IMPROVED DDOS ATTACK DETECTION-BASED FEATURE SELECTION BY USING GRAPH CONVOLUTIONAL NETWORK-TRANSFORMER MODEL

The distributed denial of service (DDoS) attack is a major cyber threat because it overwhelms critical systems with a deluge of harmful data. Abstract Many problems plague traditional intrusion detection systems, including computational inefficiency, a high incidence of false alarms, and an inability to react to new multi-vector threats. An improved technique for extracting spatial and temporal characteristics from network data utilizing Graph Convolutional Networks (GCNs) and Transformer topologies is introduced in this study as a novel hybrid detection approach. Using self-attention, transformers may probe sequential dependencies, as opposed to GCNs that learn structural correlations between flows. By analyzing the characteristics of only the first packet, this method guarantees rapid detection while reducing storage cost, in contrast to session-oriented alternative. The tests used three benchmark datasets: UNSW-NB15, CICDDoS2019, and CICIDS 2017. Conversely, the proposed model achieved 89.52%, 97.51%, and 98.95% accuracy rates separately. The results demonstrate its greater adaptability, practicality for real-time deployment, and ability to minimize hinge losses, which helps to reduce overfitting. According to the results, the models achieve better accuracy, recall, and F1-scores than the ML and DL models that are presently available in the literature, particularly for more recent datasets such as CICDDoS2019. These are the three primary benefits that this study provides: first, a GCN-Transformer framework that is capable of representing both spatial and temporal characteristics effectively; second, a way to discover and enhance features by means of graph-wise clustering and attention processes; and third, a generalizability that has been evaluated on many datasets. Present intrusion detection systems may be improved, according to the results, by integrating graph learning and sequence modeling. In the future, the model will include more business cybersecurity tasks and be tested in actual firm environments to see how well it performs.