On the other hand, the model obtained a precision of 98.74%, a recall of 97.64%, an F1-score of 98.19%, and an accuracy of 98.22% on CIC IoT 2023 [13]. These measures are graphically compared in Fig. (4), which makes it evident that the model consistently performs well across datasets. These results show how the suggested feature selection method enhances DDoS detection performance while maintaining processing efficiency.

2.4. Self-Attention Mechanisms for DDoS Detection

In order to detect DDoS attacks, Kanthimathi et al. [14] created a novel weighted ensemble-based self-attention framework for Convolutional Neural Network (CNN) models. Moreover, to improve classification accuracy and feature integration, CNNs were integrated with Random Forest, XGBoost, and Long Short-Term Memory (LSTM) by the researchers. The self-attention process was the primary component for increasing feature relevancy, which increased classification effectiveness. With a remarkable precision rating of 98.71%, the existing framework provided accurate DDoS attack detection. These results outperformed standard DDoS detection techniques [14]. This research demonstrates how joint CNN usage with self-attention methods improves detection success for sophisticated attack detection challenges.

2.5. Deep Learning for DDoS Detection

Shaikh et al. [15] created a DDoS attack detection system through their hybrid CNN-LSTM model by incorporating spatial feature extraction within a CNN and temporal feature extraction in an LSTM. Combining CNN and LSTM methods, the hybrid deep learning model demonstrated 99.86% accuracy when analysing the CICDDoS2019 dataset. By implementing the SMOTE technique, researchers balanced an imbalanced dataset of 4.4 million data points to improve the model’s detection of rare attack patterns. This successful implementation demonstrates deep learning system capabilities to recognise and prevent advanced DDoS attacks with strong accuracy [15].

Although deep learning techniques like CNNs and LSTMs offer excellent accuracy, they are less appropriate for DDoS attacks with limited resources since they require massive datasets, much processing power, and lengthy training periods. They are also not interpretable. However, the suggested hybrid machine learning method is more feasible for IoT-based DDoS detection since it provides similar accuracy, less computational cost, and more explainability.

2.6. Evaluation of Machine Learning and Deep Learning Models

Musa & Odokuma, [16] analysed individual machine learning and deep learning models for DDoS defence. The analysed models included Random Forest, Gradient Boosting, and Recurrent Neural Networks (RNNs), which produced 79%, 82% and 99.47% accuracy. Gradient Boosting and Random Forest returned performance levels below RNNs but maintained significant importance for evaluating traditional machine learning modelling capabilities. An unbalanced dataset in DDoS detection tasks was resolved through random under-sampling, which remains a standard technique in the field. The study evaluates different models and shows how RNNs succeed in managing intricate DDoS attack signatures [16, 17].

For smart-city and Internet of Things (IoT) applications, Zahid et al. [18] proposed hybrid deep-learning architectures that combine multiple neural blocks to produce robust detection. These architectures achieve powerful detection rates while dealing with heterogeneous traffic, which helps our decision to combine feature-learning components with classical classifiers to achieve greater generalisation [18].

It was suggested that a hybrid architecture for IoT DDoS detection integrate CNN (for spatial pattern recognition), LSTM (for temporal sequence modelling), and Autoencoders (for anomaly detection). On the CICIoT2023 dataset, the model’s robust detection accuracy showed its scalability and reliability in dynamic IoT traffic conditions [19].

In a recent work, a three-step strategy was developed. Feature selection was the first step that contained correlation with a sequential feature selector and was followed by a hybrid cascade method that combines LSTM to learn sequential patterns and Naive Bayes for classification. The method’s accuracy was 99.91% when tested on CIC-DDoS2019, CIC-IoT2023, and CIC-IoV2024 datasets, with the accuracy of 99.91% proving the usefulness of the hybrid pipelines method that integrates hybrid modelling and feature reduction for effective IoT DDoS detection [20].

The proposed work introduces a novel hybrid framework for IOD DDoS identification, which integrates APA-DDoS benchmark datasets, which contain network traffic features such as source and destination IP Addresses, TCP flags, and packet statistics for training and testing purposes. Ensemble learning with different classifiers is utilised in the existing framework. Concerning the conventional machine learning methods, the suggested method is specifically designed for IOT applications with limited resources, since it provides low computational costs and takes advantage of various algorithms to enhance detection accuracy and generalisation.

3. PROPOSED METHODOLOGY

The detection of a DDoS attack requires multiple steps, including implementing hybrid machine learning techniques. The equations below have been used to train and evaluate the models, improving their performance and effectiveness.

3.1. Data Preprocessing

During data pre-processing, the dataset https://www.kaggle.com/datasets/yashwanthkumbam/apaddos-dataset undergoes data cleaning and data transformation steps. For the normalisation of continuous features (e.g., packet size, duration), the Min-Max scaling method is used:

   (1)

Where:

• X is the raw feature value.
• X_max and X_min are the minimum and maximum values of the feature.

