DeepLSTMDefense: A Recurrent Learning Framework for DDoS Detection using Network Traffic Sequences

Distributed Denial of Service (DDoS) attacks are still making networks less available, so detection needs to be able to tell the difference between real flash-crowds and fake ones with very precise timing. This paper introduces DeepLSTMDefense, a recurrent sequence-classification pipeline. Network flows are grouped into time-ordered sequences, normalized, and windowed to keep temporal dependencies. Then, stacked Long Short-Term Memory (LSTM) layers are used to model traffic dynamics more accurately than static feature learners. We trained and tested the system using CICDDoS2019 and custom Portmap traces. Compared to classical baselines (Naïve Bayes, Support Vector Machine, Random Forest), consistent gains were made: on CICDDoS2019, the accuracy was 97.9%, the precision was 98.1%, the recall was 97.8%, and the false-alarm rate was 4.3%. This cut the overall error rate from 7.517% to 2.103% (≈72.0% relative reduction). When there was only a small amount of Portmap traffic, the error rate dropped by 39.69%, showing that it works with more than one dataset. These findings were validated by an AUC exceeding 0.98 and by confusion matrices demonstrating elevated sensitivity and specificity across various attack vectors. By framing DDoS detection as sequence classification, it became possible to establish earlier and more dependable trigger points for mitigation without compromising generalization. The stacked-LSTM design was put to use for practical, almost real-time defense.