The increasing reliance on the internet and its services has made accessibility a fundamental need for users. In this regard, cyber attackers, driven by financial and political motives, make extensive efforts to disrupt services. A prominent example of such endeavors is Distributed Denial-of-Service (DDoS) attacks, which have shown significant growth in recent years, posing a considerable challenge to cybersecurity professionals. One crucial solution in this domain is the real-time and low computational overhead detection of such attacks, applicable across various services. Therefore, this research aims to propose a methodology that addresses the existing challenges and is implementable in practical environments. This thesis focuses on detecting both high-rate and slow-rate DDoS attacks within the network and transport layers. To achieve this, an unsupervised hybrid model is proposed. By preprocessing data, optimal feature extraction in an online manner, and precise training, this model demonstrates promising performance in detecting DDoS attacks. The proposed model, eva‎luated on the most comprehensive and up-to-date dataset available, has improved results in this area. With a detection rate of 99.88% and a false-negative rate of 2.234%, compared to the examined models with rates of 0.26% and 0.076%, respectively, this model demonstrates better performance in this research.

حسين سعيدي

علي فانيان

زينب زالي , محمدحسين منشئي