Forecasting Future DDoS Attacks using Long Short Term Memory (LSTM) Model

International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 DOI:10.5121/ijwmn.2025.17407 87 FORECASTING FUTURE DDOS ATTACKS USING LONG SHORT TERM MEMORY (LSTM) MODEL Kong Mun Yeen 1, Rafidah Md Noor 1, Wahidah Md Shah 2, Aslinda Hassan 2 and Muhammad Umair Munir 1 1 Faculty of Computer Science and Information Technology, Universiti Malaya, Kuala Lumpur, Malaysia 2 Fakulti Teknologi Maklumat dan Komunikasi (FTMK), Universiti Teknikal Malaysia Melaka (UTeM) ABSTRACT This paper forecasts future Distributed Denial-of-Service (DDoS) attacks using deep learning models. Although several studies address forecasting DDoS attacks, they remain relatively limited compared to detection-focused research. By studying the current trends and forecasting based on newer and updated datasets, mitigation plans against the attacks can be planned and formulated. The methodology used in this research work conforms to the Cross Industry Standard Process for Data Mining (CRISP-DM) model. Leveraging cyberattack data from the COVID-19 period (2019–2020), sourced from Digital Attack Map and compiled by Arbor Networks, the study aims to identify recent attack trends and forecast future activity to support proactive mitigation strategies. The dataset was examined using statistical analysis techniques to identify prevailing patterns, with emphasis on the frequency of attacks, the duration of attack instances, and the maximum throughput recorded during each incident. Compared to other deep learning models, the LSTM model is proposed for its ability to learn long-term temporal patterns in evolving DDoS traffic. The performance of LSTM model was evaluated using Mean Squared Error (MSE) under varying neuron counts and window sizes. While the model demonstrated limited predictive accuracy in terms of absolute values, the visual comparison between the predicted and actual data using line charts revealed close alignment in trend patterns. This suggests that the model captures the underlying temporal dynamics of the data, thereby providing a promising foundation for future model optimization and performance enhancement. KEYWORDS DDoS Attack, COVID-19 Cyberattack, Deep Learning, LSTM 1. INTRODUCTION Many cyberattack methods are well known, including but not limited to phishing, spoofing, malware infections, ransomware, and Denial-of-Service (DoS) attacks. A DoS attack occurs when an attacker attempts to disable a service, server, or network. Attackers attempt to make services inaccessible by overwhelming the available resources on the hosting server, infrastructure and/or systems. However, DoS can be easily tracked, as it could contain information about the attacker that can be obtained from network traces and attack logs. Distributed Denial-of-Service (DDoS) is a distributed form of the DoS attack, and it is harder for cybersecurity solutions such as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) to detect. This is because the DDoS attacks originate from multiple sources and target one or more victims simultaneously, making it very difficult to pinpoint the real source of the attack. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 88 Government agencies, healthcare providers, and large organizations are among the main targets of cyberattacks.[1]. It is also reported that there is a 372% increase in DDoS attacks on healthcare organizations since the end of 2020. In Germany, the first fatal death due to a cyberattack on a hospital was reported. A higher increase in DDoS attacks was also reported by Cloudflare in their 2021 Q2 security report[2].By understanding the trends of DDoS attack classes, businesses, governments, and organisations can mitigate the incidents by taking preventive and countermeasures to strengthen network security and resiliency towards DDoS targeted attack classes. 1.1. Issues and Challenges DDoS attacks can generally be classified as signature-based and anomaly-based attacks. Most Intrusion Detection Systems can detect signature-based attacks, as there are patterns in the attacks [3]. Anomaly-based attacks, on the other hand, do not have fixed patterns. Hence, it is harder for existing cybersecurity solutions to detect such attacks. DDoS attacks, which are constantly changing and evolving, will be difficult for organizations and other entities to keep their network security in check. The inability to predict attacks leads to poor mitigation planning, which can ultimately impact business continuity. It is estimated that losses due to cybercrimes can reach $10.5 trillion by 2025[2].Most existing research relies on publicly available datasets such as CAIDA (Center for Applied Internet Data Analysis), NSL-KDD, and CICIDS2017 (datasets available from the Canadian Institute for Cybersecurity) [4]. These datasets are outdated and do not reflect the current DDoS attack trends during the COVID-19 pandemic[5]. On top of that, existing detection models proposed by researchers are more focused on protocol and application and network layer attacks, instead of transportation or exploitation-type attacks[3], [6]. This will potentially increase the false negatives when the datasets do not contain new types of DDoS attacks. Many researchers have presented several approaches to detecting and predicting DDoS attacks using various machine learning algorithms. One of the main limitations of machine learning methods is the amount of data they can process and the time needed to process it. This is in comparison to the deep learning approach, which can handle more data[5]. A study from Sahoo et al.