Validation of three DDoS attack detection solutions using deep learning with recent datasets

Purpose This study aims to clearly emphasize (i) the use of five-packet sequences to capture temporal and sequential dependencies in network traffic and (ii) the comprehensive evaluation of the RNN, LSTM, and hybrid XGBoost-RNN models using ROC curves, confusion matrices and calibration curves. These analyses provide a more comprehensive assessment of both the predictive performance and the reliability and calibration of the investigated models. The main contribution of this study lies in improving the capture of dependencies between sequential packages by adopting an approach based on the sequences of the five packages. Although relevant, this approach has often been neglected in previous studies. Design/methodology/approach To validate three DDoS detection models (RNN, LSTM, XGBoost-RNN) on recent IoT and SDN data sets, the study uses a of five flow windows approach to capture both short and long-term dependencies. Each data set undergoes extensive preprocessing: outlier handling with IQR, missing-value imputation, MinMaxScaler normalization and one-hot encoding for categorical attributes. XGBoost is used to select relevant features, thereby enhancing training efficiency. Models are trained with the Adam optimizer and evaluated via accuracy, recall, F1-score, confusion matrices, ROC curves and calibration curves. This methodology enables robust performance assessment and demonstrates adaptability across diverse DDoS scenarios. An LLM was used to correct spelling, grammar, sentence structure and to improve the overall manuscript. Findings The results indicate that the RNN, LSTM and XGBoost-RNN models each achieved an accuracy exceeding 98%. Among them, the XGBoost-RNN stands out for its higher accuracy in the IoT environment. The calibration curves show that the LR-HR data set is perfectly calibrated, while the IoT-DH data set had moderate calibration issues for certain classes. The IoT-SDN data set results further confirm the XGBoost-RNN model’s strong performance, especially for multiclass detection. Overall, the study demonstrates the feasibility of reliably detecting DDoS attacks with these deep learning models, though further improvements in calibration would strengthen the reliability of predicted probabilities. Research limitations/implications Although XGBoost-RNN shows strong performance, the study focuses on three data sets, potentially limiting generalization to emerging DDoS patterns. Calibration issues persist for certain classes, indicating the need for further tuning. Deep learning models also require considerable computational resources, which may be a challenge for extremely resource-constrained IoT devices. In addition, relying on labeled data can hamper detection of unknown or zero-day DDoS variants. Future research should consider real-time deployment with adaptive calibration, as well as semi-supervised or unsupervised learning approaches, to enhance model robustness and reliability against novel attack scenarios. Practical implications By analyzing five flow windows, the method captures both short and long-term dependencies, making it suitable for data centers, industrial settings and critical infrastructure. Integration with SDN controllers allows automated threat response and traffic control, enhancing network resilience. However, practical adoption must consider memory constraints, calibration refinements and periodic retraining to address evolving attacks. Despite these challenges, this framework offers a scalable security layer that can be tailored to various IoT environments, reducing downtime and improving overall threat mitigation. Social implications Strengthening DDoS detection in IoT-SDN networks enhances the reliability of interconnected devices and services vital to modern life from healthcare systems and financial institutions to smart homes and public utilities. By mitigating large-scale service disruptions, these solutions contribute to public safety, economic stability and social welfare. Reliable networks also foster wider acceptance of advanced IoT applications, improving resource distribution and bridging digital divides. Moreover, maintaining continuous connectivity reduces the potential for widespread panic or financial fallout caused by cyberattacks. Overall, robust DDoS mitigation strategies enhance societal trust in technology, encouraging broader digital transformation and innovation. Originality/value This study presents a novel approach to seldom-used of five flow windows analysis. By including thorough calibration metrics in addition to standard performance measures, the research provides deeper insight into model robustness and reliability. Furthermore, the validation is performed on recent IoT and SDN data sets, showcasing the adaptability and comprehensive coverage of the proposed methods. The multi-data set validation strategy offers heightened confidence in practical utility, differentiating this work from earlier research that typically focuses on single data sets.