An Improved Attention-Enhanced LSTM Model for Early Detection of Distributed Denial of Service Attacks

In this extended study, we aim to enhance the performance of the Long Short-Term Memory (LSTM) model for detecting Distributed Denial of Service (DDoS) attacks by incorporating an Attention layer. Our previous work demonstrates the effectiveness of rule-based, Gaussian Naive Bayes (GNB), and LSTM models in DDoS detection but reveals limitations in terms of model stability and false negative rates, particularly with datasets containing a high proportion of benign data [19]. To address these issues, we introduce the Attention layer to the LSTM model, aiming to improve detection accuracy and reduce false negatives. Experiments use the UNSW-NB15 and CIC-DDoS2019 datasets with various configurations of mini-batch sizes and detection windows. The results show that the Attention-enhanced LSTM model generally outperforms the standard LSTM model across different configurations and datasets. The Enhanced LSTM model demonstrates higher accuracy, precision, recall, and F1 scores, and the inclusion of the Attention layer leads to more consistent and reliable performance. These findings highlight the potential of attention-enhanced LSTM models for improving DDoS attack detection, making them valuable tools for cybersecurity applications. The improved model effectively distinguishes between benign and malicious packets, providing more accurate and timely alerts for incident response teams.