[7]shows that using deep learning is proven to be very efficient in predicting DDoS attacks. 1.2. Potential Solutions In the study of DDoS attacks, the Long Short-Term Memory (LSTM) and Recurrent Neural Network (RNN) are some of the techniques used to develop the machine-learning-based detection and prediction models of DDoS attacks. LSTM and RNN belong to the family of deep learning algorithms. This is due to the ability of this family of deep learning algorithms.LSTM is considered one of the most effective techniques for predicting nonlinear, time-variant data compared to other neural network and machine learning methods[3]. This effectiveness is due to the ability of LSTM to learn longer historical data and the ability to solve the gradient problems associated with the Back Propagation RNN technique [8]. LSTM has also been studied for other time-series-based forecasting, such as traffic speeds and the stock market.A predictive system, rather than one limited to detection, would allow the user or organisation to pre-emptively produce a mitigation plan for defending against such attacks.The proposed solution is a process of predicting DDoS attack trends using datasets gathered from 2019-2021 (during the COVID-19 pandemic). Section 2 provides literature reviews of previous research related to this research topic. Section 3 presents the methodology used in the trend study and prediction of DDoS attacks. It explains various tools and methods that have been employed in this research. Section 4reports findings and explains in detail the interpretation of the findings. Finally, section 6 concludes this research and potential future work. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 89 2. RELATED WORK The COVID-19 pandemic has given opportunities to many cyberattacks, targeting various organisations and critical infrastructure across the globe, including but not limited to healthcare services [9]. Many types of attacks were discovered, such as phishing, malware, communications platform compromise (e.g., Zoom, Microsoft Teams), and Denial-of-Service (DoS). DoS and Distributed DoS (DDoS) are very popular types of attack globally due to their being easy to implement but a lot harder to defend against. Due to this, it could be seen as the most dangerous type of cyberattack [5]. In a study from Khan et. al [10], the top ten deadly cyber-security threats were identified during the COVID-19 pandemic. By analysing the range of cyberattack incidents, the study found loose correlations between key events or announcements and cyberattacks. Among the top 10 threats, DDoS is the top-ranked attack as seen by most government and healthcare organisations. The journal concludes that with the rise of ubiquitous computing, there is an increase in cybersecurity threats as well, thus enforcing the need to increase vigilance in defending against them. Figure 1 categorises the DDoS attack types, the detection and mitigation methods. It also highlights prediction tools and techniques, emphasizing deep learning (e.g., LSTM), machine learning, statistical, and knowledge-based approaches. Figure 1. Taxonomy of DDoS 2.1. DDoS Prediction Algorithms The term prediction can be quite misleading and is used interchangeably in the reviewed journals, which led to a lot of confusion. The term prediction could bring different meanings, depending on the context and usage: detecting if a DDoS attack is being deployed, classifying the type of DDoS attack when detected, or forecasting the future trend of DDoS attacks. In the majority of the journals, the context of prediction refers to predicting if a DDoS attack is happening and classifying the type of attack. In other journals of similar research topics, this is also referred to as DDoS detection. The focus of these journals is the study of features from network measurement logs, such as Wireshark traces, to determine if an attack is happening on the infrastructure and systems. When a DDoS attack is detected, the next step is to classify the type of DDoS attack to immediately react appropriately against the attack. This task may reuse the same features that are employed by DDoS detection algorithms. The topic of classification is generally discussed in the same journals that study the DDoS detection mechanisms. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 90 A minority of journals researched the topic of predicting DDoS attacks on the premise of determining when the attack will happen in the future, based on time-based historical data of known attacks. In some journals, this context of prediction is also called forecasting. This research project’s focus is on this context of prediction. 