# LUCID: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

arXiv: https://arxiv.org/abs/2002.04902 · HTML: https://mlsanity.com/paper/2002.04902/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 12 Feb 2020.

## Built on by (most cited first, 14 of 14)

- [Federated Learning for Intrusion Detection System: Concepts, Challenges and Future Directions](https://mlsanity.com/paper/2106.09527/) (2021)
- [The Cross-evaluation of Machine Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2203.04686/) (2022)
- [An Intrusion Detection System based on Deep Belief Networks](https://mlsanity.com/paper/2207.02117/) (2022)
- [Reconstruction-based LSTM-Autoencoder for Anomaly-based DDoS Attack Detection over Multivariate Time-Series Data](https://mlsanity.com/paper/2305.09475/) (2023)
- [ARCADE: Adversarially Regularized Convolutional Autoencoder for Network Anomaly Detection](https://mlsanity.com/paper/2205.01432/) (2022)
- [An Efficient and Reliable Asynchronous Federated Learning Scheme for Smart Public Transportation](https://mlsanity.com/paper/2208.07194/) (2022)
- [3D-IDS: Doubly Disentangled Dynamic Intrusion Detection](https://mlsanity.com/paper/2307.11079/) (2023)
- [Detecting and Mitigating DDoS Attacks with AI: A Survey](https://mlsanity.com/paper/2503.17867/) (2025)
- [MixGAN: A Hybrid Semi-Supervised and Generative Approach for DDoS Detection in Cloud-Integrated IoT Networks](https://mlsanity.com/paper/2508.19273/) (2025)
- [AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation](https://mlsanity.com/paper/2606.08173/) (2026)
- [Classification and Explanation of Distributed Denial-of-Service (DDoS) Attack Detection using Machine Learning and Shapley Additive Explanation (SHAP) Methods](https://mlsanity.com/paper/2306.17190/) (2023)
- [Lightweight CNN-Based DDoS Detection for Resource-Constrained Edge Networks](https://mlsanity.com/paper/2309.05646/) (2023)
- [DrLLM: Prompt-Enhanced Distributed Denial-of-Service Resistance Method with Large Language Models](https://mlsanity.com/paper/2409.10561/) (2024)
- [AnchorMixGAN: Anchor-Aligned Generative Semi-Supervision for DDoS Detection in Cloud-Integrated IoT Networks](https://mlsanity.com/paper/2609.32764/) (2026)

## Abstract (arXiv)

Distributed Denial of Service (DDoS) attacks are one of the most harmful threats in today's Internet, disrupting the availability of essential services. The challenge of DDoS detection is the combination of attack approaches coupled with the volume of live traffic to be analysed. In this paper, we present a practical, lightweight deep learning DDoS detection system called LUCID, which exploits the properties of Convolutional Neural Networks (CNNs) to classify traffic flows as either malicious or benign. We make four main contributions; (1) an innovative application of a CNN to detect DDoS traffic with low processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce traffic observations for online attack detection, (3) an activation analysis to explain LUCID's DDoS classification, and (4) an empirical validation of the solution on a resource-constrained hardware platform. Using the latest datasets, LUCID matches existing state-of-the-art detection accuracy whilst presenting a 40x reduction in processing time, as compared to the state-of-the-art. With our evaluation results, we prove that the proposed approach is suitable for effective DDoS detection in resource-constrained operational environments.