# Recurrent and Deep Learning Neural Network Models for DDoS Attack Detection

Authors: S. Sumathi; R. Rajesh; Sangsoon Lim
Journal: Journal of Sensors
 (2022)

---

## Abstract

Distributed denial of service (DDoS) attack is a subclass of denial of service attack that performs severe attack in a cloud computing environment. It makes a malicious attempt to disturb the usual services of any network or server by using botnets. Hence, an efficient intrusion detection system (IDS) is essential to detect this attack. Some limitations in the existing IDS models for DDoS attack detection are delayed convergence, local stagnation issues, and local and global optimal trapping issues. These limitations are met by the recurrent neural network (RNN) and deep learning- (DL-) based proposed models that can utilize the previous states of the hidden neuron. The proposed research has used a long short-term memory (LSTM) recurrent neural network and autoencoder- and decoder-based deep learning strategy with gradient descent learning rule. The network parameters like weight vectors and bias coefficient are tuned optimally by employing the proposed a hybrid Harris Hawks optimization (HHO) and particle swarm optimization (PSO) algorithm. The proposed hybrid optimization algorithm selects the essential attributes, and the results obtained confirmed that the proposed LSTM and deep learning model outperformed all other models developed in the literature.


---

## Body

## 1. Introduction

### 1.1. Distributed Denial of Service Attack

The DDoS attack is one of the severe and most feared malicious cyber-attacks. It makes the website or a server down by flooding it with fraudulent traffic, ultimately making it inactive. Generally, DDoS attack packets have a high bit rate which performs network layer attacks [1]. A botnet master controls botnet machines present in various remote locations in this attack. Botnets are used in this type of attack as it is very similar to the normal traffic patterns of the Internet, and the owner is not aware of the commands received. Since numerous attack machines are involved, it is complicated to turn off these machines. The four components of a DDoS attack are attackers, master, zombie, and victim. This attack is generally classified into two types: bandwidth and resource depletion. In resource depletion, cloud resources are targeted, preventing legitimate users from accessing these resources. In bandwidth depletion, the victim’s network resources are targeted as shown in Figure 1.Figure 1
DDoS attack architecture.DDoS attack architecture is an agent handler model. In this model, the master communicates with the other parts of the DDoS attack system. Software packages on the Internet called masters use the handlers to communicate with the agents. Botnets, the so-called compromised machines, have agent software that performs the DDoS attack. The attacker can communicate with numerous handlers to identify the active agents to schedule an attack.


### 1.2. Recurrent Neural Network

Recurrent neural networks are deep neural networks that can be trained on large volumes of databases and perform well on natural language processing, speech recognition, and other classification problems [2]. The recurrent neural networks differ from the feed-forward neural network by their recurrent structure. It has storage units that are programmed to store the previous history of hidden states in hidden layers that are utilized to estimate the output of the current iteration. The basic structure of the RNN is shown in Figure 2. The layer units are represented in Figure 3, in which the weight values in the input, hidden, and output units are defined as Whi, Whh, and Who. The previous hidden states are utilized during the learning process to compute the current iteration output through the delay unit Z−1. So, the previous history of output is employed during the learning phase.Figure 2
Basic structure of recurrent neural network.Figure 3
Architecture of RNN.The long short-term memory network is an RNN proposed by Hochreiter in 1997 [3]. In practical applications, long short-term memory (LSTM) neural networks, which belong to gated RNNs, can learn long-term dependencies more quickly than the simple recurrent architectures [4]. The LSTM architecture handles the vanishing gradient problem. The data flow during the training process is maintained by switching special gates that decide when to read and write and what data to be stored in the gates coordinately. The LSTM architecture is presented in Figure 4, where the input gate, output gate, and the forget gate maintain the flow of signal between the layers with long-term learning dependencies. The stacked LSTM model is presented in Figure 5, where each layer has individually an LSTM framework.Figure 4
Architecture of LSTM model.Figure 5
LSTM deep learning model.The recurrent unit is updated by the following expression:(1)zt=fzt−1,xt=fVzt−1Wxt+b.where the hidden states are represented by zt, the associated weight vectors are presented as V and W, b represents the bias coefficient, respectively, f is the nonlinear activation function employed, and x=x1,x2,x3⋯xn is the input vector. The sequence of the learning process is initialized with the decision made in forget gate, and the kind of information to be stored or thrown away is decided in this gate. The previous hidden states are estimated for each input xt, and these values are employed over the sigmoid layer. If the obtained result is 1 then the data in Ct−1 is retained; else, it is removed. The following expression estimates the forget gate value:
(2)ft=σVfzt−1+Wfxt+bf.Two factors decide the decision on new information to be stored in cell memory. Initially, the input layer decides with data to be updated, and then the vector of new input data is created in thetanh layer. Based on these two-step results, the vector to be updated into the memory cells is decided.
(3)it=σVizt−1+Wixt+bi,(4)C~t=tanhVczt−1+Wcxt+bc,(5)Ct=ft⊗ct−1+it⊗C~t.The output is estimated based on the information stored in cell state by the following expression:(6)Ot=σVozt−1+Woxt+bo.In recent years, deep learning has become the dominant paradigm in machine learning and computer vision due to the availability of extensive public data and computational resources [5]. Deep learning strategies have been introduced in neural network models to perform training by employing numerous hidden layers over the conventional neural network architecture. The proposed research has used a deep learning strategy because the well-trained neural network model can provide better intrusion classification performance than the generic learning algorithms. The architecture of DLNN is shown in Figure 6. The DLNN comprises several invisible layers, and each one carries a nonlinear transformation among the layers. The DLNN has been trained by unsupervised learning techniques and a backpropagation neural network. The unsupervised learning technique has utilized the autoencoder-decoder principle to pretrain the network and adopted a backpropagation neural network to fine-tune the DLNN.Figure 6
Architecture of deep learning neural network.The autoencoder is used in unsupervised learning methods, and its output is taken as the input data [6]. The encoder network transforms the input data into code and from high-dimensional space into low-dimensional space. Then the decoder converts the input into its original form. The encoder vector ev in the encoder neural network is given in the following.
(7)ev=efxv,where ef represents the encoding function and xv denotes the input data. In a decoder neural network, the reconstruction process is performed by its decoding function df. This process maps the given dataset from low-dimensional space into high-dimensional space. The decoder process has been done by using the following.
(8)x∧v=dfev.The reconstruction errorex,x^ is minimized by using these encoder and decoder processes for the number of trained samples. The term ex,x^ is denoted as loss function, examining the inconsistency among encoded and decoded samples. The minimization of reconstruction error is the main objective of the unsupervised autoencoder.
(9)δaeθ,θ′=1N∑v=1Nexv,dθ′eθxv.The function of encoding and decoding, along with the nonlinearity process, has been performed by using the following.(10)eθx=eaf_eb+Wx,(11)dθ′x=daf_eb+WxT,where eaf_e and daf_e represent the encoder and decoder activation functions. The network bias is indicated by b, and the weight matrices of the network are given by W and WT. The reconstruction error process is as follows.
(12)ex,x^=x−x∧2.The pretraining of the DLNN model is carried out by developing the encoder process in the previous module. The input layer of the DLNN network with the first hidden layer is regarded as the encoder neural network of the first autoencoding process for the given input signalxv. The reconstruction error is minimized by training the first autoencoder process. The first trained parameter of the encoder neural network is used to initialize the first hidden layer of the DLNN process using the following.
(13)e1v=eθ1=xv.Now, the input data becomes the encoder vectore1v. The encoder neural network for the second autoencoder is obtained from the first and second hidden layers of DLNN. Next, the second trained autoencoder is used to initialize the second hidden layer of the DLNN network. The above-performed process is continued till the final hidden layer of the DLNN model. The generalized form of the final encoder vector is given in the following.
(14)eNv=eθNEN−1v.TheNth trained parameter of the encoder neural network is denoted by θN. The hidden layer of DLNN is pretrained by the N-stacked encoder process. This pretrained process avoids the local minima and improves the generalization aspect. The output of the DLNN model is calculated by using the following.
(15)yv=eθN+1eNv.The trained parameter of the output layer is denoted byθN+1. The output error is reduced by using the backpropagation algorithm.