2.1.1. Machine Learning Algorithms Machine learning algorithms can be generally categorized into three types: supervised, unsupervised, and semi-supervised. In supervised learning, data are labelled and used to train models that classify network traffic according to attack patterns. The model “learns” these patterns from a large dataset and produces a fitted model applicable to similar unseen data[11]. In unsupervised machine learning, data lack labels and are grouped into clusters based on similarities or learned thresholds, while semi-supervised learning refers to both labelled and unlabelled data. However, conventional machine learning often struggles to handle large-scale network traffic effectively. In contrast, deep learning techniques have demonstrated superior performance, producing lower error rates and higher accuracy[12].Researchers have explored multiple deep learning methods to predict DDoS attacks, such as deep multilayer perceptrons (MLP), recurrent neural networks (RNN), long short-term memory (LSTM), convolutional neural networks (CNN), and hybrid combinations, to enhance DDoS detection and forecasting [8], [13]. For example, in [14], Nadeem et al. specifically addressed the challenge of low-rate DDoS (LRDDoS) detection in Software-Defined Networks (SDN), where traditional approaches often fail due to the stealthy nature of attack traffic. They proposed an RNN-based framework that extracts flow-level features from the CIC DoS 2017 dataset (converted via CICFlowMeter) and deploys the model within an SDN controller for real-time detection. Using Mininet and Ryu controller in their experimental setup, the method achieved 98.59% detection accuracy, which resulted in outperforming conventional classifiers such as Random Forest, SVM, MLP, and CNN. Their results demonstrated that RNNs can effectively capture hidden sequential dependencies in traffic flows that make them highly suitable for detecting low-rate DDoS attacks in programmable network environments. Similarly, another study [15], showed that RNNs achieved lower error rates compared with Random Forest and demonstrated their ability to capture longer-term historical dependencies, thereby improving detection performance. In addition, Hnamte et al. [16] proposed a-two-stage deep learning model combining LSTM and Autoencoder (LSTM-AE) for network intrusion detection. The authors evaluated this on CICIDS2017 and CSE-CICIDS2018 datasets; the hybrid model showed robust detection capabilities that significantly reduced both false positives and false negatives in dynamic attack scenarios. Some of the main features used in identifying a DDoS attack are the number of packets, the time it takes to send the packets, the packet rate, and the bit rate. Machine learning-based detection has been used by IDS and IPS solutions too[17]. Several machine learning algorithms have been deployed for this purpose, including but not limited to Naïve Bayes, Random Forest, J48 Decision Tree, Support Vector Machine (SVM), Decision Tree, and Multilayer Perceptron (MLP). By using the said models, detection and classification of DDoS attacks can achieve beyond 90% accuracy rate, some even reaching 99%.Support Vector Machine (SVM) and Linear Regression are proposed by Devi S et al. [18]to predict and classify DDoS attacks on Cloud services. To classify DoS and DDoS attacks, SVM is used as it can be kernelized to solve non-linear classification problems. Linear Regression is used for visualizing and forecasting future attacks, due to its ability to predict target variables on a continuous scale. The approach of the forecast is to determine if packets received are sent by an authentic user or by an attacker. It is found that SVM is quite suitable for the classification of UDP-based attacks and somewhat suitable for TCP attacks. But Linear Regression is not suitable for forecasting as it has a high Mean SquaredError of 488.25 for the training dataset and 473.56 for the test dataset. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 91 Research in Distributed Denial-of-Service (DDoS) attack detection has employed various machine learning (ML) and deep learning methods to enhance prediction accuracy. Sahoo et al.[7] evaluated seven ML algorithms, k-Nearest Neighbour (KNN), Naïve Bayes (NB), Support Vector Machine (SVM), Random Forest (RF), Linear Regression, Artificial Neural Network (ANN), and Decision Trees, focusing on detecting Smurf, UDP Flood, and HTTP Flood attacks. Their comparative analysis demonstrated the varying strengths of each algorithm in classifying attack types. In a different approach, Alguliyev et al. [19] proposed predicting DDoS attacks using social media text analysis, specifically Twitter data from the USA. By performing sentiment analysis and employing Convolutional Neural Network (CNN) and an enhanced Long Short-Term Memory (LSTM) model, their method achieved a prediction accuracy of 0.77, highlighting the potential of non-network data sources in proactive attack forecasting. Similarly,[20]explored deep learning approaches for DDoS attacks forecasting, comparing RNN, LSTM, and GRU algorithms, and found that LSTM outperforms other DL and machine learning models in predicting DDoS traffic with high accuracy up to 20 seconds ahead. The lateststudy[21] evaluates multivariate LSTM models for predicting DDoS attacks, comparing their performance with other machine learning models on the CICDDoS2019 dataset, achieving significantly better results than existing techniques in preventing and mitigating DDoS attacks. On the other hand, Messaoud [22]uses LSTM to classify network traffic, which achieves superior performance in capturing temporal dependencies in network traffic. Deep learning has also been leveraged for more complex pattern recognition. Yuan et al.