An Enhanced Real Time DDoS Attack Detection using LSTM and Double DQN with Dueling Networks

The role of Artificial Intelligence, especially deep learning, is important in advanced persistent threats, cyber threat intelligence, mitigate attacks, and to detect malicious cyber activities. New and unseen cyber-attacks such as zero-day attacks, polymorphic malware, and DDoS attacks are not easily detected by traditional machine learning algorithms. Deep learning algorithms such as Long Short-Term Memory and Deep Q-Network can be very efficient for improving DDoS attack detection, cyber security mechanisms, and reliability in information transmission. The proposed model combines DQN with LSTM, Double DQN (DDQN), and Dueling Networks to improve DDoS attack detection. LSTM captures temporal DDoS traffic patterns and inputs its hidden state to the DDQN for decision-making. Double DQN separates the evaluation processes and action selection for more stable learning and to overcome the overestimation bias in DDQN Q-value updates. Dueling DQN divided the Q-value into value functions for specific states and advantage functions for comparing states to other states. Dueling DQN and Double DQN makes the DDoS detection system more robust when making decisions under rapidly changing network conditions and in real-time and also improves the reliability of the learning process. The proposed model is evaluated using evaluation metrics such as F1 score, recall, precision, and accuracy and measures its real-time performance in terms of response times and latency. The experimental outcome indicates that the proposed models’ accuracy is 98.81%, precision is 98.91%, recall is 99.02%, and F1-score is 98.89%, which is improved as compared to the Ensemble CNN, RNN, and LSTM model.