Performance Evaluation of CNN, LSTM, and DNN for Feature Flow Based DDoS Attack Detection on CSE-CIC-IDS2018 Dataset

Abstract

Deep learning approaches have been proven effective in detecting Distributed Denial of Service (DDoS) attacks on networks, particularly through the analysis of flow features. This study aims to evaluate CNN, LSTM, and DNN in detecting DDoS attacks using flow features on the CSE-CIC-IDS2018 dataset. Each model is systematically compared with baseline algorithms to assess accuracy, precision, recall, and F1-score, in order to determine the most optimal model for a Network Intrusion Detection System (NIDS). All models demonstrated very high accuracy above 99%, with CNN standing out as the best-performing deep learning model for detecting DDoS patterns, while XGBoost emerged as the most effective baseline. These results emphasize that the choice of detection model should consider data characteristics, the complexity of flow features, and the diversity of attack types to achieve optimal performance in a NIDS. The study shows that both CNN, DNN, and LSTM, as well as baseline models such as XGBoost, can detect DDoS attacks based on flow features with accuracy above 99%, confirming the effectiveness of this approach and the importance of selecting models according to data characteristics.