## 1.1. Distributed Denial of Service Attack

The DDoS attack is one of the severe and most feared malicious cyber-attacks. It makes the website or a server down by flooding it with fraudulent traffic, ultimately making it inactive. Generally, DDoS attack packets have a high bit rate which performs network layer attacks [1]. A botnet master controls botnet machines present in various remote locations in this attack. Botnets are used in this type of attack as it is very similar to the normal traffic patterns of the Internet, and the owner is not aware of the commands received. Since numerous attack machines are involved, it is complicated to turn off these machines. The four components of a DDoS attack are attackers, master, zombie, and victim. This attack is generally classified into two types: bandwidth and resource depletion. In resource depletion, cloud resources are targeted, preventing legitimate users from accessing these resources. In bandwidth depletion, the victim’s network resources are targeted as shown in Figure 1.Figure 1
DDoS attack architecture.DDoS attack architecture is an agent handler model. In this model, the master communicates with the other parts of the DDoS attack system. Software packages on the Internet called masters use the handlers to communicate with the agents. Botnets, the so-called compromised machines, have agent software that performs the DDoS attack. The attacker can communicate with numerous handlers to identify the active agents to schedule an attack.


## 1.2. Recurrent Neural Network

Recurrent neural networks are deep neural networks that can be trained on large volumes of databases and perform well on natural language processing, speech recognition, and other classification problems [2]. The recurrent neural networks differ from the feed-forward neural network by their recurrent structure. It has storage units that are programmed to store the previous history of hidden states in hidden layers that are utilized to estimate the output of the current iteration. The basic structure of the RNN is shown in Figure 2. The layer units are represented in Figure 3, in which the weight values in the input, hidden, and output units are defined as Whi, Whh, and Who. The previous hidden states are utilized during the learning process to compute the current iteration output through the delay unit Z−1. So, the previous history of output is employed during the learning phase.Figure 2
Basic structure of recurrent neural network.Figure 3
Architecture of RNN.The long short-term memory network is an RNN proposed by Hochreiter in 1997 [3]. In practical applications, long short-term memory (LSTM) neural networks, which belong to gated RNNs, can learn long-term dependencies more quickly than the simple recurrent architectures [4]. The LSTM architecture handles the vanishing gradient problem. The data flow during the training process is maintained by switching special gates that decide when to read and write and what data to be stored in the gates coordinately. The LSTM architecture is presented in Figure 4, where the input gate, output gate, and the forget gate maintain the flow of signal between the layers with long-term learning dependencies. The stacked LSTM model is presented in Figure 5, where each layer has individually an LSTM framework.Figure 4
Architecture of LSTM model.Figure 5
LSTM deep learning model.The recurrent unit is updated by the following expression:(1)zt=fzt−1,xt=fVzt−1Wxt+b.where the hidden states are represented by zt, the associated weight vectors are presented as V and W, b represents the bias coefficient, respectively, f is the nonlinear activation function employed, and x=x1,x2,x3⋯xn is the input vector. The sequence of the learning process is initialized with the decision made in forget gate, and the kind of information to be stored or thrown away is decided in this gate. The previous hidden states are estimated for each input xt, and these values are employed over the sigmoid layer. If the obtained result is 1 then the data in Ct−1 is retained; else, it is removed. The following expression estimates the forget gate value:
(2)ft=σVfzt−1+Wfxt+bf.Two factors decide the decision on new information to be stored in cell memory. Initially, the input layer decides with data to be updated, and then the vector of new input data is created in thetanh layer. Based on these two-step results, the vector to be updated into the memory cells is decided.
(3)it=σVizt−1+Wixt+bi,(4)C~t=tanhVczt−1+Wcxt+bc,(5)Ct=ft⊗ct−1+it⊗C~t.The output is estimated based on the information stored in cell state by the following expression:(6)Ot=σVozt−1+Woxt+bo.In recent years, deep learning has become the dominant paradigm in machine learning and computer vision due to the availability of extensive public data and computational resources [5]. Deep learning strategies have been introduced in neural network models to perform training by employing numerous hidden layers over the conventional neural network architecture. The proposed research has used a deep learning strategy because the well-trained neural network model can provide better intrusion classification performance than the generic learning algorithms. The architecture of DLNN is shown in Figure 6. The DLNN comprises several invisible layers, and each one carries a nonlinear transformation among the layers. The DLNN has been trained by unsupervised learning techniques and a backpropagation neural network. The unsupervised learning technique has utilized the autoencoder-decoder principle to pretrain the network and adopted a backpropagation neural network to fine-tune the DLNN.Figure 6
Architecture of deep learning neural network.The autoencoder is used in unsupervised learning methods, and its output is taken as the input data [6]. The encoder network transforms the input data into code and from high-dimensional space into low-dimensional space. Then the decoder converts the input into its original form. The encoder vector ev in the encoder neural network is given in the following.
(7)ev=efxv,where ef represents the encoding function and xv denotes the input data. In a decoder neural network, the reconstruction process is performed by its decoding function df. This process maps the given dataset from low-dimensional space into high-dimensional space. The decoder process has been done by using the following.
(8)x∧v=dfev.The reconstruction errorex,x^ is minimized by using these encoder and decoder processes for the number of trained samples. The term ex,x^ is denoted as loss function, examining the inconsistency among encoded and decoded samples. The minimization of reconstruction error is the main objective of the unsupervised autoencoder.
(9)δaeθ,θ′=1N∑v=1Nexv,dθ′eθxv.The function of encoding and decoding, along with the nonlinearity process, has been performed by using the following.(10)eθx=eaf_eb+Wx,(11)dθ′x=daf_eb+WxT,where eaf_e and daf_e represent the encoder and decoder activation functions. The network bias is indicated by b, and the weight matrices of the network are given by W and WT. The reconstruction error process is as follows.
(12)ex,x^=x−x∧2.The pretraining of the DLNN model is carried out by developing the encoder process in the previous module. The input layer of the DLNN network with the first hidden layer is regarded as the encoder neural network of the first autoencoding process for the given input signalxv. The reconstruction error is minimized by training the first autoencoder process. The first trained parameter of the encoder neural network is used to initialize the first hidden layer of the DLNN process using the following.
(13)e1v=eθ1=xv.Now, the input data becomes the encoder vectore1v. The encoder neural network for the second autoencoder is obtained from the first and second hidden layers of DLNN. Next, the second trained autoencoder is used to initialize the second hidden layer of the DLNN network. The above-performed process is continued till the final hidden layer of the DLNN model. The generalized form of the final encoder vector is given in the following.
(14)eNv=eθNEN−1v.TheNth trained parameter of the encoder neural network is denoted by θN. The hidden layer of DLNN is pretrained by the N-stacked encoder process. This pretrained process avoids the local minima and improves the generalization aspect. The output of the DLNN model is calculated by using the following.
(15)yv=eθN+1eNv.The trained parameter of the output layer is denoted byθN+1. The output error is reduced by using the backpropagation algorithm.