[15]developed a Bidirectional Recurrent Neural Network (Bi-RNN) model that processed sequences of network traffic traces from large datasets, effectively reducing the error rate from 7.517% to 2.103% compared to conventional ML models. The study suggested future research should explore more diverse DDoS vectors and varied system settings. More recently, Berei et al.[23]used experimental datasets of DoS, DDoS, and normal traffic to evaluate RF, KNN, and SVM models, achieving accuracy levels above 99%. Their use of double feature selection proved effective in mitigating overfitting, reducing model complexity, and improving both training and prediction efficiency. More recently, Afraji et al. [24] examined deep learning-driven defenses for DDoS attacks in cloud environments. The authors categorized the threats into volumetric, protocol, and application-layer types. While CNNs, LSTMs, RNNs, and Autoencoders achieved detection accuracies above 99%, the authors noted key challenges including imbalanced datasets, high computational cost, and the “black-box” nature of DL models. In addition, Kumar et al. [25] proposed a proactive DDoS detection framework using multiple deep learning architectures, including DNN, CNN, and LSTM, that was trained on the CICDDoS2019 dataset. To improve efficiency, the authors applied Pearson Correlation-based feature selection to remove redundant attributes before training. Their evaluation showed that the DNN model achieved the highest accuracy (98.31%), followed by CNN (97.27%) and LSTM (96.78%). While DNN exhibited the best overall classification performance, LSTM recorded the lowest log-loss (0.45) and high recall, making it well-suited for sequence-based detection scenarios. These findings reinforce that different deep learning architectures provide distinct strengths, with DNN excelling in accuracy, CNN in spatial feature extraction, and LSTM in temporal pattern recognition, highlighting the potential of ensemble or hybrid designs for proactive DDoS defense. Similarly, Saini et al. [26] proposed a synthesized K-fold crossvalidation approach to improve the robustness of DDoS detection using multiple ML classifiers. Their framework was tested on several widely used datasets, including CICIDS2017, CICDDoS2019, CSE-CICIDS2018, and NDSec-1, providing a broad evaluation across different traffic conditions. The results showed that Random Forest consistently achieved the highest detection accuracy (up to 99.98%), while other classifiers such as Decision Trees, Logistic Regression, and k-NN also performed well on certain datasets. By combining K-fold validation with diverse ML models, their approach reduced variance, improved generalization, and provided International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 92 a more reliable benchmark for selecting suitable algorithms in practical DDoS detection scenarios. 2.2. DDoS Prevention and Mitigation Bhardwaj et. al [27] study shows that there is no one-shot comprehensive countermeasure against each known DDoS attack. This increases the complication when cyber attackers keep coming up with new vector threatsand attack derivatives that can avoid detection by IDS and IPS solutions. Hence, they conclude that more research is needed to design and develop effective DDoS prevention and mitigation solutions. Due to the difficulty of detecting and predicting DDoS attacks in advance, at the moment, the ideal time to mitigate DDoS attacks would be at the beginning of the attack execution, preventing it from arriving at the target. This approach is also proposed by Jog et al.[12] by forecasting attacks using the ARIMA model. Other mitigation steps also include keeping up to date with security patches. This helps to prevent exploitation-based attacks that target flaws in the implementation of specific protocols. Pranggono & Arabo [28]provides a holistic view of how mitigation and prevention of cyberattacks and DDoS can be approached practically. The preventive steps do not focus on DDoS only, as any weak points can be exploited and contribute to DDoS attacks. User education is very important to bring awareness to how every person and system contributes to a secure infrastructure. The use of Virtual Private Networks (VPN) when working remotely allows a secure working environment, preventing attackers from intercepting communications. Multifactor authentication (MFA) strengthens account logins to prevent unauthorised access. All software applications and firmware versions should be up to date with the latest security patches