Peer-reviewed research combines two-level feature selection with neural networks to balance detection accuracy and processing speed.
Cloud platforms support banking, healthcare, retail, government services and other essential digital operations. That dependence also makes them attractive targets for Distributed Denial-of-Service (DDoS) attacks, which flood online systems with malicious traffic and can prevent legitimate users from accessing services.
Traditional detection methods often struggle to keep pace with today’s evolving attack patterns. While deep learning has significantly improved cybersecurity capabilities, many AI models require substantial computational resources, making them difficult to deploy in large-scale production environments.
A newly published peer-reviewed study proposes an artificial-intelligence framework designed to detect these attacks while addressing a practical challenge often overlooked in model development: the computing cost of continuous cybersecurity monitoring.
The peer-reviewed study, “Optimized DDoS Detection in Cloud Using Feedforward Neural Network and Two-Level Feature Selection,” was published in the AIP Conference Proceedings following its presentation at the Second International Conference on Advanced Network Technologies and Computational Intelligence (ICANTCI 2025). The paper was co-authored by Prashant Awasthi and fellow researchers.
Reducing Data Before Detection
The framework uses a two-stage feature-selection process before classifying network traffic. Information Gain first ranks the available traffic characteristics and retains the most informative candidates. Backward Selection then removes features that add little value to the model’s performance. The process reduced the input to 16 selected features, helping make model training more manageable while retaining signals relevant to DDoS detection.
The researchers trained two feedforward neural-network architectures using the CICDDoS2019 benchmark dataset: a Multi-Layer Perceptron (MLP) and a deeper Deep Neural Network (DNN). Both models were designed to classify traffic as benign or malicious.
Accuracy Versus Speed
Both approaches produced test accuracy above 99%. The MLP reached 99.10% test accuracy, while the DNN achieved 99.17% and recorded a slightly lower test loss. The difference in predictive performance was small, but the difference in computing time was more pronounced.
The MLP completed training in about 632 seconds, compared with approximately 1,452 seconds for the DNN. Its prediction time was also roughly half that of the deeper model. The findings suggest that the DNN may be preferred where marginally higher accuracy is the priority, while the MLP may be more practical for resource-constrained or latency-sensitive environments.
“In enterprise cybersecurity, the most accurate model is not automatically the most deployable one,” said Prashant Awasthi, one of the study’s co-authors. “Security teams must also consider prediction latency, infrastructure requirements, scalability and whether a model can operate continuously. Our research evaluates that balance rather than treating accuracy as the only measure of success.”
Potential Enterprise Relevance
The approach may be relevant to cloud providers, financial institutions, healthcare organizations, telecommunications companies, e-commerce platforms, government agencies, managed-security providers and enterprise security operations centers. These organizations must inspect large and changing volumes of traffic while keeping detection delays and infrastructure costs under control.
The study does not establish that either model is ready for immediate production deployment. Testing was conducted with the CICDDoS2019 benchmark dataset rather than live enterprise traffic. The authors identify further validation across additional datasets, larger networks and changing attack patterns as necessary next steps.
Future research will examine convolutional and recurrent neural networks, including LSTM, GRU and RNN models, as well as hybrid and adaptive-learning approaches that can update as new forms of malicious traffic emerge.
About the Research
The article appears in AIP Conference Proceedings, Volume 3410, as paper 020066, and was published on May 21, 2026. Its DOI is 10.1063/5.0330091.
Prashant Awasthi is a technology architecture senior manager with more than 20 years of experience in enterprise software engineering, artificial intelligence, cloud computing and digital transformation. He is also pursuing doctoral research in artificial intelligence at Symbiosis International (Deemed University). His scholarly work spans cybersecurity, cloud automation, software engineering, computer vision and generative AI.