## 2. Related Works on DDoS Attacks Detection

In this section, an overview of existing intrusion detection techniques for DDoS attacks is discussed in detail and tabulated in Table1. The proposed DDoS detection algorithms and techniques are analyzed based on their performance metrics.Table 1
Literature survey.
S. No.AuthorsDatasetAlgorithmPerformance metricsApplicationRemarks1Kona et al. [7]CICIDS2017 datasetTime series algorithmDR, ERR, TPR, TNR, precision, and FPRCloud securityEnsemble model with random forests and neural network model achieved the highest accuracy of 95.2%2Tang et al. [8]NS2 simulation platform and test-bed platformCNN, BP, and LSTMDetection rate, FN, and FPIoT securityLDoS attack detection done using multifeature fusion and convolution neural network with high accuracy and good stability3Shen et al. [9]Network flow collected at SDN switchLSTM-based deep learningAccuracy, precision, recall,F1 score, and FPRIndustrial internetData traffic in industrial internet is collected using SDN architecture. The proposed LSTM-based model achieved a detection accuracy of 99% for large-scale flooding attack and 98% for stealthy flooding attack4Krishnan D et al. [10]CICIDS 2017LSTM, CNNAccuracy, precision,F1 score, recall, ROC score, and kappa scoreNetwork securityThe proposed 1-layer LSTM with a learning rate 0.1 and 2-layer LSTMwith a learning rate of 0.2 have achieved better performance measures in DoS detection5Boukhalfa et al. [11]NSL-KDDLSTMAccuracy, sensitivity, false positive rate, precision, recall, andF-measureNetwork securityLSTM has achieved higher performance metric values when compared to classifier algorithms like SVM and KNN in intrusion detection6Abdallah et al. [12]In SDN datasetCNN, LSTMAccuracy, precision, recall, andF1 measureSDNThe proposed hybrid CNN-LSTM IDS model performs intrusion detection with an accuracy of 96.32% which is much higher than the individual models7Imrana et al. [13]NSL-KDDBidirectional long- short-term-memory (BiDLSTM)Accuracy, precision, recall andF scoreInternet securityThe classical machine learning and recurrent neural network algorithms But training time is much longer, and it suffers from high complexity8Sai Sindhu Theja et al. [14]KDD CUP 99Oppositional Crow Search Algorithm (OCSA), recurrent neural network(RNN)Precision, recall,F-measure, and accuracyCloud securityThe proposed metaheuristic OCSA is used for important feature selection and classification is done using RNN which has inexpensive speed as well as memory requirements. The proposed OCSA-RNN model outperforms other existing metaheuristic RNN-based algorithms in terms of precision, recall,F-measure, and accuracy9Shaikh et al. [15]NSL-KDDAutoencoders and (LSTM)Classification accuracyCyber securityThe proposed autoencoder-based LSTM model performs DOS detection with better classification accuracy overcoming the drawbacks in time recurrent neural networks10Li et al. [16]1999 DARPA, 2009 DARPA, and UNB CIC DDoS 2019Quintile Deviation Check (QuinDC)TPR, FPR, temporal false omission rate (TFOR) and false omission rate (FOR)IoT securityThe proposed QuinDC-based DDoS detection models perform real-time volumetric detection in IoT with accurate performance and low latency11Yang et al. [17]UNB 2017, MAWIAutoencoder- (AE-) based detection framework (AE-D3F)Detection rate (DR), FPR, and FNRNetwork securityThe proposed AE-based DDoS detection framework (AE-D3F) achieved a detection rate of 82% with a 0 FPR value12Saharkhizan et al. [18]Modbus network trafficLSTMAccuracy, precision, recall, andF-measureIoT cyber-attacksThe novel ensemble LSTM deep models achieved an average accuracy of 98.99% and average detection rate of 92.32% in IoT cyber-attack detection13Parra et al. [19]Detection of IoT botnet attacks N_BaIoTLSTM and CNNPrecision, recall accuracy, TPR, TNR, FPR, and FNRIoT securityThe proposed CNN and back-end LSTM model perform phishing attack and botnet detection with an accuracy of 94.3% and 94.80%, respectively14Haider et al. [20]CICIDS201 7Deep learning- (DL-) based CNNPrecision, recall accuracy,F1 score, and ROCSoftware-defined networking (SDN)The proposed DL-based CNN model has achieved higher DDoS detection accuracy in minimum time with low computational complexity15Hussain et al. [21]Open dataset released by Telecom ItaliaCNNAccuracy, error rate, precision, recall, false positive rate, andF1Cyber securityThe proposed robust CNN-based DDoS detection architecture has achieved higher than 91% normal and under attack cell detection accuracy16Ahmed et al. [22]CTU-13 datasetFeed-forward backpropagation ANN, deep learning artificial neural networkAccuracyCyber securityThe proposed deep learning model accurately and efficiently identify real-time zero-day botnet attacks with highest accuracy when compared to SVM, NB, or backpropagation algorithms17Lam et al. [23]IDS-2018 datasetCNNPrecision, recall, andF1 scoreIoT securityThe proposed CNN-NAS (neural architecture search) has achieved 96.4% detection rate which is higher when compared to other models in literature18Velliangiri et al. [24]KDD cup, database1, and database2Fuzzy and Taylor elephant herd optimization (FT-EHO), deep belief network (DBN) classifierDetection accuracy, accuracy, precision, and recallCloud securityThe proposed FT- EHO-DBN classifier outperformed other state-of-the-art algorithms in DDoS attack detection with ideal performance metric values but with higher computational cost19Agarval et al. [25]KDD99KNN, CN, and LSTMAccuracyCyber securityThe proposed secured attack-avoidance technique (SAAT) with machine learning algorithms has achieved higher intrusion detection accuracy with less false feedbacks20Diro et al. [26]NSL-KDD, ISCX, and KDD CUP99Deep learningAccuracy, DR FAR, precision, recall, andF-measureIoT securityThe proposed deep learning model achieved better evaluation metric values than the shallow model in binary and multiclass classification21Yuan et al. [27]ISCX2012CNN, RNN, LSTM, and gated recurrent unit neural network (GRU)Error rate, accuracy, precision, recall,F1, and AUCInternet securityThe proposed deep defense detection methodologies perform better DDoS detection than conventional machine learning algorithms with a reduced error rate of 2.103%22Asad et al. [28]CIC IDS 2017DeepDetect neural networkF1 score, ROCInternet securityThe proposed novel deep neural network-based detection mechanism has achieved a DDoS detection accuracy of 98% and anF1 score of 0.9923Ng et al. [29]NSL-KDD UNSWNB15Deep radial intelligence (DeeRaI) with cumulative incarnation (CuI)TN, FP, FN, TP TPR, FPR, accuracy, and ERCyber securityDeeRaI with CuI approach gives promising results for DoS detection when compared to the existing state-of-the-art methods with better convergence and best weights24Meidan et al. [30]IoTPOT datasetAutoencoder, SVM, IsolationForestTPR, FPR, and detection timeIoT securityThe proposed method can accurately and instantly detect botnets in IoT devices which promotes network security25Yadav et al. [31]AL-DDoS attack dataset is created in smart and secure environment (SSE) laboratoryDeep belief network (DBN) and stacked AutoEncoder (SAE)FPR, DRWeb securityThe proposed stacked AutoEncoder deep learning model is efficient in feature learning and performs attack classification with an average detection rate of 98.99% and an average false positive rate of 1.27%26Ke et al. [32]Simulated datasetsBPNN, SVM, and decision treeAccuracy rate, testing time, and false alarm rate (FAR)Internet securityThe proposed BPNN-based DDoS detection model achieved higher performance metric results in large-scale data27Ustebay et al. [33]CICIDS2017Shallow neural network (SNN), DNN, and autoencoderAccuracyNetwork securityThe proposed ANN-based DDoS detection model has achieved a 98.45% accuracy rate28Sumathi et al. [34]NSL-KDDC4.5, SVM, and KNNAccuracy, precision, sensitivity, specificity, andF1 scoreCloud securityThe SVM-based classifier model outperformed all other models in DDoS attack detection with a minimal number of feature subset29Assis et al. [35]CICDDoS 2019, CICIDS 2018Gated recurrent units (GRU)Accuracy, precision, recall, andF-measureIoT securityThe performance of the proposed GRU deep learning method for DDoS detection fared better when compared with seven different approaches namely DNN, CNN, LSTM, SVM, LR, KNN, and GD because of its ability to learn long-term dependencies30Novaes et al. [36]Emulated dataset, CIC DDoS 2019Deep neural networks (DNN)Accuracy, precision, and recallSDNThe proposed DDoS detection and defense system based on generative adversarial network (GAN) framework and deep neural networks produce superior performance metric results when compared with CNN, LSTM, and MLP31Mirsky et al. [37]OS scan, Fuzzing, Video Injection, ARP MitM, active wiretap, SSDP Flood, SYN DoS, SSL Renegotiation, and MiraiKitsune’s core algorithm (KitNET), autoencodersTPR, FNR, FPR, and equal error rate (EER)Network securityThe proposed neural network-based NIDS Kitsune detects ideal attacks detection when compared with offline anomaly detectors32Bovenzi et al. [38]Bot-IoT datasetMultimodal deep autoencoders of output classifiersTPR, FPR, ROC, andF1-measureIoT securityThe proposed H2ID, a two stage hierarchical network intrusion detection approach performs DDoS attack detection with idealF1 score value