to prevent exploitation by attackers.In line with proactive defense, Bitit et al. [29] proposed a forecasting-based solution for DDoS attacks. Their system combines time-series forecasting and online change-point detection to anticipate abrupt shifts in attack traffic volume. By dynamically selecting among multiple statistical models and using change-point alerts to adapt the algorithm models, the approach forecasts attack flow counts in real time. The authors evaluated the proposed algorithm on the CICDDoS2019 dataset, and it significantly outperformed traditional methods like ARIMA and Exponential Smoothing. Their design includes a decision-making module that, based on forecasted attack levels, triggers early alerts so administrators can initiate countermeasures before attacks peak. More recently, Gilmary et al. [30] developed an intelligent prevention and mitigation system designed for Software-Defined Networking (SDN). Their approach uses a deep neural network (DNN) model trained on real network traffic to quickly tell apart normal and malicious flows. The system first collects and filters traffic features (such as packet size, flow duration, and protocol type) using methods like PCA and Recursive Feature Elimination (RFE). These features are then fed into the DNN, which classifies the traffic in real time. Once an attack is detected, the SDN controller can reroute traffic, update flow rules, or apply rate limits to reduce the attack’s impact while keeping legitimate traffic running. Their experiments showed high accuracy (above 95%) and fewer false positives, proving the method is effective for large-scale environments like smart city data centers. However, the authors also pointed out some challenges, including the need for large, labelled datasets, high computational cost, and sensitivity to adversarial attacks. They suggested that future improvements could come from semi-supervised learning and stronger anomaly detection techniques. Similarly, Garba et al. [31] proposed a real-time DDoS detection and mitigation framework for SDN-enabled smart home networks. Their system combines machine learning classifiers (Decision Tree, SVM, KNN, Logistic Regression) with a SNORT intrusion detection system to protect both IoT devices and the SDN controller. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 93 Real-world test bed experiments showed that Decision Trees achieved the best performance with up to 99.5% detection accuracy, while SNORT effectively prevented the controller from being taken offline during TCP SYN flood attacks. The framework also applied feature selection (e.g., PCA) to reduce redundancy and improve efficiency. The authors noted limitations such as dataset size, need for labelled data, and exclusion of deep learning, suggesting future extensions with scalable DL methods. Existing research poses several challenges, including the lack of up-to-date datasets (the latest available is the CICDDoS2019 dataset), specific DDoS attack types, limited feature selection processes (specific DDoS attack types), and the need for scalable ML models. Furthermore, while deep learning has shown promise, its real-world deployment feasibility remains an open question due to computational constraints. This study aims to bridge these gaps by utilizing the dataset during the COVID-19 pandemic to systematically compare real network traffic with the prediction by modelling time-series characteristics of attack volume, duration, and throughput, thereby supporting the development of more resilient and forward-looking cybersecurity solutions. 3. METHODOLOGY To ensure a structured and goal-driven approach, the CRISP-DM (Cross Industry Standard Process for Data Mining) framework is adopted. This methodology provides a comprehensive guide through six key phases—from understanding the problem context and preparing the dataset, to model building, evaluation, and deployment. However, in this article, deployment is excluded. 3.1. Dataset Scraping The dataset is scraped from the Digital Attack Map website (https://www.digitalattackmap.com). The website provides live data visualization of DDoS attacks around the globe. It was built through a collaboration between Google Ideas (now known as Google Jigsaw) and Arbor Networks (now part of Netscout Systems after multiple acquisitions). The data is sourced from more than 330 ISPs in the world. It allows users to explore historic trends and find reports of outages happening on a given day, with rich visualization options and flexible filtering. To scrape the data, a Chromium-based browser was used (shown in Figure 2). By using the browser’s DeveloperTools, the HTTP/HTTPS communications between the browser and the server can be observed. From the Network tab, the file attacks_v2.json is found and separately downloaded from https://www.gstatic.com/ddoz-viz/attacks_v2.json. The size of the file is 163.4 Megabytes. Figure 2. Scraping data using Chromium-based browse International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 94 3.2. Data Understanding Since the data is scraped from a source with no documentation, it is critical to explore and understand