Lightweight CNN-Based DDoS Detection for Resource-Constrained Edge Networks

Krish Mahadevan; Sejal Dua; Vedanth Ramanathan

arxiv: 2309.05646 · v2 · pith:E6NBBNWAnew · submitted 2023-09-11 · 💻 cs.CR · cs.LG· cs.NI

Lightweight CNN-Based DDoS Detection for Resource-Constrained Edge Networks

Vedanth Ramanathan , Krish Mahadevan , Sejal Dua This is my paper

Pith reviewed 2026-05-24 06:24 UTC · model grok-4.3

classification 💻 cs.CR cs.LGcs.NI

keywords DDoS detectionconvolutional neural networkedge networkslightweight modelflow classificationnetwork securityintrusion detection

0 comments

The pith

A compact CNN classifies DDoS flows from normalized packet data with 0.9883 accuracy and completes test-set processing in 0.28 seconds.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that a supervised convolutional neural network can distinguish malicious DDoS traffic from benign flows when the input consists of fixed-length representations extracted from network packet captures. The architecture applies convolution, dropout, pooling, and a sigmoid output layer after length normalization, producing 0.9883 accuracy, 0.9864 precision, 0.9784 recall, and 0.9824 F1 on previously unseen test flows. These results are obtained on the CIC-DDoS2019 benchmark and are presented as evidence that small models can supply early-warning signals for edge deployments where cloud-scale analysis would be too slow. The work also notes deployment constraints and the value of further cross-dataset checks.

Core claim

The paper demonstrates that a supervised CNN trained on packet-flow representations derived from the CIC-DDoS2019 benchmark dataset, after extraction from PCAP traffic and normalization to fixed length, classifies each flow as benign or malicious using convolution, dropout, pooling, and sigmoid layers and reaches 0.9883 accuracy, 0.9864 precision, 0.9784 recall, and 0.9824 F1 score while processing the evaluated test flows in 0.28 seconds, indicating that compact neural models can provide useful early-warning signals for edge-oriented DDoS detection.

What carries the argument

The compact CNN with convolution, dropout, pooling, and sigmoid classification layers applied to fixed-length normalized packet-flow representations extracted from PCAP traffic.

If this is right

Low-latency classification of DDoS flows becomes feasible on resource-constrained edge devices without requiring cloud-scale resources.
The fixed-length normalization step produces consistent inputs that allow the same compact CNN to handle variable-length packet sequences.
The reported speed of 0.28 seconds for the test set supports use of the model for real-time monitoring close to the network edge.
Discussion of benchmark limitations indicates that cross-dataset evaluation is required before broader deployment.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The detector could be paired with automated mitigation logic that blocks flows immediately upon classification as malicious.
Hardware profiling on actual edge devices would quantify memory footprint and power draw under continuous operation.
Training on multiple benchmarks might reduce sensitivity to the specific attack patterns present in any single dataset.

Load-bearing premise

Performance measured on the CIC-DDoS2019 benchmark after fixed-length flow normalization will generalize to the variety of real-world DDoS traffic and network conditions encountered in resource-constrained edge deployments.

What would settle it

Applying the trained model to flows captured from a live edge network or a second independent DDoS dataset and recording accuracy below 0.90 or F1 below 0.90 would show that the reported benchmark results do not transfer.

