An enhanced LSTM approach for detecting IoT-based DDoS attacks using honeypot data

Abstract

One of the widening perils in network security is the Distributed Denial of Service (DDoS) attacks on the Internet of Things (IoT) ecosystem. This paper presents an enhanced Intrusion Detection System (IDS) through the proposal of an enhanced version of the long short-term memory (LSTM) model to detect DDoS attacks using honeypot-generated data. The proposed model aggregates the Conv1D, Bidirectional Long Short-Term Memory (Bi-LSTM), Bidirectional Gated Recurrent Unit (Bi-GRU), and dropout layers to extract temporal and spatial features from IoT traffic effectively. We tested the efficacy of the proposed system on a real-world IoT-DH dataset, which showed a remarkable accuracy of 99.41%, with an AUC score of 0.9999. A comparative analysis with other baseline models, such as LSTM, Bidirectional LSTM (Bi-LSTM), Gated Recurrent Unit (GRU), Recurrent Neural Network (RNN), Feedforward Neural Network (FNN), and Temporal Convolutional Network (TCN), proved that enhanced LSTM outperformed the other models. This indicates the robustness of the proposed model in correctly detecting DDoS attacks with high generalization capability for unseen traffic data. The contribution of this paper will be an addition to the deep learning techniques applied for the solution of intrusion detection systems (IDS), which will also allow the building and implementation of more efficient security mechanisms in IoT environments.