DDoS_FL: Federated learning architecture approach against DDoS attack

Abstract

The frequency and complexity of DDoS attacks have significantly increased with the growth of the internet, posing severe threats to network security. Traditional machine learning and deep learning-based detection systems often face limitations due to their reliance on centralized data collection, leading to privacy concerns, high computational costs, and challenges in adapting to heterogeneous data distributions. This study proposes DDoS_FL, a federated learning-based model designed to detect DDoS attacks without requiring data sharing between devices. The model has demonstrated effectiveness under both Independent and Identically Distributed (IDD) and Non-Independent and Identically Distributed (Non-IDD) data distributions while preserving data privacy and maintaining high detection accuracy. The proposed model is trained and evaluated using the CIC-DDoS2019 dataset, which includes various types of DDoS attacks. Experimental results show that federated learning significantly reduces training time compared to traditional centralized approaches while achieving detection accuracy ranging from 82% to 97%. Furthermore, the scalability of the model is analyzed based on the number of participating clients, highlighting the advantages of its distributed nature. Comparative analyses confirm that the proposed approach is competitive in both privacy preservation and detection performance. This study demonstrates that federated learning provides an effective solution for detecting DDoS attacks and has significant potential in enhancing network security.

Keywords

• DDoS attack
• Federated learning
• Data privacy
• Deep neural network
• Deep learning
• Information security

DDoS_FL: DDoS saldırısına karşı Federe öğrenme mimarisi yaklaşımı

Abstract

DDoS saldırılarının sıklığı ve karmaşıklığı, internetin büyümesiyle birlikte önemli ölçüde artmış ve ağ güvenliği için ciddi tehditler oluşturmuştur. Geleneksel makine öğrenimi ve derin öğrenme tabanlı tespit sistemleri, genellikle merkezi veri toplama gereksinimi nedeniyle gizlilik ihlalleri, hesaplama maliyetleri ve heterojen veri dağılımına uyum sağlama konularında sınırlamalarla karşılaşmaktadır. Bu çalışma, cihazlar arasında veri paylaşımı gerektirmeden DDoS saldırılarını tespit etmek için federe öğrenme tabanlı bir model olan DDoS_FL’yi önermektedir. Model, hem Independent and Identically Distributed (IDD) hem de Non-Independent and Identically Distributed (Non-IDD) veri dağılımlarında etkinliğini kanıtlamış olup, istemciler arasında veri gizliliğini korurken yüksek tespit doğruluğu sağlamaktadır. Önerilen model, CIC-DDoS2019 veri kümesi kullanılarak eğitilmiş ve farklı DDoS saldırı türlerine karşı test edilmiştir. Deneysel sonuçlar, geleneksel merkezi yaklaşımlara kıyasla federe öğrenmenin eğitim süresini önemli ölçüde azalttığını ve %82 ila %97 arasında değişen tespit doğruluğu elde ettiğini göstermektedir. Ayrıca, istemci sayısına bağlı olarak modelin ölçeklenebilirliği analiz edilmiş ve dağıtık yapısının avantajları ortaya konmuştur. Karşılaştırmalı analizler, önerilen yöntemin hem gizlilik koruması hem de tespit başarımı açısından rekabetçi olduğunu göstermektedir. Bu çalışma, federe öğrenmenin DDoS saldırılarının tespiti için etkili bir yaklaşım sunduğunu ve ağ güvenliğinde önemli bir çözüm olabileceğini ortaya koymaktadır.

Keywords

• DDoS saldırısı
• Federe öğrenme
• Veri gizliliği
• Derin sinir ağı
• Derin öğrenme
• Bilgi güvenliği

References

1. [1] Ganal S, Küçüksille E, Yalçınkaya MA. “PhisherHunter: Module design for automatic detection of phishing websites and preventing user abuse”. Pamukkale University Journal of Engineering Sciences, 29(5), 468-480, 2023.
2. [2] Peng T, Leckie C, Ramamohanarao K. “Survey of network-based defense mechanisms countering the DoS and DDoS problems”. ACM Computing Surveys, 39(1), 3-es, 2007.
3. [3] Sharafaldin I, Lashkari AH, Hakak S, Ghorbani AA. “Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy”. IEEE 2019 International Carnahan Conference on Security Technology, Chennai, India, 1-3 October 2019.
4. [4] Altuncu MA. Developing an intrusion detection and prevention system using machine learning and deep learning methods. PhD Thesis, Kocaeli University, Kocaeli, Türkiye, 2021.
5. [5] McMahan B, Moore E, Ramage D, Hampson S, Arcas BAy. “Communication-efficient learning of deep networks from decentralized data”. Artificial Intelligence and Statistics, Fort Lauderdale, USA, 20-22 April 2017.
6. [6] Sun Y, Esaki H, Ochiai H. “Adaptive intrusion detection in the networking of large-scale LANs with segmented federated learning”. IEEE Open Journal of the Communications Society, 2, 102-112, 2020.
7. [7] Anli YA, Ciplak Z, Sakaliuzun M, Izgu SZ, Yildiz K. “DDoS detection in electric vehicle charging stations: A deep learning perspective via CICEV2023 dataset”. Internet of Things, 28, 101343, 2024.
8. [8] Cil AE, Yildiz K, Buldu A. “Detection of DDoS attacks with feed forward based deep neural network model”. Expert Systems with Applications, 169, 114520, 2021.