read the original abstract

Distributed Denial of Service (DDoS) attacks remain a persistent threat to the availability of Internet services, edge networks, and cyber-physical infrastructure. Although recent AI-security work has increasingly focused on foundation models, autonomous agents, and adversarial robustness, many operational defense tasks still require low-latency classification close to the network edge, where cloud-scale analysis may be too slow or expensive. This paper presents a lightweight supervised deep learning approach for DDoS detection using a convolutional neural network (CNN) trained on packet-flow representations derived from the CIC-DDoS2019 benchmark dataset. The proposed pipeline extracts packet flows from PCAP traffic, normalizes them to fixed-length representations, and classifies each flow as benign or malicious using a compact CNN architecture with convolution, dropout, pooling, and sigmoid classification layers. On a held-out test set of previously unseen flows, the model achieves 0.9883 accuracy, 0.9864 precision, 0.9784 recall, and 0.9824 F1 score, while processing the evaluated test flows in 0.28 seconds. These results suggest that compact neural models can provide useful early-warning signals for edge-oriented DDoS detection. We further discuss deployment constraints, benchmark limitations, and future directions for cross-dataset evaluation, hardware-aware profiling, and integration with mitigation pipelines.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

Standard CNN on CIC-DDoS2019 with good held-out numbers but no evidence the fixed-length flows transfer to real edge traffic.

read the letter

The paper trains a compact CNN on normalized flows from CIC-DDoS2019 and reports 0.988 accuracy plus 0.28-second inference on the test split. That is the core result. It is a clean, supervised classification pipeline aimed at resource-limited edge settings rather than cloud-scale models. The authors normalize packet flows to fixed length, run a small CNN with convolution, dropout, pooling, and sigmoid output, and note the usual deployment issues plus the need for cross-dataset checks. Those choices are reasonable for the stated goal of low-latency edge detection. The metrics are reported on previously unseen flows, which is the right split. They also flag benchmark limitations in the abstract, which keeps the claims grounded. The main weakness is that everything rests on one public dataset after fixed-length normalization. No results on other traffic mixes, encrypted flows, or live edge hardware are shown, so the claim that this gives useful early-warning signals for real deployments stays untested. The abstract also omits the exact train-test procedure, preprocessing code, and hyperparameter details, which limits how far a reader can reproduce or extend the numbers. This work is for groups already running ML-based network monitoring who want a small-footprint baseline on the common CIC-DDoS2019 set. It does not reorganize the field, but the concrete pipeline and timing number could serve as a reference point. I would send it to peer review so the authors can add the missing reproducibility details and any cross-dataset runs they have; the empirical core is solid enough to justify referee time even if the generalization story needs tightening.

Referee Report

2 major / 1 minor

Summary. The paper proposes a lightweight CNN for binary DDoS/benign classification on fixed-length normalized flows extracted from the CIC-DDoS2019 benchmark. It reports 0.9883 accuracy, 0.9864 precision, 0.9784 recall and 0.9824 F1 on a held-out test set together with 0.28 s inference time for the evaluated flows, and argues that the compact architecture is suitable for resource-constrained edge deployment while acknowledging benchmark limitations and the need for future cross-dataset work.

Significance. If the reported metrics prove reproducible and the fixed-length normalization preserves attack semantics, the work supplies a concrete, low-latency baseline that could be useful for early-warning detection at the edge. The explicit discussion of deployment constraints and benchmark limitations is a positive feature; however, the absence of any cross-dataset or live-traffic validation means the claimed practical utility remains an untested extrapolation.

major comments (2)

[Abstract] Abstract: the headline claim that the model supplies 'useful early-warning signals for edge-oriented DDoS detection' rests on generalization from CIC-DDoS2019 fixed-length flows, yet no cross-dataset results, ablation on normalization length, or live edge deployment are reported; this assumption is load-bearing for the central practical contribution.
[Abstract (and implied §3–4)] The manuscript supplies no information on the train-test split method, exact preprocessing pipeline, full layer dimensions, or hyperparameter search procedure; without these details the reported metrics cannot be independently verified or assessed for leakage or overfitting.

minor comments (1)

[Abstract] The abstract states that the model 'processes the evaluated test flows in 0.28 seconds' but does not clarify whether this is per-flow, per-batch, or total wall-clock time, nor on what hardware.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the thoughtful and constructive report. We address each major comment below and indicate the revisions we will make to strengthen the manuscript.

read point-by-point responses

Referee: [Abstract] Abstract: the headline claim that the model supplies 'useful early-warning signals for edge-oriented DDoS detection' rests on generalization from CIC-DDoS2019 fixed-length flows, yet no cross-dataset results, ablation on normalization length, or live edge deployment are reported; this assumption is load-bearing for the central practical contribution.