what is available in the data and how it can be used. Due to the size of the file, common and popular text editors such as Notepad++ cannot be used as the software would crash from the size. So, the file is explored using Python and its relevant libraries. The data was converted into a pandas DataFrame format for easier handling and exploration. This step aims to understand the dataset in a very general manner, the size, scale, and contents of the data. The dataset consists of 9 features (columns) and 192,525 samples (rows). As there is no proper documentation found from the website on what the columns and values represent, the definitions of the columns are assumed and described in Table 1. Some of these columns will be used to infer other information that is useful for statistical analysis and training of the LSTM prediction model. Table 1. Dataset column description Columnname Datatype Assumed column description attack_class STRING Class of attack type. In this dataset, the values are Misuse or Detector. dst_cc []STRING An array of destination countries of systems under attack. dst_ports []STRING An array of destination countries of systems under attack. max_bps INTEGER The maximum bit rate that’s logged during the attack in bits per second. src_cc []STRING An array of source countries of the attacker. src_ports []INTEGER An array of source ports of the attacker. start TIMESTAMP Start time of the attack in Unix timestamp. stop TIMESTAMP Stop time of the attack in Unix timestamp. subclass STRING Subclass of the attack type. In this dataset, the values are Bandwidth, DNS Misuse, ICMP, IP Fragment, Protocol, TCPRST, TCPSYN, Total Traffic, and UDP Misuse. For this research project, the study is done on a global basis. With this consideration, the following columns are dropped from the dataset: dst_cc, dst_ports, src_cc, and src_ports.In this dataset, the attacks are divided into the categories as shown in Table 2. Hence, for the rest of this research project, only the attack subclass is used. Table 2. Attack classes AttackClass AttackSubclass TCPConnection TCPSYN TCPRST TCPACK Protocol Volumetric UDPMisuse ICMP Bandwidth TotalTraffic Fragmentation IPFragment Application DNSMisuse International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 95 3.3. Data Pre-processing Data pre-processing is an important step in most data analysis activities to provide an appropriate platform for statistical analysis and create an accurate prediction model. The dataset may contain numerous ambiguities, duplicates, errors, and redundant values. Some values are also required to be cleaned or massaged to be used effectively. The approach for data cleansing is to first identify the features and target variables in the dataset. Then quickly review the dataset’s value distribution of the features to check for anomalies with the values and decide on the data cleansing and massaging approach. Fortunately, the dataset is already clean with no missing values and imbalances. The next step is to massage the data for more information. 3.3.1. Data Massaging In the previous step, some useful columns werealready identified. Conversions and calculations are performed on the existing columns to enrich the dataset for better statistical analysis and prediction modelling. A. Timestamp conversion The columns start and stop are in Unix timestamp format. It is converted into a human-readable format and stored inthe columns start time and stoptime with the pandas timestamp format. B. Yearly, Monthly, Weekly, and Daily To simplify the aggregation of data, columns for years, months, weeks, and dates are created by extracting the information from the column starttime. The aggregated data is only used for visualization in charts and tables. Additionally, daily aggregated data is used as the input dataset to the LSTM model for forecasting future DDoS attack trends. For reporting the statistical values, only the original data set is used. For example, the monthly aggregated data is not derived from daily aggregated data, as this will calculate averages from averaged data and will cause inaccuracies. C. Count The column count is added with the value 1.0 to simplify the counting of attacks by subclasses and yearly/monthly/weekly/daily periods. When aggregated, the sum is used. D. Duration_min A new column duration_min is added that contains the attack duration via the formula (Stop – Start)/60, to calculate the attack duration in minutes. When aggregated, the average or mean is calculated. E. Max_gbps The original column reports this data in bits per second (bps). The values are converted to Gigabits per second (Gbps) for easier interpretation. When aggregated, the average or mean is calculated. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 102 Figure 9. The Evolving Threat Landscape of DDoS Attacks 5. CONCLUSIONS The LSTM model appears to be an effective approach for predictingattack trends, even though the model evaluation is not very conclusive. This is based on how close the predicted trend line is compared to the actual data.In future research, it is proposed to use an updated data set that contains a better classification of attacks and more dimensions. This allows for more comprehensive statistical analysis per dimension, for example, by industry. New attack types may have also been discovered and classified accordingly. The proposed LSTM model could also be enhanced further to improve the prediction of irregular spikes by adjusting more hyperparameters available to the model or by adding more layers to the neural network. Additionally, a forecasting model that utilizes more features to predict the next timestep value can be developed. ACKNOWLEDGEMENTS The authors would like to thank the Center for Advanced Computing Technology (C-ACT), Fakulti Teknologi Maklumat dan Komunikasi (FTMK), Universiti Teknikal Malaysia Melaka. REFERENCES [1] S. N. Last Name and F. N. Last Name, “Analysis onto the evolving cyber-attack trends during COVID-19 pandemic,” Int. J. Sci. Res. (Raipur), vol. 10, no. 4, pp. 139–144, Apr. 2021. [2] R. Khweiled, Palestine Technical University - Kadoorie, Faculty of Graduate Studies, Tulkarem, P.O. Box 7, Palestine, M. Jazzar, and D. Eleyan, “Cybercrimes during COVID -19 Pandemic,” Int. J. Inf. Eng. Electron. Bus., vol. 13, no. 2, pp. 1–10, Apr. 2021. [3] M. Shurman, R. Khrais, and A. Yateem, “DoS and DDoS attack detection using deep learning and IDS,” Int. Arab J. Inf. Technol., vol. 17, no. 4A, pp. 655–661, July 2020. [4] D.-D. Predicting, Review and Evaluation Study of Feature Selection Methods based on Wrapper Process. [5] I. Ortet Lopes, D. Zou, F. A. Ruambo, S. Akbar, and B. Yuan, “Towards effective detection of recent DDoS attacks: A deep learning approach,” Secur. Commun. Netw., vol. 2021, pp. 1–14, Nov. 2021. [6] Machine Learning Techniques used for the Detection and Analysis of Modern Types of DDoS Attacks. [7] K. S. Sahoo, A. Iqbal, P. Maiti, and B. Sahoo, “A machine learning approach for predicting DDoS traffic in software defined networks,” in 2018 International Conference on Information Technology (ICIT), IEEE, Dec. 2018. doi: 10.1109/icit.2018.00049. [8] M. Arshi, M. D. Nasreen, and K. Madhavi, “A survey of DDOS attacks using machine learning techniques,” E3S Web Conf., vol. 184, p. 01052, 2020. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 103 [9] B. Lindemann, T. Müller, H. Vietz, N. Jazdi, and M. Weyrich, “A survey on long short-term memory networks for time series prediction,” Procedia CIRP, vol. 99, pp. 650–655, 2021. [10] N. A. Khan, S. N. Brohi, and N. Zaman, “Ten deadly cyber security threats amid COVID-19 pandemic,” May 12, 2020. doi: 10.36227/techrxiv.12278792.v1. [11] H. Wang and Y. Li, “Overview of DDoS attack detection in software-defined networks,” IEEE Access, vol. 12, pp. 38351–38381, 2024. [12] M. Jog, M. Natu, and S. Shelke, “Distributed and predictive-preventive defense against DDoS attacks,” in Proceedings of the 16th International Conference on Distributed Computing and Networking, New York, NY, USA: ACM, Jan. 2015. doi: 10.1145/2684464.2684503. [13] E. Yang, S. Jeong, and C. Seo, “Harnessing feature pruning with optimal deep learning based DDoS cyberattack detection on IoT environment,” Sci. Rep., vol. 15, no. 1, p. 17516, May 2025. [14] M. W. Nadeem, H. G. Goh, Y. Aun, and V. Ponnusamy, “A recurrent neural network based method for low-rate DDoS attack detection in SDN,” in 2022 3rd International Conference on Artificial Intelligence and Data Sciences (AiDAS), IEEE, Sept. 2022, pp. 13–18. [15] X. Yuan, C. Li, and X. Li, “DeepDefense: Identifying DDoS attack via deep learning,” in 2017 IEEE International Conference on Smart Computing (SMARTCOMP), IEEE, May 2017. doi: 10.1109/smartcomp.2017.7946998. [16] V. Hnamte, H. Nhung-Nguyen, J. Hussain, and Y. Hwa-Kim, “A novel two-stage deep learning model for network intrusion detection: LSTM-AE,” IEEE Access, vol. 11, pp. 37131–37148, 2023. [17] M. A. Talukder et al., “Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction,” J. Big Data, vol. 11, no. 1, Feb. 2024, doi: 10.1186/s40537-024-00886-w. [18] B. S. Kiruthika Devi, V. J. Saglani, A. V. Gupta, and T. Subbulakshmi, “Classifying and predicting DoS and DDoS attacks on cloud services,” in 2018 2nd International Conference on Trends in Electronics and Informatics (ICOEI), IEEE, May 2018. doi: 10.1109/icoei.2018.8553889. [19] R. M. Alguliyev, R. M. Aliguliyev, and F. J. Abdullayeva, “Deep learning method for prediction of DDoS attacks on social media,” Adv. Data Sci. Adapt. Anal., vol. 11, no. 01n02, p. 1950002, Apr. 2019. [20] Anticipating Cyber Threats: Deep Learning Approaches for DDoS Attacks Forecasting. [21] P. Kumar, C. Kushwaha, D. Sethi, D. Ghosh, P. Gupta, and A. Vidyarthi, “Investigating the performance of multivariate LSTM models to predict the occurrence of Distributed Denial of Service (DDoS) attack,” PLoS One, vol. 20, no. 1, p. e0313930, Jan. 2025. [22] Classification Of Network Traffic Using Machine Learning Models On The NETML Dataset. [23] E. Berei, M. A. Khan, and A. Oun, “Machine learning algorithms for DoS and DDoS cyberattacks detection in real-time environment,” in 2024 IEEE 21st Consumer Communications & Networking Conference (CCNC), IEEE, Jan. 2024, pp. 1048–1049. [24] D. M. A. A. Afraji, J. Lloret, and L. Peñalver, “Deep