Lightweight Deep Learning-Based DDoS Detection in SDN-VANET Using LSTM Autoencoder

The primary dataset specified in the manuscript is:

CICDDoS2019 / CIC-DDoS2019

The freelancer must work with the actual dataset files and clearly document:

Dataset files used

Number of samples

Benign samples

DDoS samples

Attack categories used

Features used

Label column

Missing/infinite value handling

Train/validation/test split

Class distribution

The freelancer must NOT fabricate, synthetically modify, oversample, or manipulate the dataset simply to obtain better results without explicitly documenting and obtaining approval for such a methodological change.

3. Proposed Model

The main proposed model is:

LSTM Autoencoder (LSTM-AE)

The intended methodology is anomaly detection:

Preprocess network-flow data.

Select the specified features.

Normalize/standardize the features consistently.

Construct temporal sequences using a sliding window.

Train the LSTM Autoencoder primarily/exclusively on normal traffic.

Reconstruct the input sequences.

Calculate reconstruction error.

Determine an appropriate detection threshold using a validation procedure.

Classify test samples as normal or DDoS.

Calculate the required evaluation metrics.

The freelancer must provide the complete Python implementation and explain every major experimental decision.

4. Comparative Models

The following baseline models should be implemented and evaluated using the SAME experimental dataset/split wherever methodologically appropriate:

Traditional Machine Learning

Random Forest

Support Vector Machine (SVM)

K-Nearest Neighbour (KNN)

Artificial Neural Network (ANN)

Deep Learning

CNN-LSTM

Proposed

LSTM Autoencoder

The comparison must be fair and reproducible.

The freelancer must NOT deliberately weaken the baseline models or tune them unfairly to make LSTM-AE appear superior.

5. Required Metrics

For every applicable model, report:

Accuracy

Precision

Recall

F1-score

ROC-AUC

False Positive Rate (FPR)

False Negative Rate (FNR)

Where applicable, also report:

Confusion Matrix

Training time

Inference time

Number of trainable parameters

Memory/CPU usage

Computational complexity or an appropriate practical efficiency measure

The results should be reported in both:

A complete numerical table

Appropriate graphs/figures

6. LSTM-AE Specific Analysis

For the proposed LSTM Autoencoder, additionally provide:

Reconstruction-error distribution

Normal vs DDoS reconstruction-error plot

Threshold-selection plot

ROC curve

Precision-Recall curve

Confusion matrix

Threshold value used

Performance at the selected threshold

The threshold must be selected using a clearly documented validation procedure and must not be selected merely because it produces the highest test-set performance.

7. Ablation / Additional Experiments

Where computationally feasible, perform the following experiments:

Experiment A – Feature Selection

Compare:

All available selected numerical features

Proposed 13-feature set

Report whether feature reduction affects:

Accuracy

F1

AUC

Training time

Inference time

Experiment B – Sequence Length

Evaluate suitable sequence lengths, for example:

5

10

20

The final sequence length should be selected based on validation performance rather than arbitrarily.

Experiment C – Threshold Sensitivity

Evaluate how the detection performance changes with different thresholds.

This is particularly important for an autoencoder-based anomaly detector.

8. Data Leakage Prevention

This is a critical requirement.

The freelancer must ensure:

The test set is never used for model training.

The test set is not used to tune the model.

The test set is not used to select the final threshold.

Feature-selection procedures do not leak information from the test set.

Scaling parameters are fitted only on the appropriate training data.

Hyperparameter tuning is performed using training/validation data only.

Any sequence construction procedure is documented to avoid train-test contamination.

The freelancer must explicitly explain how data leakage was prevented.

9. Reproducibility

The final implementation must include:

Complete Python source code

requirements.txt/environment details

Dataset preprocessing script

Training script

Testing/evaluation script

Baseline model implementation

Configuration/hyperparameter file if applicable

Random seeds

Saved model files

Saved result files

Generated figures

Generated tables

The code should be executable by another researcher.