DAG: A Lightweight and Real-Time Edge Defense Model for IoT DDoS Attacks

Internet-of-Things (IoT) devices are increasingly used in people's lives and production in various industries. To detect and defend against Denial-of-Service (DDoS) attacks that occur on IoT networks, a lot of methods based on machine learning and deep learning have been proposed in recent years. However, these methods usually do not consider the limitation of computational resources of IoT devices. In this paper, we propose an edge model DDoS-Attack-Guard (DAG) based on Bi-GRU and ShuffleNet for DDoS identification and classification with the target of lightweight and real-time. To demonstrate the performance of our models, we use the CICDDoS2019 dataset to test the identification and classification accuracy as well as the model inference time. In addition, we build a multi-layer coder-decoder structure that can extract the potential temporal contextual features of DDoS traffic, and introduce a reconstruction structure that can improve model training. Through ablation experiments and comparative experiments, our model has an average inference speed of 2.5ms across different data sizes, which is 50% faster than the Sota method, while hitting 99.3% and 99.9% accuracy in identification and classification respectively.