# DDoSNet: A Deep-Learning Model for Detecting Network Attacks

arXiv: https://arxiv.org/abs/2006.13981 · HTML: https://mlsanity.com/paper/2006.13981/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Jun 2020.

## Built on by (most cited first, 8 of 8)

- [Reconstruction-based LSTM-Autoencoder for Anomaly-based DDoS Attack Detection over Multivariate Time-Series Data](https://mlsanity.com/paper/2305.09475/) (2023)
- [Privacy Preservation in Artificial Intelligence and Extended Reality (AI-XR) Metaverses: A Survey](https://mlsanity.com/paper/2310.10665/) (2023)
- [AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation](https://mlsanity.com/paper/2606.08173/) (2026)
- [Classification and Explanation of Distributed Denial-of-Service (DDoS) Attack Detection using Machine Learning and Shapley Additive Explanation (SHAP) Methods](https://mlsanity.com/paper/2306.17190/) (2023)
- [Ensemble Method for System Failure Detection Using Large-Scale Telemetry Data](https://mlsanity.com/paper/2407.00048/) (2024)
- [Convolutional Neural Networks and Mixture of Experts for Intrusion Detection in 5G Networks and beyond](https://mlsanity.com/paper/2412.03483/) (2024)
- [A Hybrid CNN-LSTM Deep Learning Model for Intrusion Detection in Smart Grid](https://mlsanity.com/paper/2509.07208/) (2025)
- [Adversarial Debiasing of Machine Learning Models for Enhanced Network Security against DDoS Attacks](https://mlsanity.com/paper/2609.36167/) (2026)

## Abstract (arXiv)

Software-Defined Networking (SDN) is an emerging paradigm, which evolved in recent years to address the weaknesses in traditional networks. The significant feature of the SDN, which is achieved by disassociating the control plane from the data plane, facilitates network management and allows the network to be efficiently programmable. However, the new architecture can be susceptible to several attacks that lead to resource exhaustion and prevent the SDN controller from supporting legitimate users. One of these attacks, which nowadays is growing significantly, is the Distributed Denial of Service (DDoS) attack. DDoS attack has a high impact on crashing the network resources, making the target servers unable to support the valid users. The current methods deploy Machine Learning (ML) for intrusion detection against DDoS attacks in the SDN network using the standard datasets. However, these methods suffer several drawbacks, and the used datasets do not contain the most recent attack patterns - hence, lacking in attack diversity. In this paper, we propose DDoSNet, an intrusion detection system against DDoS attacks in SDN environments. Our method is based on Deep Learning (DL) technique, combining the Recurrent Neural Network (RNN) with autoencoder. We evaluate our model using the newly released dataset CICDDoS2019, which contains a comprehensive variety of DDoS attacks and addresses the gaps of the existing current datasets. We obtain a significant improvement in attack detection, as compared to other benchmarking methods. Hence, our model provides great confidence in securing these networks.