A Two‐Phase Detection Method Based on Ensemble Feature Fusion for Detecting Distributed Denial of Service ( <scp>DDoS</scp> ) Attacks in Cloud Computing Using Deep Learning Algorithm

ABSTRACT With the expansion of cloud computing and Internet of Things (IoT), Distributed Denial of Service (DDoS) attacks have become a serious threat to cybersecurity. Accurate and fast detection of these attacks is of great importance. In this study, a two‐stage detection method based on group feature fusion is presented for detecting DDoS attacks in cloud computing environment. In the first stage, the optimal feature selection was performed using a combination of several meta‐heuristic algorithms including genetic algorithm, gray wolf, particle swarm optimization, Harris hawk, and whale. Then, three feature fusion methods including voting‐based fusion, weight‐based fusion, and learning‐based fusion were used to combine the selected features. In the second step, a hybrid deep learning model was designed, consisting of a convolutional neural network (CNN) and a long‐short term memory network (LSTM). CNN extracts spatial features of network traffic, and LSTM models temporal dependencies. This combination has improved the model's performance in accurately detecting DDoS attacks. Experimental results on two datasets, NSL‐KDD and BoT‐IoT, show that the proposed method achieves 99.1% and 99.2% accuracy, respectively, which is a significant improvement over previous methods. In addition to increasing detection accuracy, the proposed method also reduces the false positive rate and has high generalizability against various types of cyber‐attacks. In the future, the efficiency of this method in real environments can be improved by optimizing the model structure, utilizing pre‐trained networks, and reducing computational complexity.