OBiLSTM-AM: an optimized bidirectional LSTM model with attention mechanism for robust DDoS attack detection in network traffic

DDoS attacks pose a critical threat to global digital infrastructure, causing severe service disruptions and financial losses. Contemporary low-volume, multi-vector attacks tend to circumvent traditional signature-based protection. The major shortcoming of current machine learning and deep learning detectors is that they do not analyze network traffic bidirectionally and prioritize the most indicative attack signatures, resulting in suboptimal detection of stealthy threats. In this study, the authors propose a new framework, the Optimized Bidirectional LSTM-Attention Mechanism (OBiLSTM-AM), to help fill these gaps. It also comprises a Bidirectional Long Short-Term Memory (BiLSTM) network that captures the temporal context of past and future traffic conditions, and an attention mechanism that dynamically selects the most significant time intervals for computational analysis. Bayesian optimization is an algorithm that uses machine learning to optimize a model’s hyperparameters (usually to achieve the desired performance level). On a stratified sample of the benchmark CIC-DDoS2019 dataset, using 48,712 windowed sequences (100 time steps each) partitioned into 34,098 training, 7,307 validation, and 7,307 test sequences, the model achieves 99.2% accuracy, 98.5% precision, and 98.3% F1-score, far above those of standard LSTM, GRU, and hybrid models. The OBiLSTM-AM framework therefore offers a highly precise, efficient, and robust solution for real-time DDoS detection, which represents a significant improvement over cybersecurity defense tools.