Developing a Neural Network Model Using SERLU Function to Detect Low-Rate DDoS Attacks

With the great development of cyber-attacks, low-rate distributed denial of service attacks has become a real threat to networks, cloud computing, and systems. The difficulty of this type of attack is its ability to hide, as it sends traffic similar to normal network traffic, which makes it difficult to distinguish and detect it using traditional detection methods. Attackers focus on reducing the quality of service instead of disrupting it, as is the case with high-rate distributed denial of service attacks, by sending traffic at a low rate to ensure that the attack continues for a more extended period without detection. Therefore, this paper proposes an improved detection method based on neural networks with a new activation function, smooth exponential rectified linear unit, to detect low-rate distributed denial of service attacks accurately. The proposed activation function smooth exponential rectified linear unit is an improved version of the traditional rectified linear unit, where the negative inputs are treated through an exponential function instead of converting it to 0 as in the rectified linear unit, which makes the neural network able to learn from abnormal patterns and increase the accuracy of attack detection. The proposed model was implemented and evaluated using a widely used dataset, which is the low-rate distributed denial of service (MQTT) dataset, and the accuracy results of the smooth exponential rectified linear unit-based model reached 0.99, while the accuracy results of the rectified linear unit-based model were 0.96, which is an indication of the effectiveness of the proposed function to classify low-rate distributed denial of service attacks more accurately.