IBNS-Based Pattern-Based DDoS Detection Using Neural Networks and Reinforcement Learning

IBNS-Based Pattern-Based DDoS Detection Using Neural Networks and Reinforcement Learning | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article IBNS-Based Pattern-Based DDoS Detection Using Neural Networks and Reinforcement Learning Sneh Kanwar Singh Sidhu, Sikander Singh Cheema This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6468555/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract As current network infrastructures grow in complexity and size, cybersecurity risks such as Distributed Denial-of-Service (DDoS) attacks have evolved to be increasingly sophisticated and difficult to counteract. DDoS attacks exploit network weaknesses by inundating systems with malicious traffic, therefore disrupting services and causing significant operational and financial losses. Static rule-based algorithms, commonly employed in conventional DDoS detection systems, are incapable of adapting to evolving attack patterns. Artificial intelligence (AI) techniques such as neural networks (NNs) and reinforcement learning (RL), offers an effective solution by enabling dynamic and intelligent threat detection. Intent-Based Networking (IBN) is a novel framework that automates network administration by converting overarching business objectives into system settings. IBN security features can be further improved when combined with Pattern Based DDoS Detection, which allows real-time attack detection and mitigation. Neural networks can discern between valid and invalid HTTP traffic through deep learning techniques in massive datasets. Adaptive threat management is possible through persistent network activity learning, making it possible to continually modify and optimize the response strategies to threats. In this paper, a new approach for defending against TCP SYN based DDoS attacks is presented through the fusion of machine learning, reinforcement learning, and intent based networking. While reaction time is enhanced by 43% with RL-based mitigation, the proposed model achieves 99.86% accuracy utilizing ML. The system enhances network protection by adapting security regulations, utilizing up-to-date threat intelligence, and monitoring activity in real-time. Indices of the IBNS architecture improve not only lessen the rate of false positive results 0.0008 FPR, stabilize the network, but also shift into proactive mode engagement to neutralize risks. This innovation strengthens the cybersecurity infrastructure of an institution by reducing the intervention of humans in the detection and tracking of dynamic cycle attacks. IBNS Neural Networks Reinforcement Learning DDoS detection IBNS based DDoS mitigation Traffic Redirection Network Security Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6468555","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":457679809,"identity":"6f8e6581-6105-49e4-88f3-1de24b6b306e","order_by":0,"name":"Sneh Kanwar Singh Sidhu","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA5ElEQVRIiWNgGAWjYBAC+xkMBiA6gR9Z9AA+LQY3oFokG0jWYoBXGYqW280bGH/usMkzPn784ePCtjsM/O0HGA8X4NFiP+dYATPvmbRiszM5xsYz254xSJxJYDg8A58tEjkGzIxthxO33eBhk+ZtO8zAcIOB4TAPAS2MP9v+J26ewf78N0iLPDFaGHjbDiRukGAwYwZpMSCsJQ3ol7bkxBlAv0jPOPeMx/BMYgMBLcnAEGuzS+xvP/7wc0HZHTm544cPf8anBQjYf8BYzMBIBCpmbMCvARkwE4j3UTAKRsEoGKEAAGrUT7B5k2fFAAAAAElFTkSuQmCC","orcid":"","institution":"Punjabi University","correspondingAuthor":true,"prefix":"","firstName":"Sneh","middleName":"Kanwar Singh","lastName":"Sidhu","suffix":""},{"id":457679810,"identity":"ee382701-1c5e-42ec-a9cf-35ccdfecb682","order_by":1,"name":"Sikander Singh Cheema","email":"","orcid":"","institution":"Punjabi University","correspondingAuthor":false,"prefix":"","firstName":"Sikander","middleName":"Singh","lastName":"Cheema","suffix":""}],"badges":[],"createdAt":"2025-04-17 06:23:27","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6468555/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6468555/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":97671226,"identity":"4248cd5f-27fb-42e2-873c-0c6075b01b27","added_by":"auto","created_at":"2025-12-08 09:32:12","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1379798,"visible":true,"origin":"","legend":"","description":"","filename":"IBNDDoSNNRL.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6468555/v1_covered_31bf824a-8565-4a13-a90f-92aae5688e49.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"IBNS-Based Pattern-Based DDoS Detection Using Neural Networks and Reinforcement Learning","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"IBNS, Neural Networks, Reinforcement Learning, DDoS detection, IBNS based DDoS mitigation, Traffic Redirection, Network Security","lastPublishedDoi":"10.21203/rs.3.rs-6468555/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6468555/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eAs current network infrastructures grow in complexity and size, cybersecurity risks such as Distributed Denial-of-Service (DDoS) attacks have evolved to be increasingly sophisticated and difficult to counteract. DDoS attacks exploit network weaknesses by inundating systems with malicious traffic, therefore disrupting services and causing significant operational and financial losses. Static rule-based algorithms, commonly employed in conventional DDoS detection systems, are incapable of adapting to evolving attack patterns. Artificial intelligence (AI) techniques such as neural networks (NNs) and reinforcement learning (RL), offers an effective solution by enabling dynamic and intelligent threat detection. Intent-Based Networking (IBN) is a novel framework that automates network administration by converting overarching business objectives into system settings. IBN security features can be further improved when combined with Pattern Based DDoS Detection, which allows real-time attack detection and mitigation. Neural networks can discern between valid and invalid HTTP traffic through deep learning techniques in massive datasets. Adaptive threat management is possible through persistent network activity learning, making it possible to continually modify and optimize the response strategies to threats. In this paper, a new approach for defending against TCP SYN based DDoS attacks is presented through the fusion of machine learning, reinforcement learning, and intent based networking. While reaction time is enhanced by 43% with RL-based mitigation, the proposed model achieves 99.86% accuracy utilizing ML. The system enhances network protection by adapting security regulations, utilizing up-to-date threat intelligence, and monitoring activity in real-time. Indices of the IBNS architecture improve not only lessen the rate of false positive results 0.0008 FPR, stabilize the network, but also shift into proactive mode engagement to neutralize risks. This innovation strengthens the cybersecurity infrastructure of an institution by reducing the intervention of humans in the detection and tracking of dynamic cycle attacks.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e","manuscriptTitle":"IBNS-Based Pattern-Based DDoS Detection Using Neural Networks and Reinforcement Learning","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-05-19 05:43:50","doi":"10.21203/rs.3.rs-6468555/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"bf409b70-973c-4a9a-8cb0-41cce138333e","owner":[],"postedDate":"May 19th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2025-12-05T04:23:36+00:00","versionOfRecord":[],"versionCreatedAt":"2025-05-19 05:43:50","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6468555","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6468555","identity":"rs-6468555","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}