Deep Learning Utilization for DDoS Attack Detection with Federated Learning: A Case Study on the CICDDoS2019 Dataset
Received: 16 August 2025 | Revised: 1 October 2025 | Accepted: 9 October 2025 | Online: 9 February 2026
Corresponding author: Ayoub Alsarhan
Abstract
Modern systems are highly susceptible to Distributed Denial of Service (DDoS) attacks, which often cause major service interruptions and financial losses. These attacks have become more frequent and sophisticated due to the unexpected explosion in the use of wireless technologies, making them more challenging to detect with traditional methods. In this paper we investigate the effective detection of DDoS attacks using deep learning, specifically within a federated learning architecture. The CICDDoS2019 dataset was used to train and evaluate the proposed intrusion detection scheme. Federated learning trains models on several dispersed servers or devices while maintaining local data, thereby preserving user privacy and enabling collaborative learning across clients. The results demonstrate that Federated Deep Learning (FDL) outperforms conventional machine learning algorithms such as Random Forest (RF), Support Vector Machines (SVM), and Recurrent Neural Networks (RNNs), achieving 98% detection accuracy. In addition, the proposed method improves recall and reduces false positives, making it ideal for real-time intrusion detection in dynamic environments.
Keywords:
DDoS detection, deep learning, federated learning, IoTDownloads
References
A. Alnatsheh et al., "Machine Learning-Based Approach for Detecting DDoS Attack in SDN," in 2023 2nd International Engineering Conference on Electrical, Energy, and Artificial Intelligence (EICEEAI), Zarqa, Jordan, Sep. 2023, pp. 1–5. DOI: https://doi.org/10.1109/EICEEAI60672.2023.10590313
A. Sanmorino, L. Marnisah, and H. D. Kesuma, "Detection of DDoS Attacks using Fine-Tuned Multi-Layer Perceptron Models," Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 16444–16449, Oct. 2024. DOI: https://doi.org/10.48084/etasr.8362
P. Chauhan and M. Atulkar, "A Framework for DDoS Attack Detection in SDN-Based IoT Using Hybrid Classifier," in Machine Learning, Image Processing, Network Security and Data Sciences, Singapore, 2023, pp. 889–900. DOI: https://doi.org/10.1007/978-981-19-5868-7_67
M. Shurman, R. Khrais, and A. Yateem, "DoS and DDoS Attack Detection Using Deep Learning and IDS," The International Arab Journal of Information Technology, vol. 17, no. 4A, pp. 655–661, Jul. 2020. DOI: https://doi.org/10.34028/iajit/17/4A/10
M. Mittal, K. Kumar, and S. Behal, "Deep learning approaches for detecting DDoS attacks: a systematic review," Soft Computing, vol. 27, no. 18, pp. 13039–13075, Sep. 2023. DOI: https://doi.org/10.1007/s00500-021-06608-1
H. M. Belachew, M. Y. Beyene, A. B. Desta, B. T. Alemu, S. S. Musa, and A. J. Muhammed, "Design a Robust DDoS Attack Detection and Mitigation Scheme in SDN-Edge-IoT by Leveraging Machine Learning," IEEE Access, vol. 13, pp. 10194–10214, 2025. DOI: https://doi.org/10.1109/ACCESS.2025.3526692
A. A. Alashhab, M. S. M. Zahid, A. Muneer, and M. Abdullahi, "Low-rate DDoS attack Detection using Deep Learning for SDN-enabled IoT Networks," International Journal of Advanced Computer Science and Applications (IJACSA), vol. 13, no. 11, Nov. 2022. DOI: https://doi.org/10.14569/IJACSA.2022.0131141
K. J and A. L. R. P. J, "Mitigate Volumetric DDoS Attack using Machine Learning Algorithm in SDN based IoT Network Environment," International Journal of Advanced Computer Science and Applications (IJACSA), vol. 14, no. 1, Jan. 2023. DOI: https://doi.org/10.14569/IJACSA.2023.0140161
M. Aslam et al., "Adaptive Machine Learning Based Distributed Denial-of-Services Attacks Detection and Mitigation System for SDN-Enabled IoT," Sensors, vol. 22, no. 7, Mar. 2022. DOI: https://doi.org/10.3390/s22072697
J. Wang, Y. Liu, W. Su, and H. Feng, "A DDoS attack detection based on deep learning in software-defined Internet of things," in 2020 IEEE 92nd Vehicular Technology Conference (VTC2020-Fall), Victoria, BC, Canada, Aug. 2020, pp. 1–5. DOI: https://doi.org/10.1109/VTC2020-Fall49728.2020.9348652
R. Doriguzzi-Corin and D. Siracusa, "FLAD: Adaptive Federated Learning for DDoS attack detection," Computers & Security, vol. 137, Feb. 2024, Art. no. 103597. DOI: https://doi.org/10.1016/j.cose.2023.103597
Y.-C. Lee, W.-C. Chien, Y.-C. Chang, Y.-C. Lee, W.-C. Chien, and Y.-C. Chang, "FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection," Applied Sciences, vol. 14, no. 22, Nov. 2024. DOI: https://doi.org/10.3390/app142210236
Y. Alhasawi and S. Alghamdi, "Federated Learning for Decentralized DDoS Attack Detection in IoT Networks," IEEE Access, vol. 12, pp. 42357–42368, 2024. DOI: https://doi.org/10.1109/ACCESS.2024.3378727
H. Cheng, J. Liu, T. Xu, B. Ren, J. Mao, and W. Zhang, "Machine learning based low-rate DDoS attack detection for SDN enabled IoT networks," International Journal of Sensor Networks, vol. 34, no. 1, pp. 56–69, Jan. 2020. DOI: https://doi.org/10.1504/IJSNET.2020.109720
A. Alsarhan et al., "Optimizing Cyber Threat Detection in IoT: A Study of Artificial Bee Colony (ABC)-Based Hyperparameter Tuning for Machine Learning," Technologies, vol. 12, no. 10, Sep. 2024, Art. no. 181. DOI: https://doi.org/10.3390/technologies12100181
I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, "Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy," in 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India, Jul. 2019, pp. 1–8. DOI: https://doi.org/10.1109/CCST.2019.8888419
Downloads
How to Cite
License
Copyright (c) 2025 Ayoub Alsarhan, Malek Barhoush, Bashar Khassawneh, Malik Al-Essa, Mohammad Aljaidi, Qais Al-Na'amneh
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