9. [9] McMahan B, Moore E, Ramage D, Hampson S, Arcas BA. “Communication-efficient learning of deep networks from decentralized data”. 20th International Conference on Artificial Intelligence and Statistics, Fort Lauderdale, USA, 20-22 April 2017.
10. [10] Dolaat KMM, Erbad A, Ibrar M. “Enhancing global model accuracy: Federated learning for imbalanced medical image datasets”. International Symposium on Networks, Computers and Communications, Paris, France, 23-26 October 2023.
11. [11] Lu Z, Pan H, Dai Y, Si X, Zhang Y. “Federated learning with non-IID data: A survey”. IEEE Internet of Things Journal, 11(11), 19188-19209, 2024.
12. [12] Li T, Sahu AK, Talwalkar A, Smith V. “Federated learning: Challenges, methods, and future directions”. IEEE Signal Processing Magazine, 37(3), 50-60, 2020.
13. [13] Yang Q, Liu Y, Cheng Y, Kang Y, Chen T, Yu H. “Federated learning: Synthesis lectures on artificial intelligence and machine learning”. Synthesis Lectures on Artificial Intelligence and Machine Learning, 13(3), 1-207, 2019.
14. [14] OpenMined. “Pysyft”. https://github.com/OpenMined (11.04.2023).
15. [15] Lim WYB, Luong NC, Hoang DT, Jiao Y, Liang YC, Yang Q, Niyato D, Kim DI, Miao C. “Federated learning in mobile edge networks: A comprehensive survey”. IEEE Communications Surveys and Tutorials, 22(3), 2031-2063, 2020.
16. [16] Zhu X, Wang J, Hong Z, Xia T, Xiao J. “Federated learning of unsegmented Chinese text recognition model”. IEEE 31st International Conference on Tools with Artificial Intelligence, Portland, OR, USA, 4-6 November 2019.
17. [17] Jabłecki P, Ślazyk F, Malawski M. “Federated learning in the cloud for analysis of medical images – experience with open source frameworks”. MICCAI Workshop on Distributed and Collaborative Learning, Lima, Peru, 4-8 October 2021.
18. [18] Yazdinejad A, Parizi RM, Dehghantanha A, Karimipour H. “Federated learning for drone authentication”. Ad Hoc Networks, 120, 102574, 2021.
19. [19] Clayton J, Kontokosta CE, Hong T, Corgnati SP, D’Oca S, et al. “The ASHRAE Great Energy Predictor III competition: Overview and results”. Science and Technology for the Built Environment, 26(10), 1427-1447, 2020.
20. [20] Dasari SV, Mittal K, Bapat J, Das D. “Privacy enhanced energy prediction in smart building using federated learning”. IEEE International IoT, Electronics and Mechatronics Conference, Toronto, Canada, 21-24 April 2021.
21. [21] Mosteiro P, Rijcken E, Zervanou K, Kaymak U, Scheepers F, Spruit M. “Making sense of violence risk predictions using clinical notes”. Health Information Science: 9th International Conference, Amsterdam, USA, 20-23 October 2020.
22. [22] Borger T, Mosteiro P, Kaya H, Rijcken E, Salah AA, Scheepers F, Spruit M. “Federated learning for violence incident prediction in a simulated cross-institutional psychiatric setting”. Expert Systems with Applications, 199, 116720, 2022.
23. [23] Zhao R, Yin Y, Shi Y, Xue Z. “Intelligent intrusion detection based on federated learning aided long short-term memory”. Physical Communication, 42, 101157, 2020.
24. [24] Singh S, Bhardwaj S, Pandey H, Beniwal G. “Anomaly detection using federated learning”. Proceedings of International Conference on Artificial Intelligence and Applications, Singapore, 9-10 July 2020.
25. [25] Tang Z, Hu H, Xu C. “A federated learning method for network intrusion detection”. Concurrency and Computation: Practice and Experience, 34(10), e6812, 2022.
26. [26] Hsu RH, Wang YC, Fan CI, Sun B, Ban T, Takahashi T, Wu TW, Kao SW. “A privacy-preserving federated learning system for Android malware detection based on edge computing”. 15th Asia Joint Conference on Information Security, Taipei, Taiwan, 20-21 August 2020.