## 3. Proposed Hybrid Optimization Algorithm

The proposed hybrid swarm intelligent optimization algorithm serves a twofold purpose. Initially, the algorithm is employed to select the significant features employed for the attack identification and tune the proposed neural network-based IDS models with optimal parameter settings. These objectives have been achieved by employing the Harris Hawks optimization algorithm, which has limitations during the training process. These limitations are addressed by combining HHO optimizer with particle swarm optimization algorithm and also attain better tradeoff between exploration and exploitation ability of the algorithm. The main inspiration of HHO is the cooperative behavior and chasing style of Harris Hawks in nature called surprise pounce. The detailed pseudo code of the HHO algorithm is presented in [39].The conventional HHO algorithm suffers from poor exploration ability as the Hawks need to wait for prey from several minutes to hours. This limitation has been eliminated by improving the convergence speed of the algorithm, which has been done by integrating particle swarm optimization and HSO. PSO is a population-based optimization technique applied extensively to many engineering problems [40]. The proposed research has chosen the PSO algorithm because of its simplicity and excellent exploration ability. The detailed pseudocode of the PSO algorithm is presented in [41]. The advantages of HHO and PSO have been combined to give a hybrid HHO algorithm to attain a tradeoff between exploration and exploitation mechanisms than HHO and other conventional algorithms. The pseudocode of the proposed hybrid HHO-PSO algorithm is shown in Algorithm 1.Algorithm 1:Pseudocode of proposed hybrid HHO-PSO algorithm.
Input: population size, convergence criteria, random factors, acceleration coefficient, inertia factor, upper and lower boundsOutput: the fitness value and the corresponding position of the prey1: Initialize the population2:while (stopping criteria) do3:  Fitness (all Hawks in population)4:ifcurrent_pBest>pBest5:  thenpBset=current_pBest6:elsepBest=pBest7:gBest=particlewithbestpBestamongthepopulation8: Define the position of the rabbit9:for (all Hawks)10:  Update the initial energy level of prey and its jumping power11:  Update the current energy level of prey# Exploration Phase12:ifE≥113:  The position of each hawk in the population is adjusted by equationXt+1=Xrandt−r1Xrandt−2r2Xt+vt+1q≥0.5Xrabbitt−Xnt−r3LB+r4UB−LB+vt+1q<0.5# Exploitation Phase14:ifE≤115:if (r<0.5 and E≥0.5)#Soft Besiege16: Adjust the Hawks position by equationXt+1=ΔXt−EJXrabbitt−Xt#Hard Besiege17:else if (r≥0.5 and E<0.5)18:  Adjust the position by equationXt+1=Xrabbitt−EΔXt#Soft besiege with dives19:else if (r<0.5 and E≥0.5)20:Y=Xrabbitt−EJXrabbit−Xmt21:Z=Y+SxLFD22:Xt+1=Y if (FY<FXtZ if (FZ<FXt23:else if (r<0.5 and E<0.5)24:Y=Xrabbitt−E∣JXrabbit−Xmt25:Z=Y+SxLFD26:Xt+1=Y if FY<FXtZ if FZ<FXt27: return the solution


