# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
## 4 Simulation and Results
### Execution Time and Throughput Analysis  
Execution time analysis (Figure 11) reveals that EffiGRU-GhostNet has the lowest computational overhead among all tested models, making it ideal for real-time applications. Figure 11 shows how dataset size affects machine-learning model execution time. All models start to take longer as the dataset grows from 10,000 to 250,000 occurrences. Processing more excellent datasets increases computational complexity, which increases execution time. The proposed technique EffiGRU-GhostNet has the lowest execution time among the plotted models. Its lightweight design, which may use GhostNet, makes it efficient. These designs decrease computational costs by achieving excellent performance \begin{table}
\begin{tabular}{l c c} \hline \hline
**Class** & **FP** & **TN** \\ \hline HorizontalPort Scan & 4 & 84,496 \\ Benign & 7 & 90,493 \\ C\&C & 12 & 82,008 \\ Okiru & 4 & 91,896 \\ DDoS & 2 & 87,498 \\ C\&C0 Heart Beat & 9 & 86,444 \\ C\&C Tori & 8 & 88,539 \\ Attack & 2 & 88,578 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: FP and TN for each class in IoT-23 dataset. Figure 10: ROC curves comparison of proposed and exisiting methods. with fewer parameters. The suggested technique may also optimize training and inference, improving the computing economy without sacrificing accuracy. The throughput (packets per second) and detection accuracy (%) of EffiGRU-GhostNet are shown in Figure 12 for different data volumes. This demonstrates the model's capacity for real-time processing and its stability in accuracy when faced with rising loads. The model's processing capability is shown by the throughput, which first grows as data volume climbs from 1000 to 100,000 packets per second, reaches a peak, and then somewhat tapers down at more significant quantities. Despite being high across the board for data quantities, detection accuracy decreases, falling slightly from 98.9% to 97.9% as data intensity increases. This number is significant because it shows that EffiGRU-GhostNet can handle large amounts of data efficiently and reliably, making it ideal for situations with a lot of network traffic and a need for real-time DDoS detection. Potential Applications Beyond IoT  
The efficacy and efficiency of EffiGRU-GhostNet on the IoT-23 and APA-DDoS datasets demonstrate its adaptability and indicate that it can be used in many domains apart from IoT networks. For example, the model is well-suited for implementation in cloud infrastructures due to its lightweight architecture and minimal computing needs. The capacity of EffiGRU-GhostNet to identify and counteract such threats in real time might strengthen the defenses of these systems, which are often subjected to coordinated huge DDoS attacks. Figure 11: Execution Time of Proposed and State of the Art. Figure 12: Throughput (packets per second) and detection accuracy across different volumes. The model's rapid threat identification helps avoid operational interruptions brought on by cyberattacks in sectors of vital infrastructure like smart grids and industrial control systems where continuous operation is crucial. Anomalies in network traffic, for instance, might be used to prevent potential outages or manufacturing process defects. EffiGRU-GhostNet provides an extra layer of security in the healthcare industry, where sensitive patient data are often the target of cyber threats, by spotting malicious activity aimed at compromising electronic health records or linked medical equipment. Also, the model can maintain monitoring on financial networks all the time, protecting customer data and preventing breaches in security in a sector that often has massive attacks on important transactional data. Cloud computing platforms are ideal for EffiGRU-GhostNet because of its precision and capacity to manage large amounts of traffic. The approach guarantees operational stability and safeguards dispersed resources by pro-actively detecting and neutralizing DDoS attacks at the network boundary.