Optimizing DDoS Detection with Time Series Transformers

Distributed Denial of Service (DDoS) attacks pose severe risks to large networks by disrupting services. Effective detection and response are crucial. Despite progress, current DDoS detection methods need improvement in adaptability and scalability to manage growing network traffic complexity. Existing models often fail to generalize across various network environments, protocols or attack types. This research introduces a hybrid model combining a Time Series Transformer (TST) with feature engineering to enhance DDoS detection and classification. Based on an experimental evaluation using the CICDDoS2019 and CICIoT2023 datasets, which encompass diverse DDoS attack types and network environments, the proposed model outperforms RNN, BiLSTM, and TransformerRNN models. The TST approach achieved an accuracy of 0.971 and an F-beta score of 0.701 on the CICDDoS2019 dataset, and an accuracy of 0.981 and an F-beta score of 0.952 on the CICIoT2023 dataset. We also compare the TST approach's performance across different network protocols for DDoS classification, analyzing the model's ability to detect attacks within various protocols, such as TCP, UDP, and ICMP.