## 4. Proposed Hybrid HO-PSO-LSTM and Deep Learning Models

The proposed hybrid learning model is shown in Figure7. The original dataset has 41 features, and the main objective of the proposed models is to attain better accuracy with a reduced number of features. So, the optimal feature selection is performed by employing the proposed HHO-PSO optimization algorithm; the algorithm parameters values are presented in Table 2. The selected features are shown in Tables 3 and 4 and fed into the network, and the corresponding performance is evaluated. 10-fold cross-validation is employed for each fold to select the optimal features, and the selected features are tabulated. The optimal features are identified at the end of the 10-fold cross-validation process based on the frequency of occurrences. The selected features by proposed HHO-PSO algorithm for LSTM is given in Table 5, and the frequency of selected features between the proposed model and existing models is presented in Table 6.Algorithm 2:Pseudocode of the proposed hybrid deep learning IDS model
Input: initialize the necessary parameters such as weight vector, α, input, output, and hidden layer neuron numbers, stopping criterion, population size, random factors, acceleration coefficient, inertia factor, upper and lower boundsOutput: fitness value and MSE1: all input – target pair present the input2:while (stopping condition)3:fori=1 to number of autoencoders4:   compute the net input of the layer5:   employ tangential activation function6:   find the output of the autoencoder layer7: The output of encoder layer is fed as input to the decoder unit8: Compute the net input and employ activation function to estimate the output of the decoder layer9: Weight values are updated by gradient descent learning schemeWnewdecoder=Wolddecoder+∆Wwhere∆W=αδerXN−autoen10: Fine-tuning of the network is performed by employing backpropagation strategyWnewN−autoencoderr=WoldN−autoencoder+∆Wwhere∆W=αδerXN−1autoencoderWnewN−autoencoderr=WoldN−autoencoder+∆Wwhere∆W=αδerXN−2autoencoder………………………………………………………………………..………………………………………………………………………..Wnew1−autoencoderr=Wold1−autoencoder+∆Wwhere∆W=αδerX2autoencoder11: compute the reconstruction error12:if (convergence criteria)13:  stop the process return the output14: else15:  Invoke the proposed Hybrid HHO-PSO optimizer algorithm16:while (stopping criteria) do17:  Fitness (all Hawks in population)18:ifcurrent_pBest>pBest19:  thenpBset=current_pBest20:else21:pBest=pBest22:gBest=particlewithbestpBestamongthepopulation23: Define the position of the rabbit24:for (all Hawks)25:  Update the initial energy level of prey and its jumping power26:  Update the current energy level of prey27:ifE≥128:  The position of each hawk in the population is adjusted by the equationsXt+1=Xrandt−r1Xrandt−2r2Xt+νt+1q≥0.5Xrabbitt−Xnt−r3LB+r4UB−LB+νt+1q<0.529:ifE≤130:ifE≤131:if (r≥0.5 and E≥0.5)32:  Adjust the Hawks position byΔXt=Xrabbitt−Xt33:else if (r≥0.5 and E<0.5)34: Adjust the Hawks position byXt+1=Xrabbitt−EΔXt35:else if (r<0.5 and E≥0.5)36:Y=Xrabbitt−E∣JXrabbit−Xmt37:Z=Y+SxLFD38:Xt+1=YifFY<FXtZ if FZ<FXt39: else if40:Y=Xrabbitt−E∣JXrabbit−Xmt41:Z=Y+SxLFD42:Xt+1=Y if (FY<FXtZ if (FZ<FXt43: Return weight values44:End if45:End while46: StopFigure 7
Proposed hybrid models.Table 2
Parameters of the proposed model.
ParametersLSTM or DLNN modelWeights and biasOptimally fed by HHO-PSONumber of input neuronsNumber of selected featuresNumber of hidden layers2Number of hidden neuronsInitialized to (6-8) for LSTM and (7-12) for DLNN, fixed during trainingNumber of output neurons1Activation functionSigmoidal activation functionLearning rate0.25 (fixed at end trial)Learning ruleGradient descent ruleHybrid HHO-PSOPopulation size100Maximum number of iterationsUntil convergence attainedu,v(0, 1)β1.5Initial energy stateE0(0, 1)Table 3
The selected features by proposed HHO-PSO algorithm.
No.Selected featuresNo.Selected features1F3 (service)2F4 (flag)3F5 (src_bytes)4F6 (dst_bytes)5F12 (logged_in)6F25 (serror_rate)7F30 (diff_srv_rate)8F39 (dst_host_srv_serror_rate)Table 4
Selected features of the proposed algorithm during 10-fold cross-validation.
Proposed hybrid HHO-PSO#1F3, F4, F5, F6, F8, F10, F12, F25, F26, F29, F30, F35, F36, F37, and F39#6F3, F4, F5, F6, F8, F9, F12, F23, F25, and F30#2F4, F5, F6, F8, F12, F25, F26, F30, F35, F36, and F39#7F3, F4, F5, F6, F8, F12, F23, F25,F29, F30, and F38#3F3, F4, F5, F6, F8, F10, F12, F23, F25, F26, F30, F36, and F39#8F3, F4, F5, F6, F8, F12, F23, F25,F30, F35, and F39#4F4, F5, F6, F8, F10, F12, F23, F25, F26,F36, and F39#9F3, F4, F5, F6, F12, F23, F25, F30,F35, F36, and F39#5F3, F4, F5, F12, F23, F25, F26, F30, F35, and F39#10F3, F4, F5, F10, F12, F25, F30, F35, and F39Table 5
