Hybrid RNN-GRU-LSTM Model for Accurate Detection of DDoS Attacks on IDS Dataset

Abstract

Distributed Denial of Service (DDoS) attacks are a persistent threat to network security, capable of disrupting critical services. This study proposes a hybrid deep learning model that combines Recurrent Neural Networks (RNN), Gated Recurrent Units (GRU), and Long Short-Term Memory (LSTM) networks to effectively detect DDoS attacks in network traffic. Each component of the hybrid model captures unique temporal dependencies—RNN for basic sequence patterns, GRU for efficient short-term memory, and LSTM for long-term memory retention. The model is evaluated using two standard Intrusion Detection System (IDS) datasets, CIC-DDoS2019 and UNSW-NB15, representing diverse attack scenarios. Preprocessing techniques, including feature selection, normalization, and class balancing with Synthetic Minority Over-sampling Technique (SMOTE), ensure high-quality input data. Experimental results demonstrate that the hybrid model outperforms standalone RNN, GRU, and LSTM models, achieving superior accuracy, precision, recall, and F1-score. Specifically, the hybrid model achieves 97.3% accuracy, 97.0% precision, 97.6% recall, and an AUC of 0.981 on the CIC-DDoS2019 dataset. These results underscore the model’s capability to detect complex DDoS patterns while maintaining low false positive rates. The proposed approach offers a scalable, adaptive, and robust solution for real-time intrusion detection in dynamic network environments, outperforming traditional methods.