Anomaly-Aware Deep Learning for DDos Detection with Optimization and Knowledge Distillation

Abstract

Distributed Denial of Service (DDoS) attacks continue to overwhelm networked systems, demanding detectors that are accurate, low-false-alarm, transferable, and deployable. We propose OSES-DL, an Optimization-guided Statistical Ensemble Synergistic Deep Learning framework that advances all four fronts. The method introduces: (i) an Optimization-driven Feature Evolution Layer (OFEL) that co-trains feature sparsity with accuracy, stability, and entropy preservation; (ii) a Statistical Deep Synergy Module (SDSM) that injects Mahalanobis anomaly priors directly into BiLSTM hidden states, yielding anomaly-aware representations; (iii) Ensemble Knowledge Distillation with class-conditional temperature and feature–logit coupling (EKD-CCT) for calibrated, lightweight deployment; and (iv) a Cross-Domain Generalization Regularizer (CDGR) that combines prior-weighted MMD and CORAL for layer wise domain alignment. On CICDDoS2019, OSES-DL attains 99.45% accuracy, F1 0.994, AUC 0.998, and FAR 0.62%, with ECE 0.9%. Trained on CICDDoS2019 and tested on UNSW-NB15 and CAIDA, it improves F1 by +1.0% and reduces FAR by 0.5%–0.6% over the strongest baseline, while maintaining near-BiLSTM latency. Leave-one-attack-type-out tests confirm robustness to unseen vectors. Ablations attribute FAR reduction to SDSM, calibration to OFEL/EKD, and transferability to CDGR. OSES-DL delivers a principled, operationally grounded detector that is both state-of-the-art and deployment-ready.