  Distributed Denial of Service (DDoS) attacks are one of the most harmful
threats in today's Internet, disrupting the availability of essential services.
The challenge of DDoS detection is the combination of attack approaches coupled
with the volume of live traffic to be analysed. In this paper, we present a
practical, lightweight deep learning DDoS detection system called LUCID, which
exploits the properties of Convolutional Neural Networks (CNNs) to classify
traffic flows as either malicious or benign. We make four main contributions;
(1) an innovative application of a CNN to detect DDoS traffic with low
processing overhead, (2) a dataset-agnostic preprocessing mechanism to produce
traffic observations for online attack detection, (3) an activation analysis to
explain LUCID's DDoS classification, and (4) an empirical validation of the
solution on a resource-constrained hardware platform. Using the latest
datasets, LUCID matches existing state-of-the-art detection accuracy whilst
presenting a 40x reduction in processing time, as compared to the
state-of-the-art. With our evaluation results, we prove that the proposed
approach is suitable for effective DDoS detection in resource-constrained
operational environments.