The selected features by proposed HHO-PSO algorithm for LSTM.
Feature No.AttributeF3ServiceF4FlagF5src_bytesF6dst_bytesF12logged_inF25serror_rateF30diff_srv_rateF39dst_host_srv_serror_rateTable 6
Frequency of selected features between the proposed model and existing models.
FeatureC4.5KNNSVMPSOHHOHHO-PSOF2000010F3300578F4910108910F510101091010F6140448F7100000F81010108107F10101010784F11100030F1210101091010F23109109107F2510937910F26087000F29101010842F301010108109F33070000F34001000F3591010886F36101091085F37894871F38135241F390102358F40000000F41100000Total number of selected features12141010108


## 5. Result Comparison and Discussion for Proposed Hybrid HHO-PSO-LSTM

The proposed IDS models are evaluated with NSL benchmark datasets. The model is iterated for ten trial runs to avoid biased output, and the model performance for each trial run is depicted in Figure8.Figure 8
Performance of the proposed LSTM model for 10 trial runs.The average performance of the proposed LSTM model for the 10-trial run is presented in Table7 and Figure 9. The classic LSTM model reported an accuracy of 0.9541, but it has poor true negative class identification as compared to the hybrid models. Feeding the model with a PSO-based feature selection strategy enhances performance more than the conventional LSTM strategy. Compared to PSO, on incorporating the HHO strategy, the true negative and true positive cases are improved. So, the model is fed with a hybrid feature selection strategy, and the performance is investigated compared to the other two algorithms. The performance is improved with false negative cases significantly reduced. This shows the significance of the proposed hybrid HHO-PSO optimization strategy in enhancing the performance of the conventional LSTM model.Table 7
Performance of the proposed LSTM model.
Model under studyAccuracyPrecisionSensitivitySpecificityF1 scoreLSTM0.95410.95920.96010.94610.9597PSO-LSTM0.96310.96660.96840.95600.9675HHO-LSTM0.96820.96930.97470.95970.9720Proposed hybrid HHO-PSO-LSTM0.98530.98320.99090.97800.9870Figure 9
Performance of the proposed LSTM models.The random initialization of weight vectors and bias coefficients affects the conventional neural network model. The proposed LSTM model is optimally framed by feeding optimal weight and bias coefficients by the proposed HHO-PSO optimization algorithm that improves the convergence speed presented in Figure10. The conventional LSTM model converges at the 353rd iteration. In contrast, the proposed optimally constructed LSTM model starts to converge at the 200th iteration, and also the reported lacuna of delayed convergence is handled effectively by the proposed LSTM model. To further demonstrate the effectiveness of the proposed model, the model performances are compared with the existing models in the works of literature and other models, as presented in Table 8. The reported results inferred that the proposed hybrid HHO-PSO-LSTM IDS model outperformed all other models with better intrusion classification performance.Figure 10
Convergence graph.Table 8
Comparative analysis made with other models in literatures.
Model under studyAccuracyPrecisionSensitivitySpecificityF1 scoreNaïve Bayes [38]0.92160.96490.90390.94900.9334CART [39]0.89930.94910.88270.92530.9147ABC-BPN [40]0.91160.95850.89390.93930.9250BR-BPN [41]0.89890.95560.87770.93350.9150GA-BPN [42]0.92120.96180.90560.94500.9328PSO-BPN [43]0.90960.96180.88860.94340.9237GA-MLP [44]0.91400.95880.89720.94010.9270MLP [45]0.92290.96940.90250.95510.9347LSTM [46]0.95450.96070.95940.94800.9600LSTM [47]0.95420.96760.95270.95630.9601C4.5 [34]0.93700.96800.92480.95490.9459KNN [34]0.91700.93680.91890.91430.9278SVM [34]0.94940.95850.95280.94480.9557BPN [48]0.92720.96630.91110.95150.9379MLP [49]0.93800.97260.92270.96110.9470PSO-BPN [50]0.94400.97320.93150.96230.9519PSO-MLP [51]0.94730.97220.93760.96130.9546HHO-BPN [52]0.95010.96860.94510.95710.9567HHO-MLP [53]0.95840.96990.95760.95960.9637LSTM0.95410.95920.96010.94610.9597PSO-LSTM0.96310.96660.96840.95600.9675HHO-LSTM0.96820.96930.97470.95970.9720Hybrid HHO-PSO-BPN0.97080.97250.97610.96380.9743HHO-PSO-MLP0.97740.97630.98380.96900.9800Proposed hybrid HHO-PSO-LSTM0.98530.98320.99090.97800.9870