Authors: We agree that the phrasing in the abstract extrapolates from benchmark results to practical utility. The manuscript already notes benchmark limitations and the need for future cross-dataset work, but the headline claim can be tightened. In revision we will rephrase the abstract to state that the model achieves strong performance on the CIC-DDoS2019 benchmark and may serve as a baseline for edge-oriented detection, while making the absence of cross-dataset or live-traffic validation more explicit. We cannot supply new cross-dataset or deployment experiments in this revision cycle. revision: partial
Referee: [Abstract (and implied §3–4)] The manuscript supplies no information on the train-test split method, exact preprocessing pipeline, full layer dimensions, or hyperparameter search procedure; without these details the reported metrics cannot be independently verified or assessed for leakage or overfitting.

Authors: We acknowledge that these reproducibility details are currently insufficient. In the revised manuscript we will add a dedicated subsection (new §3.2) that fully specifies the train-test split procedure, the complete preprocessing and normalization pipeline, the exact layer dimensions and hyperparameters of the CNN, and the hyperparameter search method. These additions will allow independent verification and assessment of potential leakage or overfitting. revision: yes

Circularity Check

0 steps flagged

No circularity; standard held-out evaluation on external benchmark

full rationale

The paper reports empirical classification metrics (accuracy 0.9883 etc.) obtained by training a CNN on normalized flows from the public CIC-DDoS2019 dataset and evaluating on a held-out split. No equations, fitted parameters, or derivations are presented whose outputs reduce to the inputs by construction. The central performance claim is a direct measurement on external data rather than a self-referential prediction or self-citation chain. The authors explicitly note benchmark limitations and call for future cross-dataset work, confirming the evaluation is not internally forced.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 0 invented entities

The central claim depends on the representativeness of the CIC-DDoS2019 benchmark and standard supervised-learning assumptions about i.i.d. samples and fixed-length flow features; no new entities are postulated.

free parameters (1)

CNN architecture hyperparameters
Layer counts, filter sizes, dropout rates, and pooling choices selected to produce the reported metrics; values not stated in abstract.

axioms (1)

domain assumption CIC-DDoS2019 flows after normalization capture the distinguishing features of DDoS attacks in a manner that supports generalization to edge networks.
Implicit in the decision to train and evaluate exclusively on this benchmark.

pith-pipeline@v0.9.0 · 5773 in / 1363 out tokens · 30703 ms · 2026-05-24T06:24:48.769408+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

26 extracted references · 26 canonical work pages

[1]

K. Jia, C. Liu, Q. Liu, J. Wang, J. Liu, F. Liu, A lightweight ddos detection scheme under sdn context. Cybersecurity 5 (2022). https: //doi.org/10.1186/s42400-022-00128-7

work page doi:10.1186/s42400-022-00128-7 2022
[2]

Netscout ddos threat intelligence report - latest cyber threat intelligence report (2022)

NetScout. Netscout ddos threat intelligence report - latest cyber threat intelligence report (2022). URL https://www.netscout.com/ threatreport/. Retrieved January 18, 2023

work page 2022
[3]

Distributed denial of service: Anatomy and impact of ddos attacks (2023)

AO Kaspersky Lab. Distributed denial of service: Anatomy and impact of ddos attacks (2023). URL https://www.kaspersky. com/resource-center/preemptive-safety/ how-does-ddos-attack-work. Retrieved January 22, 2023

work page 2023
[4]

Malatras, Z

A. Malatras, Z. Stanic, I. Lella, Enisa threat landscape: Transport sector (january 2021 to october 2022). European Union Agency for Cybersecurity 1, 74–80 (2023). https://doi. org/10.2824/553997

work page doi:10.2824/553997 2021
[5]

