Detecting and Mitigating DDoS Attacks with AI: A Survey

2025-03-22

AI Summary

Static rule-based approaches for DDoS attack detection and mitigation suffer from poor generalization and severe class ambiguity, hindering accurate attack categorization. Method: We propose the first collaborative classification framework integrating human expert hierarchies with AI-generated dendrograms to resolve long-standing attack-type ambiguities. Our cross-layer AI paradigm spans data governance, adversarial robustness, and proactive mitigation, incorporating LSTM/GNN/Transformer architectures, unsupervised anomaly detection, adversarial training, explainable AI (XAI), and traffic feature engineering. Contribution/Results: We establish a unified evaluation benchmark quantifying trade-offs among accuracy, latency, and generalization across mainstream AI methods. We systematically analyze dataset characteristics and augmentation strategies, and identify seven open challenges—advancing toward AI-driven, closed-loop, autonomous defense systems.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Humans and AI: Human-in-the-loop Machine Learning

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Distributed Denial of Service attacks represent an active cybersecurity research problem. Recent research shifted from static rule-based defenses towards AI-based detection and mitigation. This comprehensive survey covers several key topics. Preeminently, state-of-the-art AI detection methods are discussed. An in-depth taxonomy based on manual expert hierarchies and an AI-generated dendrogram are provided, thus settling DDoS categorization ambiguities. An important discussion on available datasets follows, covering data format options and their role in training AI detection methods together with adversarial training and examples augmentation. Beyond detection, AI based mitigation techniques are surveyed as well. Finally, multiple open research directions are proposed.

Problem

• Surveying AI methods for DDoS attack detection and mitigation
• Providing taxonomy to resolve DDoS categorization ambiguities
• Analyzing datasets and training techniques for AI defenses

Innovation

• AI-based DDoS detection methods
• Taxonomy with expert hierarchies and AI dendrogram
• AI mitigation techniques and adversarial training