## 6. Result Comparison and Discussion for Proposed Hybrid HHO-PSO Deep Learning IDS Model

The size of the original dataset has reduced after the feature selection process, and the selected feature subset is fed into the proposed deep learning model for intrusion classification. Parameter handling is the major challenge of the deep learning models, which has been done by optimally choosing the weight and bias vectors of the proposed model. Initially, numerous trials are made to fix the number of hidden layers for developing the DLNN model. The number of hidden layers and hidden neurons is another factor deciding the complexity of the network. So, the hidden layers and hidden neurons are fixed based on the trial and error method, and the model performances for various hidden layers are presented in Table9.Table 9
Performance of the proposed DLNN for various hidden layers.
Trial runsNo. of hidden layerAccuracyPrecisionSensitivitySpecificityF1 scoreError rateComputational time in sec150.98810.99080.98830.98780.98950.0119200.22260.98860.99020.98970.98710.99000.0114220.98370.98590.99000.98530.98670.98760.0141259.98480.98620.98980.98590.98640.98790.0138330.07590.98700.98950.98770.98610.98860.0130365.236100.98700.98890.98830.98530.98860.0130379.937110.98800.98750.99140.98360.98950.0120380.238120.99530.99690.99260.99590.99470.0047393.129130.99860.99900.99860.99860.99880.0014439.9810140.99930.99930.99950.99910.99940.0007459.32The error rate of the proposed model for 10 trial run and their corresponding hidden layers are shown in Figure11. Handling the overfitting issue is the primary task of the deep learning models, which can be done by analyzing the training efficiency of the proposed model. The training and testing accuracy for various hidden layers are shown in Figure 12, which has confirmed that the network underfits till trial 7 and it overfits from trial 9. So, the overfitting and the underfitting issue has been avoided by fixing 12 numbers of hidden layers. Further, Table 10 confirmed that the proposed model achieved better intrusion classification performance for 12 hidden layers. So, the proposed model has fixed 12 numbers hidden layers. Comparison of the proposed models with existing models is shown in Table 11. Comparison of percentage improvement of the proposed HHO-PSO-DLNN model with other models is shown in Table 10. Comparison of computational time involved in the proposed models and algorithms is tabulated in Table 12. Table 12 shows that the computational time of the proposed hybrid HHO-PSO-DLNN is higher than all the other models under comparison due to its increase in the number of hidden layers. But the important tradeoff is that the performance metric values in DDoS attack detection in proposed optimized DL are much better than other algorithms.Figure 11
Error rate for 10-trial runs.Figure 12
Training efficiency of the proposed model for 10-trial runs.Table 10
Comparison of percentage improvement of the proposed HHO-PSO-DLNN model with other models.
Model under studyAccuracyPrecisionSensitivitySpecificityF1 scoreC4.5 [34]5.832.896.784.14.88KNN [34]7.836.017.378.166.69SVM [34]4.593.843.985.113.9BPN [52]6.813.068.154.445.68MLP [53]5.732.436.993.484.77PSO-BPN [54]5.132.376.113.364.28PSO-MLP [55]4.82.475.53.464.01HHO-BPN [56]4.522.834.753.883.8HHO-MLP [57]3.692.73.53.633.1LSTM4.123.773.254.983.5PSO-LSTM3.223.032.423.992.72HHO-LSTM2.712.761.793.622.27DLNN2.671.752.672.362.21PSO-DLNN1.780.772.091.051.43HHO-DLNN1.421.121.151.491.13Proposed hybrid HHO-PSO-LSTM11.370.171.790.77Table 11
Comparison of proposed models with existing models.
Model under studyAccuracyPrecisionSensitivitySpecificityF1 scoreNaïve Bayes [42]0.92160.96490.90390.94900.9334CART [43]0.89930.94910.88270.92530.9147ABC-BPN [44]0.91160.95850.89390.93930.9250BR-BPN [45]0.89890.95560.87770.93350.9150GA-BPN [46]0.92120.96180.90560.94500.9328PSO-BPN [47]0.90960.96180.88860.94340.9237GA-MLP [48]0.91400.95880.89720.94010.9270MLP [49]0.92290.96940.90250.95510.9347LSTM [50]0.95450.96070.95940.94800.9600LSTM [51]0.95420.96760.95270.95630.9601C4.5 [34]0.93700.96800.92480.95490.9459KNN [34]0.91700.93680.91890.91430.9278SVM [34]0.94940.95850.95280.94480.9557BPN [52]0.92720.96630.91110.95150.9379MLP [53]0.93800.97260.92270.96110.9470PSO-BPN [54]0.94400.97320.93150.96230.9519PSO-MLP [55]0.94730.97220.93760.96130.9546HHO-BPN [56]0.95010.96860.94510.95710.9567HHO-MLP [57]0.95840.96990.95760.95960.9637LSTM0.95410.95920.96010.94610.9597PSO-LSTM0.96310.96660.96840.95600.9675HHO-LSTM0.96820.96930.97470.95970.9720DLNN0.96860.97940.96590.97230.9726PSO-DLNN0.97750.98920.97170.98540.9804HHO-DLNN0.98110.98570.98110.98100.9834Proposed hybrid HHO-PSO-LSTM0.98530.98320.99090.97800.9870Proposed HHO-PSO-DLNN0.99530.99690.99260.99590.9947Table 12
Comparison of computational time involved in the proposed model and algorithms.
Model under studyComputational time in secondsPSO-LSTM280.4HHO-LSTM290.6Proposed hybrid HHO-PSO-LSTM300.7Hybrid HHO-PSO-BPN350.2Hybrid HHO-PSO-MLP360.8Hybrid HHO-PSO-DLNN393.12The proposed DLNN model is tuned for its weight and bias vectors by individually employing PSO and HHO algorithms and then using the proposed hybrid HHO-PSO optimization algorithm. The performance comparison of conventional DLNN, PSO-DLNN, HHO-DLNN, and hybrid HHO-PSO-DLNN has been done and is shown in Figure13. ROC curve and rate of convergence of the proposed model are shown in Figures 14 and 15. The performance of the proposed hybrid HHO-PSO-DLNN model is observed to be better than the conventional DLNN, PSO-DLNN, and HHO-DLNN models.Figure 13
Performance of the proposed DLNN model with other models.Figure 14
ROC curve for the proposed DLNN model.Figure 15
Rate of convergence of the proposed models.