Bouzoubaa, Y

K. Bouzoubaa, Y. Taher, B. Nsiri, Predict- ing dos-ddos attacks: Review and evaluation study of feature selection methods based on wrapper process. International Journal of Advanced Computer Science and Appli- cations 12(5) (2021). https://doi.org/10. 14569/IJACSA.2021.0120517

work page arXiv 2021
[6]

Zargar, J

S.T. Zargar, J. Joshi, D. Tipper, A survey of defense mechanisms against distributed denial of service (ddos) flooding attacks. IEEE Communications Surveys & Tutorials 15(4), 2046–2069 (2013). https://doi.org/10. 1109/SURV.2013.031413.00127

work page arXiv 2046
[7]

Shameli-Sendi, M

A. Shameli-Sendi, M. Pourzandi, M. Fekih- Ahmed, M. Cheriet, Taxonomy of distributed denial of service mitigation approaches for cloud computing. Journal of Network and Computer Applications 58 (2015). https: //doi.org/10.1016/j.jnca.2015.09.005

work page doi:10.1016/j.jnca.2015.09.005 2015
[8]

Agarwal, N

B. Agarwal, N. Mittal, Hybrid approach for detection of anomaly network traffic using data mining techniques. Procedia Technology 6, 996–1003 (2012)

work page 2012
[9]

Feinstein, D

L. Feinstein, D. Schnackenberg, R. Balupari, D. Kindred, in Proceedings DARPA Informa- tion Survivability Conference and Exposition (2003). https://doi.org/10.1109/discex.2003. 1194894

work page doi:10.1109/discex.2003 2003
[10]

V. Ravi, S. Kp, P. Poornachandran, in Apply- ing Convolutional Neural Network for Net- work Intrusion Detection (2017), pp. 1222–

work page 2017
[11]

https://doi.org/10.1109/ICACCI.2017. 8126009

work page doi:10.1109/icacci.2017 2017
[12]

de Assis, L.F

M.V. de Assis, L.F. Carvalho, J.J. Rodrigues, J. Lloret, M.L. Proen¸ ca Jr, Near real-time security system applied to sdn environments in iot networks using convolutional neural network. Computers & Electrical Engineering 86, 106738 (2020). https://doi.org/https:// doi.org/10.1016/j.compeleceng.2020.106738. URL https://www.sciencedirect.com/ science/artic...

work page doi:10.1016/j.compeleceng.2020.106738 2020
[13]

Mittal, K

M. Mittal, K. Kumar, S. Behal, Deep learn- ing approaches for detecting ddos attacks: A systematic review. Soft Computing pp. 1–37 (2022). https://doi.org/10.1007/ s00500-021-06608-1

work page 2022
[14]

Ddos 2019 dataset (2021)

Canadian Institute for Cybersecurity – UNB. Ddos 2019 dataset (2021). URL https:// www.unb.ca/cic/datasets/ddos-2019.html

work page 2019
[15]

Shaaban, E

A. Shaaban, E. Abd-Elwanis, M. Hussein, in Proceedings—2019 IEEE 9th Interna- tional Conference on Intelligent Comput- ing and Information Systems, ICICIS 2019 (2019), pp. 233–238. https://doi.org/10. 1109/ICICIS46948.2019.9014826

work page arXiv 2019
[16]

T. Kim, B. Kang, M. Rho, S. Sezer, E.G. Im, A multimodal deep learning method for android malware detection using various fea- tures. IEEE Transactions on Information Forensics and Security14(3), 773–788 (2018). https://doi.org/10.1109/TIFS.2018.2866319 12

work page doi:10.1109/tifs.2018.2866319 2018
[17]

