{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T20:08:02Z","timestamp":1776888482631,"version":"3.51.2"},"reference-count":43,"publisher":"MDPI AG","issue":"20","license":[{"start":{"date-parts":[[2023,10,23]],"date-time":"2023-10-23T00:00:00Z","timestamp":1698019200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"European University of Atlantic"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Internet security is a major concern these days due to the increasing demand for information technology (IT)-based platforms and cloud computing. With its expansion, the Internet has been facing various types of attacks. Viruses, denial of service (DoS) attacks, distributed DoS (DDoS) attacks, code injection attacks, and spoofing are the most common types of attacks in the modern era. Due to the expansion of IT, the volume and severity of network attacks have been increasing lately. DoS and DDoS are the most frequently reported network traffic attacks. Traditional solutions such as intrusion detection systems and firewalls cannot detect complex DDoS and DoS attacks. With the integration of artificial intelligence-based machine learning and deep learning methods, several novel approaches have been presented for DoS and DDoS detection. In particular, deep learning models have played a crucial role in detecting DDoS attacks due to their exceptional performance. This study adopts deep learning models including recurrent neural network (RNN), long short-term memory (LSTM), and gradient recurrent unit (GRU) to detect DDoS attacks on the most recent dataset, CICDDoS2019, and a comparative analysis is conducted with the CICIDS2017 dataset. The comparative analysis contributes to the development of a competent and accurate method for detecting DDoS attacks with reduced execution time and complexity. The experimental results demonstrate that models perform equally well on the CICDDoS2019 dataset with an accuracy score of 0.99, but there is a difference in execution time, with GRU showing less execution time than those of RNN and LSTM.<\/jats:p>","DOI":"10.3390\/s23208642","type":"journal-article","created":{"date-parts":[[2023,10,23]],"date-time":"2023-10-23T10:34:20Z","timestamp":1698057260000},"page":"8642","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":42,"title":["Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm"],"prefix":"10.3390","volume":"23","author":[{"given":"Mahrukh","family":"Ramzan","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of Engineering & Technology (UET), Lahore 54890, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Muhammad","family":"Shoaib","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Engineering & Technology (UET), Lahore 54890, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6446-4945","authenticated-orcid":false,"given":"Ayesha","family":"Altaf","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Engineering & Technology (UET), Lahore 54890, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shazia","family":"Arshad","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Engineering & Technology (UET), Lahore 54890, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Faiza","family":"Iqbal","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Engineering & Technology (UET), Lahore 54890, Pakistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"\u00c1ngel Kuc","family":"Castilla","sequence":"additional","affiliation":[{"name":"Universidad Europea del Atl\u00e1ntico, Isabel Torres 21, 39011 Santander, Spain"},{"name":"Universidad Internacional Iberoamericana, Campeche 24560, Mexico"},{"name":"Universidad Internacional Iberoamericana, Arecibo, PR 00613, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8271-6496","authenticated-orcid":false,"given":"Imran","family":"Ashraf","sequence":"additional","affiliation":[{"name":"Department of Information and Communication Engineering, Yeungnam University, Gyeongsan 38541, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,10,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"23","DOI":"10.37868\/sei.v3i1.124","article-title":"Survey of dos\/ddos attacks in iot","volume":"3","author":"Khader","year":"2021","journal-title":"Sustain. Eng. Innov."},{"key":"ref_2","unstructured":"Neustar Security (2020, August 05). Cyber Threats & Trends: January\u2013June 2020. Available online: https:\/\/www.cdn.neustar\/resources\/whitepapers\/security\/neustar-cyber-threats-trends-report-2020.