learning-driven defense strategies for mitigating DDoS attacks in cloud computing environments,” Cyber Security and Applications, no. 100085, p. 100085, Jan. 2025. [25] R. K. Gurugubelli, K. Bhukya, and R. Choppa, “Proactive DDoS attacks detection using deep learning techniques,” IET Conf. Proc., vol. 2024, no. 30, pp. 275–280, Mar. 2025. [26] H. K. Saini, A. P. Sharma, and G. Kaur, “A Synthesized K-fold approach for Detecting DDoS attack using Machine Learning Solutions,” in 2023 International Conference on Integrated Intelligence and Communication Systems (ICIICS), IEEE, Nov. 2023. doi: 10.1109/iciics59993.2023.10420932. [27] A. Bhardwaj, G. V. B. Subrahmanyam, V. Avasthi, H. Sastry, and S. Goundar, “DDoS attacks, new DDoS taxonomy and mitigation solutions — A survey,” in 2016 International Conference on Signal Processing, Communication, Power and Embedded System (SCOPES), IEEE, Oct. 2016. doi: 10.1109/scopes.2016.7955549. [28] B. Pranggono and A. Arabo, “COVID ‐19 pandemic cybersecurity issues,” Internet Technol. Lett., no. itl2.247, Oct. 2020, doi: 10.1002/itl2.247. [29] R. Bitit, A. Derhab, M. Guerroumi, and F. A. Khan, “DDoS attack forecasting based on online multiple change points detection and time series analysis,” Multimed. Tools Appl., vol. 83, no. 18, pp. 53655–53685, Nov. 2023. International Journal of Wireless & Mobile Networks (IJWMN), Vol.17, No. 4, August 2025 104 [30] R. Gilmary, Kaviya, Manvizhi, Arunkumar, and Arunkumar, “Intelligent DDoS attack prevention and mitigation in SDN environment,” in 2025 International Conference on Multi-Agent Systems for Collaborative Intelligence (ICMSCI), IEEE, Jan. 2025, pp. 166–171. [31] U. H. Garba, A. N. Toosi, M. F. Pasha, and S. Khan, “SDN-based detection and mitigation of DDoS attacks on smart homes,” Comput. Commun., vol. 221, pp. 29–41, May 2024. [32] D. Kwon, H. Kim, D. An, and H. Ju, “DDoS attack volume forecasting using a statistical approach,” in 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), IEEE, May 2017. doi: 10.23919/inm.2017.7987432. AUTHORS KONG MUN YEEN is a seasoned telecommunications professional and Senior Consultant at Orbitage, with extensive experience delivering specialized training across Malaysia, Indonesia and many more. She has developed and conducted courses such as Certified Internet Protocol Associate (CIPA), Certified Internet Protocol Engineer (CIPE), GSM & GPRS Overview, 3G Overview, and LTE Planning, Signalling, and Optimization. Previously a Senior Trainer at ULearn, she holds a Bachelor’s Degree in Electrical and Electronics Engineering from Universiti Tenaga Nasional (2003) and a Master of Data Science from Universiti Malaya (2022). RAFIDAH MD NOOR received the BIT degreefrom Universiti Utara Malaysia, in 1998, theM.Sc. degree in computer science from Universiti Teknologi Malaysia, in 2000, and the Ph.D.degree in Computer Science from Lancaster University,U.K., in 2010. She is currently a Professor at theDepartment of Computer Systems and Technology, Faculty of Computer Science and InformationTechnology, Universiti Malaya. Her research is related to the field oftransportation systems in the computer science research domain, includingvehicular networks, wireless networks, network mobility, quality of service,and the Internet of Things. WAHIDAH MD SHAH holds her Bachelor of Information Technology from Universiti Utara Malaysia, Master of Computer Science from Universiti Teknologi Malaysia and PhD in Computer Science from Lancaster University, UK. She is currently a Senior Lecturer in the Department of Computer System and Communication at Universiti Teknikal Malaysia Melaka. She is a member of the Information Security, Digital Forensic, and Computer Networking research group. Her research interests include system and networking, wireless ad-hoc networking, cyber-physical systems (CPS) and IoT related technology. ASLINDA HASSAN received her PhD degree in Electrical Engineering, from Memorial University of Newfoundland, St. John's, NL, Canada in 2014. She received M.Sc. degree in Computer Science, from Universiti Teknologi Malaysia (UTM) and B.Sc. degree in Business Administration with honors, from University of Pittsburgh, Pittsburgh, PA, USA in 2001 and 1999, respectively. In 2004, she joined Universiti Teknikal Malaysia Melaka, where she is currently a Senior Lecturer at Faculty of Information and Communication Technology. Her research interests include in vehicular ad hoc network, vehicular communication, wireless ad-hoc network, wireless sensor network, wireless communication, ad hoc routing protocols, cyber-physical systems (CPS), Internet of Things (IoT), network performance modelling and analysis as well as network programming interfaces. MUHAMMAD UMAIR MUNIR received the B.S.C.S. degree (Hons.) from the University of Central Punjab, in 2017, and the master’s degree in computer science from Universiti Malaya. He is currently a PhD candidate at Universiti Malaya and Research assistant to Professor Rafidah Md Noor and Associate Professor Dr. Ismail Ahmedy. His research interests include the Internet of Things, wireless sensor networks, vehicular communication, and software quality.