Musri, B

N. Musri, B. Christie, S. Ichwan, A. Cahyanto, Deep learning convolu- tional neural network algorithms for the early detection and diagnosis of den- tal caries on periapical radiographs: A systematic review. Imaging Science in Dentistry 51(3), 237–242 (2021). https://doi.org/10.5624/isd.20210074

work page doi:10.5624/isd.20210074 2021
[18]

Choudhary, B

K. Choudhary, B. DeCost, C. Chen, A. Jain, F. Tavazza, R. Cohn, C.W. Park, A. Choud- hary, A. Agrawal, S.J.L. Billinge, E. Holm, S.P. Ong, C. Wolverton, Recent advances and applications of deep learning methods in materials science. npj Computational Mate- rials 8(1) (2022). https://doi.org/10.1038/ s41524-022-00734-6. URL https://doi.org/ 10.1038%2Fs4152...

work page 2022
[19]

Yamashita, M

R. Yamashita, M. Nishio, R. Do, K. Togashi, Convolutional neural networks: an overview and application in radiology. Insights into Imaging 9, 611–629 (2018). https://doi.org/ 10.1007/s13244-018-0639-9

work page doi:10.1007/s13244-018-0639-9 2018
[20]

Sharafaldin, A.H

I. Sharafaldin, A.H. Lashkari, S. Hakak, A.A. Ghorbani, in IEEE 53rd International Car- nahan Conference on Security Technology (2019)

work page 2019
[21]

Doriguzzi-Corin, S

R. Doriguzzi-Corin, S. Millar, S. Scott- Hayward, J. Mart´ ınez-del Rinc´ on, D. Sira- cusa, Lucid: A practical, lightweight deep learning solution for ddos attack detection. IEEE Transactions on Network and Service Management 17(2), 876–889 (2020). https: //doi.org/10.1109/TNSM.2020.2971776

work page doi:10.1109/tnsm.2020.2971776 2020
[22]

Brownlee, A gentle introduction to the rec- tified linear unit (relu)

J. Brownlee, A gentle introduction to the rec- tified linear unit (relu). Machine Learning Mastery 23 (2019)

work page 2019
[23]

Gowdra, R

N. Gowdra, R. Sinha, S. MacDonell, W. Yan, Mitigating severe over-parameterization in deep convolutional neural networks through forced feature abstraction and compression with an entropy-based heuristic. Pattern Recognition 119, 108057 (2021). https://doi. org/10.1016/j.patcog.2021.108057

work page doi:10.1016/j.patcog.2021.108057 2021
[24]

Gholamy, V

A. Gholamy, V. Kreinovich, O. Kosheleva, Why 70/30 or 80/20 relation between train- ing and testing sets: A pedagogical explana- tion. Departmental Technical Reports (CS). (2018). URL https://scholarworks.utep.edu/ cs techrep/1209

work page 2018
[25]

Brownlee, What is the difference between test and validation datasets

J. Brownlee, What is the difference between test and validation datasets. Machine Learn- ing Mastery (2017)

work page 2017
[26]

2023 , issn =

Y. Guo, A review of machine learning-based zero-day attack detection: Challenges and future directions. Computer Communica- tions 198, 175–185 (2023). https://doi.org/ 10.1016/j.comcom.2022.11.001 13

work page doi:10.1016/j.comcom.2022.11.001 2023

[1] [1]

K. Jia, C. Liu, Q. Liu, J. Wang, J. Liu, F. Liu, A lightweight ddos detection scheme under sdn context. Cybersecurity 5 (2022). https: //doi.org/10.1186/s42400-022-00128-7

work page doi:10.1186/s42400-022-00128-7 2022

[2] [2]

Netscout ddos threat intelligence report - latest cyber threat intelligence report (2022)

NetScout. Netscout ddos threat intelligence report - latest cyber threat intelligence report (2022). URL https://www.netscout.com/ threatreport/. Retrieved January 18, 2023

work page 2022

[3] [3]

