# Big Data-Driven Deep Learning Ensembler for DDoS Attack Detection
## 3 Proposed System Model  
The proposed system architecture systematically detects DDoS attacks using the APADDoS and IoT-23 datasets. The proposed framework is shown in Figure 1. To maintain analysis consistency, each dataset's raw data is cleaned, standardized, and encoded for categorical variables. Dimensionality reduction, feature mapping, and temporal mapping  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Ref** & **Method Used** & **Dataset** & **Objective Achieved** & **Limitations** \\ \hline
[14] & Simple Neural Network & CSE-CIC-IDS2018 & Achieved 82\% accuracy and 42\% precision & Limited precision and high false positives and negatives \\ \hline
[15] & KNN classifier and wrapper feature selection & CSE-CIC-IDS2018 & Achieved highest accuracy of 98.3\% & High computational cost due to feature selection process \\ \hline
[16] & GRU-RNN & CICIDS2017 and NSL-KDD & Achieved 99\% and 89\% accuracy & High computational complexity and resource consumption \\ \hline
[17] & Genetic algorithm, K-means clustering, SVM & NSL-KDD & Improved detection accuracy and data handling & Complexity in implementation and high resource requirements \\ \hline
[18] & RF and CNN & KDD99 & Achieved 99.63\% accuracy & Requires substantial computational resources and training time \\ \hline
[19] & CNN and information entropy & UNSW-NB15 & Achieved 98.98\% accuracy & Limited scalability and high computational cost \\ \hline
[20] & SAE and Snort IDS & KDD99 & Achieved 95\% accuracy & High training time and complexity in integrating multiple models \\ \hline
[20] & DBN and CNN & Simulated dataset & 96.7\% detection rate and 1.2\% false positive rate & High computational cost and potential overfitting \\ \hline
[21] & ANN models and GWO & MQTT dataset & Improved attack prediction and reduced training data memory space & Model hyperparameter values not disclosed and potential vulnerability to adversarial attacks \\ \hline
[22] & GRU & UNSW-NB15 & Highlighted evasion of poisoning precautions by backdoor attacks & Vulnerable to white box poisoning and high complexity in detecting sophisticated attacks \\ \hline
[26] & LSTM & CICDDoS2019 & Achieved 98.6\% accuracy & High training time and potential overfitting \\ \hline \hline \end{tabular}
\end{table}
Table 1: Related work in DDoS attack detection.  
produce feature spaces for these datasets. We then use class imbalance detection, correlation analysis, descriptive statistics, and distribution assessment to highlight dataset features and DDoS attack detection issues. The generator transforms and extracts enable the model to recognize DDoS assault patterns using feature engineering.  
The IoT classification model EffiGRU-GhostNet uses limited computing resources. This model integrates EfficientNet, GhostNet, and GRU layers for speed, accuracy, and efficiency. IP addresses, port numbers, packet sizes, and transport layer flags are processed by EffiGRU-GhostNet to detect NTL attacks. The model's efficient, lightweight architecture detects patterns indicative of NTL DDoS attacks while decreasing processing costs, making it perfect for real-time detection. GRU layers capture sequential patterns in network traffic data, EfficientNet efficiently processes input data for temporal network data analysis, and GhostNet preserves the model's lightweight structure. These components allow the EffiGRU-GhostNet model to collect complicated characteristics efficiently and scalably. EffiGRU-GhostNet detects DDoS attack patterns using ghost modules, ConvGRU layers, and MBConv blocks. APA-DDoS and IoT-23 dataset performance evaluations and statistical analyses show the model's accuracy and resilience in real-world DDoS detection situations. The sections following describe each step of the proposed system model.