A Comparative Analysis of Autoencoder-Enhanced and Traditional Signature-Based DDoS Detection Using the CICDDoS 2019 Dataset

Distributed Denial of Service (DDoS) attacks pose significant threats to network security, necessitating adaptive and vigorous detection methods. Traditional signature-based detection, while effective and rapid against known attacks, struggles to identify novel and zero-day threats. Conversely, autoencoder-based anomaly detection excels at detecting unknown threats but suffers in speed and detection latency. To address these limitations, this research project proposes a hybrid DDoS detection system that combines signature-based methods with an autoencoder-enhanced anomaly detection model. The system processes incoming traffic through a two-stage pipeline, where SNORT detects known attack signatures in the first stage. Traffic that bypasses the first stage is then analyzed using an autoencoder-based anomaly detection model to detect previously unseen threats. This system is evaluated against a signature-based system using the CICDDoS 2019 dataset, testing metrics such as speed, detection latency, precision, recall, and detection accuracy.  Results demonstrate that a hybrid system mitigates the limitations of both methods, enhancing zero-day attack detection while maintaining efficiency.  This project highlights the advantages of integrating complementary detection methods to improve DDoS mitigation against evolving threats.