LIDS: A Novel Lightweight Intrusion Detection System for DDoS Attacks

ABSTRACT In this study, we introduce, a novel Lightweight Intrusion Detection System (LIDS) specifically designed to address this critical trade‐off between detection performance and computational efficiency. LIDS is designed for ultra‐low‐latency DDoS detection and distinguishes itself through a unique three‐stage architecture. The pipeline begins with Principal Component Analysis (PCA)‐based feature reduction to mitigate the curse of dimensionality, extract the most informative features from network traffic data, and reduce the input complexity for the classifier. Each inference in an LIDS operates on a single network packet represented by its extracted flow‐level features, enabling real‐time, per‐packet decision‐making with ultra‐low latency. This is followed by a weighted sampling technique to effectively handle the severe class imbalance typically present in network security datasets, preventing the model from being biased towards benign traffic. Finally, a lightweight model was fitted with minimal parameters for attack detection. We conducted a comprehensive evaluation of the LIDS on three diverse benchmark datasets: CICDDoS2019, TON_IoT, and BoT‐IoT, and evaluated its performance on both binary (attack vs. benign) and multi‐class (specific attack type) classification tasks. The LIDS consistently achieved a detection accuracy of over 99% and F1‐scores exceeding 99% across all datasets for binary classification. Additionally, the multi‐class classification achieved a detection accuracy of over 95% and F1‐scores exceeding 95%. Crucially, the system demonstrates exceptional efficiency, with an end‐to‐end inference latency below 2 per packet when tested on commodity edge‐like hardware and a final model size of less than 300 KB. To further bolster the model's practicality, we provide an interpretability analysis using SHapley Additive exPlanations (SHAP) to identify the key features driving its predictions and conduct an adversarial robustness evaluation to confirm its resilience.