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Hussain, F., Abbas, S.G., Husnain, M., Fayyaz, U.U., Shahzad, F., and Shah, G.A. (2020, January 5\u20137). IoT DoS and DDoS attack detection using ResNet. Proceedings of the 2020 IEEE 23rd International Multitopic Conference (INMIC), Bahawalpur, Pakistan.","DOI":"10.1109\/INMIC50486.2020.9318216"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"2","DOI":"10.32604\/iasc.2022.024668","article-title":"Ensemble Deep Learning Models for Mitigating DDoS Attack in Software-Defined Network","volume":"33","author":"Alanazi","year":"2022","journal-title":"Intell. Autom. Soft Comput."},{"key":"ref_5","unstructured":"Seifousadati, A., Ghasemshirazi, S., and Fathian, M. (2021). A Machine Learning approach for DDoS detection on IoT devices. arXiv."},{"key":"ref_6","unstructured":"(2022, December 12). Ddos Evaluation Dataset (cic-ddos2019). Available online: https:\/\/www.unb.ca\/cic\/datasets\/ddos-2019.html."},{"key":"ref_7","first-page":"3337","article-title":"Deep learning approaches for detecting DDoS attacks: A systematic review","volume":"27","author":"Mittal","year":"2022","journal-title":"Soft Comput."},{"key":"ref_8","first-page":"4","article-title":"Long Short-Term Memory Recurrent Neural Network for detecting DDoS flooding attacks within TensorFlow Implementation framework","volume":"2017","author":"Bediako","year":"2017","journal-title":"Digit. Vetenskapliga Ark."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"254","DOI":"10.1016\/j.procs.2021.07.032","article-title":"Deep learning algorithms for detecting denial of service attacks in software-defined networks","volume":"191","author":"Farhat","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Alzahrani, R.J., and Alzahrani, A. (2021). Security analysis of ddos attacks using machine learning algorithms in networks traffic. Electronics, 10.","DOI":"10.3390\/electronics10232919"},{"key":"ref_11","first-page":"13663","article-title":"Dynamic approaches for detection of DDoS threats using machine learning","volume":"2021","author":"Dhamor","year":"2021","journal-title":"Ann. Rom. Soc. Cell Biol."},{"key":"ref_12","first-page":"24","article-title":"DDoS detection using machine learning techniques","volume":"4","author":"Amrish","year":"2022","journal-title":"J. IOT Soc. Mobile, Anal. Cloud"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"56","DOI":"10.1186\/s40537-022-00616-0","article-title":"Detecting Denial of Service attacks using machine learning algorithms","volume":"9","author":"Kumari","year":"2022","journal-title":"J. Big Data"},{"key":"ref_14","first-page":"4173187","article-title":"Detection of DDoS Attack Using Machine Learning Algorithms","volume":"9","author":"Katiravan","year":"2022","journal-title":"SSRN"},{"key":"ref_15","first-page":"1","article-title":"Detecting Distributed Denial of Service attacks using Recurrent Neural Network","volume":"2022","author":"Qamar","year":"2022","journal-title":"Psychology"},{"key":"ref_16","unstructured":"Kona, S.S. (2020). Detection of DDoS Attacks Using RNN-LSTM and Hybrid Model Ensemble. [Ph.D. Thesis, National College of Ireland]."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"62722","DOI":"10.1109\/ACCESS.2022.3176317","article-title":"Design and development of RNN anomaly detection model for IoT networks","volume":"10","author":"Ullah","year":"2022","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Saurabh, K., Sood, S., Kumar, P.A., Singh, U., Vyas, R., Vyas, O., and Khondoker, R. (2022, January 6\u20139). Lbdmids: LSTM based deep learning model for intrusion detection systems for IOT networks. Proceedings of the 2022 IEEE World AI IoT Congress (AIIoT), Seattle, WA, USA.","DOI":"10.1109\/AIIoT54504.2022.9817245"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"55","DOI":"10.52866\/ijcsm.2022.02.01.006","article-title":"Gradient Techniques to Predict Distributed Denial-Of-Service Attack","volume":"3","author":"Qamar","year":"2022","journal-title":"Iraqi J. Comput. Sci. Math."},{"key":"ref_20","first-page":"15","article-title":"Distributed Denial Of Service Attack Detection Based On Neural Network: A Comparative Study","volume":"2","author":"Qamar","year":"2022","journal-title":"Int. J. Sci. Technol. Res."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"15","DOI":"10.21742\/IJSH.2020.14.2.02","article-title":"Detection of distributed denial of service attacks based on machine learning algorithms","volume":"14","author":"Rahman","year":"2020","journal-title":"Int. J. Smart Home"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"17","DOI":"10.32604\/iasc.2022.022856","article-title":"Detection of DDoS Attack in IoT Networks Using Sample Selected RNN-ELM","volume":"34","author":"Hariprasad","year":"2022","journal-title":"Intell. Autom. Soft Comput."