Distributed denial of service: Anatomy and impact of ddos attacks (2023)

AO Kaspersky Lab. Distributed denial of service: Anatomy and impact of ddos attacks (2023). URL https://www.kaspersky. com/resource-center/preemptive-safety/ how-does-ddos-attack-work. Retrieved January 22, 2023

work page 2023

[4] [4]

Malatras, Z

A. Malatras, Z. Stanic, I. Lella, Enisa threat landscape: Transport sector (january 2021 to october 2022). European Union Agency for Cybersecurity 1, 74–80 (2023). https://doi. org/10.2824/553997

work page doi:10.2824/553997 2021

[5] [5]

Bouzoubaa, Y

K. Bouzoubaa, Y. Taher, B. Nsiri, Predict- ing dos-ddos attacks: Review and evaluation study of feature selection methods based on wrapper process. International Journal of Advanced Computer Science and Appli- cations 12(5) (2021). https://doi.org/10. 14569/IJACSA.2021.0120517

work page arXiv 2021

[6] [6]

Zargar, J

S.T. Zargar, J. Joshi, D. Tipper, A survey of defense mechanisms against distributed denial of service (ddos) flooding attacks. IEEE Communications Surveys & Tutorials 15(4), 2046–2069 (2013). https://doi.org/10. 1109/SURV.2013.031413.00127

work page arXiv 2046

[7] [7]

Shameli-Sendi, M

A. Shameli-Sendi, M. Pourzandi, M. Fekih- Ahmed, M. Cheriet, Taxonomy of distributed denial of service mitigation approaches for cloud computing. Journal of Network and Computer Applications 58 (2015). https: //doi.org/10.1016/j.jnca.2015.09.005

work page doi:10.1016/j.jnca.2015.09.005 2015

[8] [8]

Agarwal, N

B. Agarwal, N. Mittal, Hybrid approach for detection of anomaly network traffic using data mining techniques. Procedia Technology 6, 996–1003 (2012)

work page 2012

[9] [9]

Feinstein, D

L. Feinstein, D. Schnackenberg, R. Balupari, D. Kindred, in Proceedings DARPA Informa- tion Survivability Conference and Exposition (2003). https://doi.org/10.1109/discex.2003. 1194894

work page doi:10.1109/discex.2003 2003

[10] [10]

V. Ravi, S. Kp, P. Poornachandran, in Apply- ing Convolutional Neural Network for Net- work Intrusion Detection (2017), pp. 1222–

work page 2017

[11] [11]

https://doi.org/10.1109/ICACCI.2017. 8126009

work page doi:10.1109/icacci.2017 2017

[12] [12]

de Assis, L.F

M.V. de Assis, L.F. Carvalho, J.J. Rodrigues, J. Lloret, M.L. Proen¸ ca Jr, Near real-time security system applied to sdn environments in iot networks using convolutional neural network. Computers & Electrical Engineering 86, 106738 (2020). https://doi.org/https:// doi.org/10.1016/j.compeleceng.2020.106738. URL https://www.sciencedirect.com/ science/artic...

work page doi:10.1016/j.compeleceng.2020.106738 2020

[13] [13]

Mittal, K

M. Mittal, K. Kumar, S. Behal, Deep learn- ing approaches for detecting ddos attacks: A systematic review. Soft Computing pp. 1–37 (2022). https://doi.org/10.1007/ s00500-021-06608-1

work page 2022

[14] [14]

Ddos 2019 dataset (2021)

Canadian Institute for Cybersecurity – UNB. Ddos 2019 dataset (2021). URL https:// www.unb.ca/cic/datasets/ddos-2019.html

work page 2019

[15] [15]

Shaaban, E

A. Shaaban, E. Abd-Elwanis, M. Hussein, in Proceedings—2019 IEEE 9th Interna- tional Conference on Intelligent Comput- ing and Information Systems, ICICIS 2019 (2019), pp. 233–238. https://doi.org/10. 1109/ICICIS46948.2019.9014826

work page arXiv 2019

[16] [16]

