Neural Network (DNN) model for detecting Distributed Denial of Service (DDoS) attacks using the CIC-IDS2017 dataset. The model incorporates a Adaptive Attention Layer (AAL) and data normalization to improve feature relevance and classification accuracy. Experiments were conducted across three feature sets (78, 39, and 25), multiple dataset sizes (4K, 40K, 225K), and a range of classification thresholds (0.1 to 1.0). Results demonstrate that optimal accuracy is consistently achieved at thresholds between 0.2 and 0.4. The study confirms a positive correlation between increased feature and dataset sizes and improved detection accuracy—especially when combined with AAL and normalization. The adaptive layer significantly enhances model performance by focusing on the most informative features and reducing both false positives and false negatives. The proposed model achieved a maximum accuracy of 99.93%, outperforming several benchmark methods. These findings underscore the value of attention-based deep learning approaches in developing robust, scalable, and real-time intrusion detection systems for cybersecurity applications.