Hybrid RNN-GRU-LSTM Model for Accurate Detection of DDoS Attacks on IDS Dataset

Abstract

Distributed  Denial  of  Service  (DDoS)  attacks  are  a  persistent  threat  to network security, capable of disrupting critical services. This study proposes a  hybrid  deep  learning  model  that  combines  Recurrent  Neural  Networks (RNN),  Gated  Recurrent  Units  (GRU),  and  Long  Short-Term  Memory (LSTM) networks to effectively detect DDoS attacks in network traffic. Each component of the hybrid model captures unique temporal dependencies—RNN for basic sequence patterns, GRU for efficient short-term memory, and LSTM for long-term memory retention. The model is evaluated using two standard  Intrusion  Detection  System  (IDS)  datasets,  CIC-DDoS2019  and UNSW-NB15,  representing  diverse  attack  scenarios.  Preprocessing techniques, including feature selection, normalization, and class balancing with Synthetic Minority Over-sampling Technique (SMOTE), ensure high-quality input data. Experimental results demonstrate that the hybrid model outperforms standalone RNN, GRU, and LSTM models, achieving superior accuracy,  precision,  recall,  and  F1-score.  Specifically,  the  hybrid  model achieves 97.3% accuracy, 97.0% precision, 97.6% recall, and an AUC of 0.981 on the CIC-DDoS2019 dataset. These results underscore the model’s capability  to  detect  complex  DDoS  patterns  while  maintaining  low  false positive rates. The proposed approach offers a scalable, adaptive, and robust solution for real-time intrusion detection in dynamic network environments, outperforming traditional methods.