T. Kim, B. Kang, M. Rho, S. Sezer, E.G. Im, A multimodal deep learning method for android malware detection using various fea- tures. IEEE Transactions on Information Forensics and Security14(3), 773–788 (2018). https://doi.org/10.1109/TIFS.2018.2866319 12

work page doi:10.1109/tifs.2018.2866319 2018

[17] [17]

Musri, B

N. Musri, B. Christie, S. Ichwan, A. Cahyanto, Deep learning convolu- tional neural network algorithms for the early detection and diagnosis of den- tal caries on periapical radiographs: A systematic review. Imaging Science in Dentistry 51(3), 237–242 (2021). https://doi.org/10.5624/isd.20210074

work page doi:10.5624/isd.20210074 2021

[18] [18]

Choudhary, B

K. Choudhary, B. DeCost, C. Chen, A. Jain, F. Tavazza, R. Cohn, C.W. Park, A. Choud- hary, A. Agrawal, S.J.L. Billinge, E. Holm, S.P. Ong, C. Wolverton, Recent advances and applications of deep learning methods in materials science. npj Computational Mate- rials 8(1) (2022). https://doi.org/10.1038/ s41524-022-00734-6. URL https://doi.org/ 10.1038%2Fs4152...

work page 2022

[19] [19]

Yamashita, M

R. Yamashita, M. Nishio, R. Do, K. Togashi, Convolutional neural networks: an overview and application in radiology. Insights into Imaging 9, 611–629 (2018). https://doi.org/ 10.1007/s13244-018-0639-9

work page doi:10.1007/s13244-018-0639-9 2018

[20] [20]

Sharafaldin, A.H

I. Sharafaldin, A.H. Lashkari, S. Hakak, A.A. Ghorbani, in IEEE 53rd International Car- nahan Conference on Security Technology (2019)

work page 2019

[21] [21]

Doriguzzi-Corin, S

R. Doriguzzi-Corin, S. Millar, S. Scott- Hayward, J. Mart´ ınez-del Rinc´ on, D. Sira- cusa, Lucid: A practical, lightweight deep learning solution for ddos attack detection. IEEE Transactions on Network and Service Management 17(2), 876–889 (2020). https: //doi.org/10.1109/TNSM.2020.2971776

work page doi:10.1109/tnsm.2020.2971776 2020

[22] [22]

Brownlee, A gentle introduction to the rec- tified linear unit (relu)

J. Brownlee, A gentle introduction to the rec- tified linear unit (relu). Machine Learning Mastery 23 (2019)

work page 2019

[23] [23]

Gowdra, R

N. Gowdra, R. Sinha, S. MacDonell, W. Yan, Mitigating severe over-parameterization in deep convolutional neural networks through forced feature abstraction and compression with an entropy-based heuristic. Pattern Recognition 119, 108057 (2021). https://doi. org/10.1016/j.patcog.2021.108057

work page doi:10.1016/j.patcog.2021.108057 2021

[24] [24]

Gholamy, V

A. Gholamy, V. Kreinovich, O. Kosheleva, Why 70/30 or 80/20 relation between train- ing and testing sets: A pedagogical explana- tion. Departmental Technical Reports (CS). (2018). URL https://scholarworks.utep.edu/ cs techrep/1209

work page 2018

[25] [25]

Brownlee, What is the difference between test and validation datasets

J. Brownlee, What is the difference between test and validation datasets. Machine Learn- ing Mastery (2017)

work page 2017

[26] [26]

2023 , issn =

Y. Guo, A review of machine learning-based zero-day attack detection: Challenges and future directions. Computer Communica- tions 198, 175–185 (2023). https://doi.org/ 10.1016/j.comcom.2022.11.001 13

work page doi:10.1016/j.comcom.2022.11.001 2023