# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
###### Abstract  
The increasing threat of Distributed DDoS attacks necessitates robust, big data-driven methods to detect and mitigate complex Network and Transport Layer (NTL) attacks. This paper proposes EfiGRU-GhostNet, a deep-learning ensemble model for high-accuracy DDoS detection with minimal resource consumption. EfiGRU-GhostNet integrates Gated Recurrent Units (GRU) with the GhostNet architecture, optimized through Principal Component Analysis with Locality Preserving Projections (PCA-LLP) to handle large-scale data effectively. Our ensemble was tested on IoT-23, APATDOeS, and additional datasets created from popular DDoS attack tools. Simulations demonstrate a recognition rate of 98.99% on IoT-23 with a 0.11% false positive rate and 99.05% accuracy with a 0.01% error on APA-DDoS, outperforming SVM, ANN-GWO, GRU-RNN, CNN, LSTM, and DBN baselines. Statistical validation through Wilcoxon and Spearman's tests further verifies EfiGRU-GhostNet's effectiveness across datasets, with a Wilcoxon F-statistic of 7.632 (\(p=0.022\)) and a Spearman correlation of 0.822 (\(p=0.005\)). This study demonstrates that EfiGRU-GhostNet is a reliable, scalable solution for dynamic DDoS detection, advancing the field of big data-driven cybersecurity.  
denial of service attack; deep learning ensembler; network layer security; transport layer security; IoT security; cyber security +
Footnote †: journal:  
Article Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection  
flood a service, server, or network with internet traffic to disrupt functioning. Companies confront substantial dangers from DDoSA's growing complexity, regularity, and intensity. Botnets of hacked computers launch coordinated attacks, frequently simulating genuine user activity to avoid discovery [3].  
Web servers' application layers are vulnerable to HTTP-GET flood DDoSA, circumventing typical security mechanisms. Because they mimic traffic patterns, these attacks are hard to spot. A recent study shows that HTTP-GET flood DDoS detection and mitigation are still open for research, requiring more advanced and comprehensive solutions [4]. DDoSA may result in financial losses, brand harm, and service downtime. DDoSA have hit 82% of firms, causing data breaches or service disruptions. At afflicted firms, DDoSA reduce service performance by 26% and cause 41% service outages [5]. Due to hostile user techniques and DDoS Attacks (DDoSA) power and complexity, advanced defensive measures are needed. Traditional intrusion detection systems (IDS) typically miss advanced attack paths. Cyber threats are dynamic; therefore, systems must adapt and react quickly. AI is a significant cybersecurity tool. AI-driven intrusion detection systems accurately identify known and unexpected threats using deep learning [6]. These technologies may identify irregularities in massive data sets and warn cybersecurity specialists of possible intrusions. DDoSA on remote work and internet service infrastructure increased during the COVID-19 epidemic. CDN providers like Cloudflare claim regular and large-scale DDoSA, some reaching 100 Gbps, causing service delays and financial losses. Defense measures must be updated and improved as DDoS assault methods evolve.