  A Distributed Denial-of-service (DDoS) attack is a malicious attempt to
disrupt the regular traffic of a targeted server, service, or network by
sending a flood of traffic to overwhelm the target or its surrounding
infrastructure. As technology improves, new attacks have been developed by
hackers. Traditional statistical and shallow machine learning techniques can
detect superficial anomalies based on shallow data and feature selection,
however, these approaches cannot detect unseen DDoS attacks. In this context,
we propose a reconstruction-based anomaly detection model named
LSTM-Autoencoder (LSTM-AE) which combines two deep learning-based models for
detecting DDoS attack anomalies. The proposed structure of long short-term
memory (LSTM) networks provides units that work with each other to learn the
long short-term correlation of data within a time series sequence. Autoencoders
are used to identify the optimal threshold based on the reconstruction error
rates evaluated on each sample across all time-series sequences. As such, a
combination model LSTM-AE can not only learn delicate sub-pattern differences
in attacks and benign traffic flows, but also minimize reconstructed benign
traffic to obtain a lower range reconstruction error, with attacks presenting a
larger reconstruction error. In this research, we trained and evaluated our
proposed LSTM-AE model on reflection-based DDoS attacks (DNS, LDAP, and SNMP).
The results of our experiments demonstrate that our method performs better than
other state-of-the-art methods, especially for LDAP attacks, with an accuracy
of over 99.
