Generalized detection of DDoS attack patterns using machine learning models

Abstract

Distributed Denial of Service (DDoS) attacks, including stealthy Low-Rate DDoS (LRDDoS) variants, pose critical challenges to network security by evading conventional detection systems that rely on traffic volume thresholds. Existing machine learning-based detectors often fail to generalize across diverse attack patterns, suffer from concept drift in evolving traffic, and cannot leverage distributed data due to privacy constraints. To address these limitations, we propose FLD-DDoS, an integrated detection framework based on asynchronous Federated Learning (FL) with Bidirectional LSTM (Bi-LSTM) and adaptive concept drift handling. Our approach enables collaborative model training across multiple network nodes without centralizing sensitive data, while maintaining detection accuracy under changing traffic conditions. The key contributions include: (1) a novel asynchronous FL architecture with intelligent main node selection; (2) a Bi-LSTM classifier enhanced with model drift detection using Kolmogorov–Smirnov testing; (3) a comprehensive evaluation on 800 million real-world corporate network packets showing 99.82% detection accuracy with sub-second latency; (4) experimental comparison demonstrating superiority over six baseline and state-of-the-art methods; (5) a comparative experimental evaluation considering two additional baseline models. The implemented system significantly reduces network load and demonstrates scalable performance with $O\left(n\right)$ time complexity for the core algorithms, while providing robust protection against both volumetric and stealthy DDoS attacks.