1D Convolution-Enhanced Mamba: A Method for Accurate Capture of Long-Sequence Stealthy DDoS Attacks

Network technology has advanced rapidly in recent years, and distributed denial-of-service (DDoS) attacks have grown more diverse, stealthy, and large-scale. Traditional detection approaches struggle to process long network traffic sequences and locate sparse attack signals hidden in massive normal traffic, which makes accurate and efficient DDoS detection an urgent requirement. This paper presents an end-to-end DDoS detection model built on the Mamba architecture. We use one-dimensional convolutions to extract local features and smooth noise, which strengthens the model’s ability to capture bursty attack behaviors. Then, taking advantage of Mamba’s linear complexity and selective scanning mechanism, the model models long traffic sequences, filters out redundant information, and concentrates on potential attack patterns. With global feature aggregation and a classification layer, the model realizes accurate attack recognition. Experiments conducted on the CIC-DDoS2019 dataset show that our model obtains better performance in weighted F1 score, precision, and recall, while also improving inference efficiency. The model is suitable for high-precision, low-latency DDoS detection in real network environments.