Using Deep Learning to Detect DDoS Attacks at the Application Layer

Distributed Denial of Service attacks targeting the application layer are recognized as some of the most challenging to identify and least visible forms of cyber threats. These attacks specifically target HTTP/HTTPS protocols with the intent of restricting access to web application resources, and they encompass various forms such as “Low attacks,” “Slow attacks,” and “GET/POST floods.” By exploiting weaknesses within web applications, these attacks can result in severe service interruptions and substantial financial repercussions. This article discusses the application of artificial intelligence for the preliminary detection of such attacks, employing a hybrid model that integrates both Machine Learning and Deep Learning techniques. Conventional detection methods frequently fall short in identifying these sophisticated and covert attacks. To tackle this issue, the study introduces a hybrid AI framework that merges Isolation Forest with Convolutional Neural Networks to effectively identify and counteract application-layer Distributed Denial of Service(DDoS) attacks. Isolation Forest is utilized for anomaly detection in network traffic, while Convolutional Neural Networks enhances the model's capacity to discern intricate patterns within high-dimensional datasets. The proposed model underwent training and evaluation using a real-world network traffic dataset, achieving an impressive accuracy rate of <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{9 8. 5 \%}$</tex> in identifying malicious traffic. This methodology not only enhances the detection rate but also minimizes false positives, thereby providing a robust defense mechanism for safeguarding web applications against Distributed Denial of Service attacks. The findings underscore the promise of hybrid Artificial intelligence models in enhancing cybersecurity strategies and establish a foundation for future investigations in this domain.