},{"key":"ref_23","first-page":"34","article-title":"Detecting distributed denial of service in network traffic with deep learning","volume":"13","author":"Rusyaidi","year":"2022","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_24","first-page":"18","article-title":"Iot-botnet detection using long short-term memory recurrent neural network","volume":"9","author":"Costa","year":"2020","journal-title":"Int. J. Eng. Res"},{"key":"ref_25","first-page":"20220155","article-title":"Deep learning in distributed denial-of-service attacks detection method for Internet of Things networks","volume":"32","author":"Aswad","year":"2023","journal-title":"J. Intell. Syst."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"3337","DOI":"10.1007\/s13042-021-01323-7","article-title":"DDoS detection in 5G-enabled IoT networks using deep Kalman backpropagation neural network","volume":"12","author":"Almiani","year":"2021","journal-title":"Int. J. Mach. Learn. Cybern."},{"key":"ref_27","unstructured":"(2023, April 04). Data Normalization. Available online: https:\/\/www.geeksforgeeks.org\/data-normalization-with-pandas\/."},{"key":"ref_28","unstructured":"(2023, April 04). Normalization. Available online: https:\/\/www.digitalocean.com\/community\/tutorials\/normalize-data-in-python."},{"key":"ref_29","unstructured":"(2020, September 09). Categorical Data. Available online: https:\/\/www.kdnuggets.com\/2021\/05\/deal-with-categorical-data-machine-learning.html."},{"key":"ref_30","unstructured":"(2023, April 04). One Hote Encoding. Available online: https:\/\/www.analyticsvidhya.com\/blog\/2020\/03\/one-hot-encoding-vs-label-encoding-using-scikit-learn\/."},{"key":"ref_31","unstructured":"(2023, April 04). Feature Extraction. Available online: https:\/\/towardsdatascience.com\/feature-extraction-techniques-d619b56e31be."},{"key":"ref_32","unstructured":"(2022, December 12). Testing Split Method in Machine Learning. Available online: https:\/\/www.researchgate.net\/post\/70_training_and_30_testing_spit_method_in_machine_learning."},{"key":"ref_33","unstructured":"(2023, April 04). Data Splitting. Available online: https:\/\/www.techtarget.com\/searchenterpriseai\/definition\/data-splitting."},{"key":"ref_34","first-page":"51","article-title":"A machine learning approach for ddos (distributed denial of service) attack detection using multiple linear regression","volume":"63","author":"Sambangi","year":"2020","journal-title":"Proceedings"},{"key":"ref_35","first-page":"1377","article-title":"Deep GRU neural network prediction and feedforward compensation for precision multiaxis motion control systems","volume":"25","author":"Hu","year":"2020","journal-title":"IEEE\/ASME Trans. Mechatron."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2018, January 25\u201329). Deep recurrent neural network for intrusion detection in sdn-based networks. Proceedings of the 2018 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, Canada.","DOI":"10.1109\/NETSOFT.2018.8460090"},{"key":"ref_37","unstructured":"(2023, April 04). Learning Rate. Available online: https:\/\/machinelearningmastery.com\/understand-the-dynamics-of-learning-rate-on-deep-learning-neural-networks\/."},{"key":"ref_38","unstructured":"(2023, April 04). Overfitting. Available online: https:\/\/www.v7labs.com\/blog\/overfitting."},{"key":"ref_39","unstructured":"(2023, April 04). Activation Function. Available online: https:\/\/machinelearningmastery.com\/choose-an-activation-function-for-deep-learning\/."},{"key":"ref_40","unstructured":"(2023, April 04). Early Stopping. Available online: https:\/\/www.educative.io\/answers\/what-is-early-stopping."},{"key":"ref_41","unstructured":"(2023, April 04). Optimization. Available online: https:\/\/machinelearningmastery.com\/adam-optimization-algorithm-for-deep-learning\/."},{"key":"ref_42","unstructured":"(2022, September 09). Batch and Epoch. Available online: https:\/\/machinelearningmastery.com\/difference-between-a-batch-and-an-epoch\/."},{"key":"ref_43","unstructured":"(2022, December 12). Intrusion Detection Evaluation Dataset (CIC-IDS2017). Available online: https:\/\/www.unb.ca\/cic\/datasets\/ids-2017.html."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/20\/8642\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:10:08Z","timestamp":1760130608000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/20\/8642"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,23]]},"references-count":43,"journal-issue":{"issue":"20","published-online":{"date-parts":[[2023,10]]}},"alternative-id":["s23208642"],"URL":"https:\/\/doi.org\/10.3390\/s23208642","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,23]]}}}