Deep Learning-Based Classification of IoT DDoS Attacks Using CNN-LSTM

Abstract

The rapid proliferation of Internet of Things (IoT) devices has significantly increased network connectivity and data exchange but has also made IoT ecosystems highly vulnerable to Distributed Denial of Service (DDoS) attacks. These attacks exploit the limited computational capacity of IoT devices, leading to network congestion, service disruption, and potential system failures. To address this growing concern, this study proposes a Deep Learning-based hybrid Convolutional Neural Network and Long Short-Term Memory (CNN-LSTM) model for the accurate classification of IoT DDoS attacks using the CICIoT2023 dataset. The CNN layers are utilized for automated extraction of spatial and local features from network traffic data, while the LSTM layers effectively capture temporal dependencies to improve detection accuracy and robustness. The model is trained and evaluated on preprocessed network flow features under multiple IoT attack scenarios. Experimental results demonstrate that the proposed CNN-LSTM model achieves superior performance compared to traditional deep learning architectures, attaining an accuracy of 95%, precision of 97%, recall of 94%, F1-score of 95%, Matthews Correlation Coefficient (MCC) of 0.95, and an AUC-ROC value of 0.99. These results confirm the model’s ability to effectively distinguish between normal and attack traffic in complex IoT environments. Overall, the proposed approach provides a reliable, scalable, and data-driven framework for securing IoT networks against DDoS attacks, contributing to the development of more resilient and intelligent intrusion detection systems.