27. [27] Sharafaldin I, Lashkari AH, Ghorbani AA. “Toward generating a new intrusion detection dataset and intrusion traffic characterization”. 4th International Conference on Information Systems Security and Privacy, Funchal, Madeira, Portugal, 22-24 January 2018.
28. [28] Vaccari I, Chiola G, Aiello M, Mongelli M, Cambiaso E. “MQTTset, a new dataset for machine learning techniques on MQTT”. Sensors, 20(22), 6578, 2020.
29. [29] Friha O, Ferrag MA, Shu L, Maglaras L, Choo KR, Nafaa M. “FELIDS: Federated learning-based intrusion detection system for agricultural Internet of Things”. Journal of Parallel and Distributed Computing, 165, 17-31, 2022.
30. [30] Sharafaldin I, Lashkari AH, Hakak S, Ghorbani AA. “Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy”. International Carnahan Conference on Security Technology, Chennai, India, 1-3 October 2019.
31. [31] Doriguzzi-Corin R, Siracusa D. “FLAD: Adaptive federated learning for DDoS attack detection”. Computers and Security, 137, 103597, 2024.
32. [32] Canadian Institute for Cybersecurity. “CICDDoS”. https://www.unb.ca/cic/datasets/ddos-2019.html (21.12.2024).
33. [33] Tavallaee M, Bagheri E, Lu W, Ghorbani AA. “A detailed analysis of the KDD CUP 99 data set”. IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, Canada, 8-10 July 2009.
34. [34] Canadian Institute for Cybersecurity. “CICIDS”. https://www.unb.ca/cic/datasets/ids-2017.html (21.12.2024).
35. [35] Chawla NV, Bowyer KW, Hall LO, Kegelmeyer WP. “SMOTE: Synthetic minority over-sampling technique”. Journal of Artificial Intelligence Research, 16, 321-357, 2002.
36. [36] McMahan B, Moore E, Ramage D, Hampson S, Arcas BA. “Communication-efficient learning of deep networks from decentralized data”. 20th International Conference on Artificial Intelligence and Statistics, Fort Lauderdale, USA, 20-22 April 2017.
37. [37] Zhang J, Yu P, Qi L, Liu S, Zhang H. “FLDDoS: DDoS attack detection model based on federated learning”. IEEE 20th International Conference on Trust, Security, and Privacy in Computing and Communications, Shenyang, China, 20-22 October 2021.
38. [38] Moustafa N, Slay J. “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)”. Military Communications and Information Systems Conference, Canberra, Australia, 10-12 November 2015.
39. [39] Li J, Lyu L, Liu X, Zhang X, Lyu X. “FLEAM: A federated learning empowered architecture to mitigate DDoS in industrial IoT”. IEEE Transactions on Industrial Informatics, 18(6), 4059-4068, 2021.
40. [40] CAIDA. “Datasets–DDoS Attack (2007)”. https://data.caida.org/datasets/security/ddos-20070804 (01.09.2022).
41. [41] Ali MN, Imran M, Uddin MS, Kim BS. “Low rate DDoS detection using weighted federated learning in SDN control plane in IoT network”. Applied Sciences, 13(3), 1431, 2023.
42. [42] Jazi HH, Gonzalez H, Stakhanova N, Ghorbani AA. “Detecting HTTP-based application layer DoS attacks on web servers in the presence of sampling”. Computer Networks, 121, 25-36, 2017.
43. [43] Elsayed MS, Le-Khac NA, Jurcut AD. “InSDN: A novel SDN intrusion dataset”. IEEE Access, 8, 165263-165284, 2020.
44. [44] Fotse YSN, Tchendji VK, Velempini M. “Federated learning based DDoS attacks detection in large scale software-defined network”. IEEE Transactions on Computers, 74(1), 101-115, 2025.
45. [45] Zainudin A, Akter R, Kim DS, Lee JM. “FedDDoS: An efficient federated learning-based DDoS attacks classification in SDN-enabled IIoT networks”. 13th International Conference on Information and Communication Technology Convergence, Jeju Island, Republic of Korea, 19-21 October 2022.
46. [46] Matsuda K, Sasaki Y, Xiao C, Onizuka M. “FedMe: Federated learning via model exchange”. SIAM International Conference on Data Mining, Alexandria, USA, 28-30 April 2022.
