Mitigating DDoS attacks through ensemble learning models integrated with two-tier heuristic optimisation techniques for effective cyber defence

The internet is the most effective means of communication in the modern world. Therefore, cyber-attacks are becoming more frequent, and their consequences are becoming increasingly severe. Distributed denial of service (DDoS) is one of the five most effective and costly cyberattacks. DDoS attacks are the most prevalent and expensive in today's evolving cybersecurity landscape. However, their ability to disrupt network services causes significant financial losses and has become an effective means of DDoS detection and prevention, both of which are essential for organisations. Network monitoring and control systems have found it challenging to recognise the numerous classes of denial of service (DoS) and DDoS attacks, as they all work exclusively. Therefore, an effective model is needed for attack detection. A previous study has established that shallow and deep learning (DL) methods are vital for identifying DDoS threats; however, there is a lack of research on time-based features and classification across numerous DDoS threat categories. This manuscript introduces an ensemble learning model integrated with two-tier heuristic optimisation techniques for effective cyber defence (ELMT2HO-ECD) methodology. The primary purpose of the ELMT2HO-ECD methodology is to provide a robust solution for detecting and mitigating DDoS attacks in real time. Initially, the ELMT2HO-ECD approach applies mean normalisation to the data to measure the feature within a specified range. Furthermore, the mountain gazelle optimiser (MGO) approach is utilised for feature extraction. For DDoS attack detection, ensemble DL models, namely convolutional long short‐term memory (ConvLSTM), Wasserstein autoencoder (WAE), and temporal convolutional networks (TCN), are employed. To further enhance the performance of the three ensemble models, hyperparameter tuning is performed using the improved pufferfish optimisation algorithm (IPOA), which optimises the models' parameters to achieve higher accuracy. The ELMT2HO-ECD model is evaluated on the CICIDS2017, CICIDS2018, and CICIDS2019 datasets. Validation of the performance of the ELMT2HO-ECD model demonstrated superior accuracy of 98.93%, 98.43%, and 99.23% compared with existing techniques.