DDoS Attack Detection With and Without SMOTEENN Dataset Balancing Strategy: Deep Learning Approaches

Andualem Girma; Kibreab Adane

doi:10.47852/bonviewAIA62026187

Authors

Andualem Girma Computing and Software Engineering, Arba Minch University, Ethiopia
Kibreab Adane Computing and Software Engineering, Arba Minch University, Ethiopia https://orcid.org/0000-0002-3021-5059

DOI:

https://doi.org/10.47852/bonviewAIA62026187

Keywords:

deep learning techniques, DDoS attack detection, dataset balancing strategy, SMOTEENN, network traffic analysis, DDoS attacktypes, CICDDoS2019

Abstract

DDoS attacks flood the target systems with bulky, abnormal traffic, rendering them unavailable to benign users, and could lead to the crash of servers or computing devices, a loss of money, and a loss of productivity in time-dependent sectors like banks, airlines, online shopping, and more. Many researchers have sought to address DDoS attack issues using various techniques despite these attacks continuing to rise. To address these concerns, the study employed PRISMA guidelines to excavate open issues from recent and pertinent research articles to provide viable solutions and employed diverse deep-learning models. Each model was fine-tuned and trained with and without the SMOTEENN dataset balancing strategy using diverse train-test-validation splits. When looking at the models’ efficacy, it was evident that all models achieved remarkable accuracy rates on the test dataset following the application of the SMOTEENN dataset balancing strategy. Among others, the combination of the MLP model with SMOTEENN scored the top accuracy of 98.90%. The SMOTEENN technique reduces the FNR and FPR for models like DNN and BiLSTM. While slightly increasing FPR, it lowers FNR for the majority of models, including MLP, LSTM, DCNN, CNN-LSTM, and DNN-AE. Despite significantly improving the accuracy, the SMOTEENN technique did not reduce the model’s train-test computational times. The review findings reveal that applying relevant feature selection strategies could reduce model computational time. The study demonstrates the workflow for DDoS attack detection, classification, and mitigation using the proposed model.

Received: 19 May 2025 | Revised: 10 September 2025 | Accepted: 11 December 2025

Conflicts of Interest

The authors declare that they have no conflicts of interest to this work.

Data Availability Statement

Data sharing is not applicable to this article as no new data were created or analyzed in this study.

Author Contribution Statement

Andualem Girma: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Resources, Data curation, Writing – review & editing, Visualization. Kibreab Adane: Conceptualization, Methodology, Validation, Formal analysis, Investigation, Data curation, Writing – original draft, Writing – review & editing, Supervision.