47. [47] Lee YC, Chien WC, Chang YC. “FedDB: A federated learning approach using DBSCAN for DDoS attack detection”. Applied Sciences, 14(22), 9995, 2024.
48. [48] Ali PJM, Faraj RH, Koya E. “Data normalization and standardization: A technical report”. Machine Learning Technical Reports, Koya University, Koya, Erbil, Iraq, 1(1), 1-6, 2014.
49. [49] Büyüktanır B, Yıldız K, Ülkü EE, Büyüktanır T. “du-CBA: Veriden habersiz ve artırımlı sınıflandırmaya dayalı birliktelik kuralları çıkarma mimarisi”. Journal of the Faculty of Engineering and Architecture of Gazi University, 38(3), 1919-1930, 2023.
50. [50] Demir A, Kulaksız A Y, Büyüktanır B, Büyüktanır B, Yıldız K. “Model Training and Real World Analysis Using Health Data with Federated Learning”. The International Open Source Conference (UAKK 2024), June 2025.
51. [51] Büyüktanır B. “YENİ NESİL MODEL EĞİTİM YAKLAŞIMI: FEDERE ÖĞRENME (NEW GENERATION MODEL EDUCATION APPROACH: FEDERATED LEARNING)”. UBAK DERLEME: International Scientific Compilation Research Congress, No. 1, pp. 208–212, 29 February 2024.
52. [52] Google Brain Team. “TensorFlow”. https://www.tensorflow.org/ (16.06.2023).
53. [53] Chollet F. “Keras”. https://keras.io/ (16.06.2023).
54. [54] McKinney W. “Pandas”. https://pandas.pydata.org/ (16.06.2023).
55. [55] INRIA. “Scikit-learn”. https://scikit-learn.org/stable/ (16.06.2023).
56. [56] Schmidt-Hieber J. “Nonparametric regression using deep neural networks with ReLU activation function”. Annals of Statistics, 48(4), 1875-1897, 2020.
57. [57] Gal Y, Ghahramani Z. “A theoretically grounded application of dropout in recurrent neural networks”. 30th International Conference on Neural Information Processing Systems, Barcelona, Spain, 5-10 December 2016.
58. [58] Vinayakumar R, Alazab M, Soman KP, Poornachandran P, Al-Nemrat A, Venkatraman S. “Deep learning approach for intelligent intrusion detection system”. IEEE Access, 7, 41525-41550, 2019.
59. [59] Bottou L. “Large-scale machine learning with stochastic gradient descent”. 19th International Conference on Computational Statistics, Paris, France, 22-27 August 2010.
60. [60] Campos EM, Saura PF, González-Vidal A, Hernández-Ramos JL, Bernabe JB, Baldini G, Skarmeta A. “Evaluating federated learning for intrusion detection in Internet of Things: Review and challenges”. Computer Networks, 203, 108661, 2022.
61. [61] Büyüktanır B, Altınkaya Ş, Karataş Baydoğmuş G, Yıldız K. “Federated learning in intrusion detection: Advancements, applications, and future directions”. Cluster Computing, 28(7), 1-25, 2025.
62. [62] Yang C, Wang Q, Xu M, Chen Z, Bian K, Liu Y, Liu X. “Characterizing impacts of heterogeneity in federated learning upon large-scale smartphone data”. Proceedings of the Web Conference, Ljubljana, Slovenia, 19-23 April 2021.
63. [63] Abay A, Zhou Y, Baracaldo N, Rajamoni S, Chuba E, Ludwig H. “Mitigating bias in federated learning”. arXiv preprint, arXiv:2012.02447, 2020.
64. [64] Huang T, Lin W, Shen L, Li K, Zomaya AY. “Stochastic client selection for federated learning with volatile clients”. IEEE Internet of Things Journal, 9(20), 20055-20070, 2022.
65. [65] Ozturk O, Buyuktanir B, Baydogmus G K, Yildiz K. “Differential Privacy in Federated Learning: Mitigating Inference Attacks with Randomized Response”. arXiv preprint arXiv:2509.13987, 2025.
66. [66] Hoi SC, Sahoo D, Lu J, Zhao P. “Online learning: A comprehensive survey”. Neurocomputing, 459, 249-289, 2021.
67. [67] Mitra A, Hassani H, Pappas GJ. “Online federated learning”. 60th IEEE Conference on Decision and Control, Austin, USA, 13-15 December 2021.
68. [68] Liu Y, Kang Y, Xing C, Chen T, Yang Q. “A secure federated transfer learning framework”. IEEE Intelligent Systems, 35(4), 70-82, 2020.