## 7. Statistical Analysis of the Proposed Models

Dietterich [58] recommended the statistical models that can be executed 10 times. The 5×2 cv test is a powerful strategy for measuring the classifier algorithms’ statistical variation. In the proposed scheme, twofold cross-validation is performed five times, where 50% of the data sample is employed for training, and the remaining 50% is employed for testing. Then the dataset is shared such that the testing sample is employed for training and the training sample is adopted for testing, respectively. The performance difference between the two models is evaluated using Equations (16)–(20).
(16)AccA=AccA,Model−1−AccA,Model−2,(17)AccB=AccB,Model−1−AccB,Model−2.The mean and variance of difference are evaluated by using the following equations.(18)Accavg=AccA+AccB/2,(19)σ2=AccA−Accavg2+AccB−Accavg2.Thet statistics is evaluated after 5 iterations as follows:
(20)t=AccA,11/5∑i=15σi2,where AccA,1 is the accuracy of the first iteration sample.Thet distribution with 5 degrees of freedom is followed by t statistics. The p value is estimated and compared with the level of significance α=0.05. When the p value is less than the level of significance, then the null hypothesis is rejected, and both the models reported similar performance. This signifies the estimated difference to be real. Otherwise, if the p value is greater than the significance level, then the null hypothesis is not rejected. The difference obtained in performance is probably due to stochastic factors or a statistical coincidence. The performance of the proposed HHO-PSO-tuned DLNN model is compared with the performance of other models and confirmed that the proposed HHO-PSO possesses better performance, which is reported in Table 13. The results obtained confirmed that the proposed HHO-PSO-DLNN model is statistically better than all other models developed in this proposed research work.Table 13
Statistical analysis with a level of significance of 0.05.
Models under comparisonp valueStatistical resultHHO-PSO-DLNN vs. DLNN0.0291Null hypothesis is rejectedHHO-PSO-DLNN vs. HHO-PSO-LSTM0.0321Null hypothesis is rejectedHHO-PSO-DLNN vs. HHO-PSO-MLP0.0364Null hypothesis is rejectedHHO-PSO-DLNN vs. HHO-PSO-SVM0.0272Null hypothesis is rejectedHHO-PSO-DLNN vs. C4.5-SVM0.0219Null hypothesis is rejected


## 8. Conclusion and Future Directions

The proposed model in this paper employed a recurrent neural network and deep learning neural network model for the intrusion classification problem. The LSTM network is adopted, and its intrusion detection performances are investigated. The hybrid HHO-PSO algorithm is employed to improve the model’s performance, and the model response is analyzed by the metric values obtained. It is investigated that the proposed hybrid HHO-PSO optimization algorithm has improved the performance of the neural network models by providing a minimal number of optimal feature subsets with better classification accuracy. The convergence speed of the proposed model is improved than the other models in this study and demonstrated better performance than other models in the literature. The deep learning architecture for DDoS attack detection based on autoencoder-decoder strategy is initially framed based on numerous trial results. Then, the weight vectors of the proposed DLNN model are optimally tuned by the proposed hybrid HHO-PSO optimization algorithm. The model performances are analyzed for each trial run. Further, the effectiveness of the proposed model has been analyzed by comparing the model’s performance with other existing works. Finally, a statistical analysis is made based on5×2 cv test to justify the superiority of the proposed hybrid HHO-PSO-DLNN model with all other existing models. It is confirmed that the proposed DLNN model outperformed all other models in intrusion detection under a cloud computing environment.The following are the future research directions for DDoS attack detection using DL methods:(i)
DDoS DL-based detection methods can be combined with eXplainable Artificial Intelligence (XAI) techniques, which leads to global interpretation [59](ii)
The proposed DDoS detection DL-based methods can be implemented in a larger system with which it is easy to detect the compromised end points. It also helps us to improve the performance of the proposed algorithms making them skillful in handling the various abnormalities that occurs in the performance of the network(iii)
Efficient and lightweight DL models can be developed for attack prone networks which has limited resources for computing(iv)
Pattern of attacks changes at a much faster rate, and hence, automatic updated DL models can be developed to detect new DDoS attack instances(v)
The increased computational time of the proposed hybrid HHO-PSO-DLNN can further be reduced in future, retaining its ideal performance metric values in DDoS attack detection



---

*Source: 8530312-2022-09-10.xml*