Hybrid LSTM–LightGBM Model for Multiclass DDoS Attack Detection in 5G and IoT Networks

The internet has grown from a network of computers into a vast, invisible web connecting billions of everyday objects, from smart thermostats to industrial sensors. This expansion, known as the Internet of Things, relies on high-speed communication systems to keep everything running smoothly. However, this connectivity creates a new kind of vulnerability. Bad actors can launch coordinated digital assaults, flooding these networks with so much traffic that legitimate services stop working. These attacks, called Distributed Denial-of-Service, are becoming faster and more complex, evolving in ways that make them difficult to spot with traditional security tools. For years, security systems have relied on static rules or simple statistical checks to identify trouble, but these methods often struggle to keep up with the rapid, shifting patterns of modern cyber threats.

To address this challenge, researchers Asma Djama, Mohamed Maazouz, Hamza Kheddar, and Muhammet Ali Akcayol have developed a new approach that combines two different types of artificial intelligence. Their work focuses on creating a system that can not only detect these attacks but also understand the timing and sequence of the data flowing through a network. The researchers built a hybrid model that first uses a type of neural network designed to remember sequences, much like how a human might recall the order of events in a story. This part of the system, called Long Short-Term Memory, or LSTM, watches the flow of network traffic over time to spot subtle patterns that indicate an attack is brewing. Once this system has identified these temporal patterns, it passes the information to a second, highly efficient classifier known as LightGBM. This second component acts as a rapid decision-maker, sorting the traffic into specific categories to determine exactly what kind of attack is occurring, if any.

The team tested this combined system using three large, realistic collections of network data that included both normal traffic and various types of malicious attacks. These datasets represented different environments, ranging from standard computer networks to complex setups involving thousands of diverse IoT devices. The results showed that by teaching the system to look at the sequence of events rather than just isolated snapshots of data, the model became significantly better at distinguishing between different types of attacks. In tests involving a dataset of over 450,000 samples representing various flood attacks, the hybrid model correctly identified the nature of the traffic in 97.80% of cases. When tested on another dataset with nearly 400,000 samples, it achieved an accuracy of 96.80%. Perhaps most impressively, on a widely used benchmark dataset containing over 390,000 samples, the system reached an accuracy of 99.89%.

A key finding of the research is that the combination of these two methods outperforms using either one alone. When the researchers tested the decision-making component without the sequence-learning part, the system's ability to tell apart similar-looking attacks dropped noticeably. For instance, the system struggled to distinguish between two specific types of flooding attacks that look very similar in their basic statistics but behave differently over time. By adding the sequence-learning layer, the model could see the difference in how the data packets arrived, leading to a much clearer picture of the threat. The researchers also used a technique called SHAP to look inside the model's decision-making process, ensuring that the system was not just guessing but was actually relying on meaningful features to make its choices. This transparency is crucial for security teams who need to trust the alerts they receive.

Beyond accuracy, the study highlighted that the system is fast enough for real-world use. In a world where attacks happen in milliseconds, a security tool must react instantly. The researchers found that their model could make a prediction in less than a hundredth of a millisecond on the largest datasets, a speed that allows it to be deployed in live networks without slowing them down. This efficiency makes the approach suitable for resource-limited devices, such as the sensors found in smart homes or industrial settings, which cannot handle heavy computational loads. The work suggests that by teaching machines to understand the rhythm of network traffic, security systems can become far more resilient against the evolving tactics of cyber attackers, offering a robust shield for the connected future.