# Reconstruction-based LSTM-Autoencoder for Anomaly-based DDoS Attack Detection over Multivariate Time-Series Data

arXiv: https://arxiv.org/abs/2305.09475 · HTML: https://mlsanity.com/paper/2305.09475/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 33 references that are in the map.
- First posted on arXiv 21 Apr 2023.

## Builds on (most cited first, 4 of 4)

- [Unsupervised and Semi-supervised Anomaly Detection with LSTM Neural Networks](https://mlsanity.com/paper/1710.09207/) (2017)
- [LSTM-Autoencoder based Anomaly Detection for Indoor Air Quality Time Series Data](https://mlsanity.com/paper/2204.06701/) (2022)
- [LUCID: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection](https://mlsanity.com/paper/2002.04902/) (2020)
- [DDoSNet: A Deep-Learning Model for Detecting Network Attacks](https://mlsanity.com/paper/2006.13981/) (2020)

## Built on by (most cited first, 4 of 4)

- [GCP: Guarded Collaborative Perception with Spatial-Temporal Aware Malicious Agent Detection](https://mlsanity.com/paper/2501.02450/) (2025)
- [Early Detection of Forest Calamities in Homogeneous Stands -- Deep Learning Applied to Bark-Beetle Outbreaks](https://mlsanity.com/paper/2503.12883/) (2025)
- [A Hybrid CNN-LSTM Deep Learning Model for Intrusion Detection in Smart Grid](https://mlsanity.com/paper/2509.07208/) (2025)
- [PUL-Inter-slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks](https://mlsanity.com/paper/2510.02236/) (2025)

## Abstract (arXiv)

A Distributed Denial-of-service (DDoS) attack is a malicious attempt to disrupt the regular traffic of a targeted server, service, or network by sending a flood of traffic to overwhelm the target or its surrounding infrastructure. As technology improves, new attacks have been developed by hackers. Traditional statistical and shallow machine learning techniques can detect superficial anomalies based on shallow data and feature selection, however, these approaches cannot detect unseen DDoS attacks. In this context, we propose a reconstruction-based anomaly detection model named LSTM-Autoencoder (LSTM-AE) which combines two deep learning-based models for detecting DDoS attack anomalies. The proposed structure of long short-term memory (LSTM) networks provides units that work with each other to learn the long short-term correlation of data within a time series sequence. Autoencoders are used to identify the optimal threshold based on the reconstruction error rates evaluated on each sample across all time-series sequences. As such, a combination model LSTM-AE can not only learn delicate sub-pattern differences in attacks and benign traffic flows, but also minimize reconstructed benign traffic to obtain a lower range reconstruction error, with attacks presenting a larger reconstruction error. In this research, we trained and evaluated our proposed LSTM-AE model on reflection-based DDoS attacks (DNS, LDAP, and SNMP). The results of our experiments demonstrate that our method performs better than other state-of-the-art methods, especially for LDAP attacks, with an accuracy of over 99.