3.2. Feature Engineering

To extract features, we implement statistical methods during feature engineering which calculate the mean and standard deviation (σ) of packet sizes for each timeslot.

   (2)

Where:

•  is the mean value
•  is the sample mean
• n is total number of samples

3.3. Hybrid Model Development

For the hybridisation of machine learning models such as Decision Trees (DT), Random Forest (RF), and Gradient Boosting (GB), the model performance is combined using ensemble learning techniques. A standard ensemble method used is bagging, where each model  in the ensemble votes for a classification, and the final prediction y is determined by majority voting:

   (3)

Where:

•  represent the individual models in the ensemble.

For boosting methods like Gradient Boosting, the model updates iteratively using the following formula for the t-th iteration:

   (4)

Where:

•  is the prediction at iteration t,
• η is the learning rate,
•  is the residual error of the previous model at iteration t.

3.4. Sequential and Temporal Analysis

A network based on GRUs and LSTM networks will act as a sequential pattern predictor for network traffic phenomena. The following equations give the update rules for GRUs:

      a. Update gate:

   (5)

      b. Reset gate:

   (6)

      c. New memory content:

  (7)

      d. Final memory:

   (8)

Where:

• represent the update, reset, and hidden states.
•  is the input at time t.
• σ is the sigmoid activation function, and ⊙ is the element-wise multiplication.
•  is the weight matrix for the input vector 
•  is the weight matrix for the previous hidden state, 
•  bias vector added to the update gate
• ite the weight matrix for the input to the reset gate
•  You are the weight matrix applied to the previous hidden state, 
•  bias vector added to reset gate

3.5. Model Training and Optimisation

Model optimisation needs the adjustment of tuning parameters to maximise model performance. The cross-entropy loss can represent the loss function used during training for classification tasks:

   (9)

Where:

• N is the no. of samples,
•  is the actual label for sample i,
•  is the predicted probability of the positive class for sample i,
• θ are the model parameters.

3.6. Evaluation Metrics

The accuracy of the model will be the primary evaluation metric:

   (10)

Where:

• TP: True Positive
• TN: True Negative
• FN: False Positive
• FP: False Positive

3.7. Real-time Detection and Deployment

The security detection of network traffic functions through an active, real-time deployment of the model. At each time step, the model will calculate the likelihood of an attack based on incoming traffic patterns:

   (11)

Where:

• x represents the feature vector of incoming traffic,
• f(x) is the trained model’s output, representing the probability of the traffic being an attack.

3.8. Continuous Model Improvement

During several training periods, we will receive updated datasets to teach the model fresh attack signatures and modernise network patterns, building ongoing operational benefits. The system maintains feedback loops to process detected attack data, which it uses to train and enhance its predictive models for subsequent attacks.

4. RESULTS AND DISCUSSIONS

Significant research was developed through analysing the APA-DDoS dataset, consisting of 151,200 rows and 23 features, to determine the hybrid machine learning model’s effectiveness for Distributed Denial of Service (DDoS) attack detection. The database contained different feature types, including IP addresses, TCP flags, packet and byte statistics, and attack class labels for identifying benign and unauthorised traffic. According to the correlation heatmap, attack patterns strongly correlate with the three essential features of TCP. Flags: syn and frame. Len and ip.proto.

4.1. Accuracy and Model Performance

The efficacy of several hybrid machine learning models in network event recognition was evaluated through validation, as indicated in Table 2. The primary algorithm in each hybrid configuration was chosen based on its fundamental predictive power. In contrast, the secondary algorithm fulfilled a complementary function by permitting more effective feature extraction, improving bias correction, lowering variance, or improving interpretability.

Table 2. Hybrid machine learning model performance.

For instance, the Random Forest functioned as the primary classifier in the Decision Tree + Random Forest combination [21] because of its ensemble learning capabilities and resistance to overfitting. At the same time, the Decision Tree component-maintained interpretability for security analysts. Combining AdaBoost’s bias-correction mechanism with Bagging’s capacity to reduce variance resulted in a balanced and broadly applicable model. For consistent, high-accuracy classification, Gradient Boosting + Random Forest combined the sequential learning advantages of Gradient Boosting with the robustness of Random Forest. Naïve Bayes + Decision Tree combined the rule-based clarity of Decision Trees with the probabilistic categorisation of Naïve Bayes for high-dimensional feature spaces. Finally, SVM + Neural Network combined the robust boundary detection of SVM with the feature-learning potential of neural networks for intricate traffic patterns. Table 3 shows the constraints for hybrid model selection.

Table 3. Constraints considered for hybrid model selection.

4.2. Graphical Analysis

Accuracy Comparison Bar Plot: The bar plot, presented in Fig. (5), showed that all hybrid models reached 100% detection accuracy for DDoS attacks as presented in Fig. (5).