A deployable shield based intelligent defense framework for mitigating large scale application layer DDoS attacks

An application-layer DDoS attack is hard to spot as it causes server-side resources to be consumed and may emulate the behavior of a legitimate client. D-SHIELD is a novel deployable framework for real-time application-layer DDoS detection and mitigation, which is presented in this Research. The proposed pipeline consists of train-only pre-processing, preprocessing via BM-HHO (Brownian Motion Harris Hawks Optimization), feature weighting using I-GMIWO (Invasive Gaussian Mutation Improved Weed Optimization) and the Xavier initialization and Soft-Plus activation of XSP-DNN based on the selected features. The framework is tested using both the CIC-DDoS2019 and Edge-IIoT datasets, and subsequently, in a real prototype which alerts and blocks the source IP under con-trolled attack scenarios. D-SHIELD's exhibits 99.46% as overall held-out binary test accuracy in offline experiments for NetBIOS attack family and 99.80% on Edge-IIoT with very low false-positive rates. The real-time prototype achieves a detection rate of 98.85% in the evaluated stress tests of the evaluated request rate from 100 to 100,000 requests/s. Ablation shows that strong detection is preserved if payload-dependent features are dropped and only metadata-based features are employed, in an HTTPS-oriented ablation. The accuracy of these results shows that D-SHIELD will be accurate in the benchmark environment, as well as for deployments on the edge and for IIoT applications requiring low latency mitigation and minimal impact on benign traffic.