CDBi-LSTM: A Hybrid Deep Learning Model With Attention-Based Fusion for Efficient DDoS Detection in IoT Environments

We present composite deep bidirectional long short-term memory (CDBi-LSTM), a compact flow-level detector for Internet of Things (IoT) distributed denial of service (DDoS) attacks that couples a CNN stream and a BiLSTM stream, equips each stream with self–attention and residual connections, and combines them via attention-based fusion. To reflect heterogeneous deployments while avoiding dataset bias, we train and evaluate separately on three public benchmarks: CICDDoS2019, NF-BoT-IoT-v3, and NF-ToN-IoT-v3, under a consistent methodology. The model attains excellent performance: 99.95% accuracy on CICDDoS2019 (binary) and 99.85% (7-class), 99.99% on NF-BoT-IoT-v3, and 99.85% on NF-ToN-IoT-v3, with very low false positives/negatives confirmed by confusion matrices. Loss curves show fast and stable convergence. A complexity analysis demonstrates edge viability: MB–scale footprint (approx. 1.38–1.52 MB; 361k–398k parameters), tiny RAM deltas at load (1.70–1.98 MB), and CPU latency in the tens of milliseconds (61.9–69.0 ms). An ablation study isolates the contributions of per-stream self-attention, per-stream residuals, and gated fusion, revealing favourable accuracy-efficiency trade-offs relative to simpler variants. On CICDDoS2019, the method is competitive with or surpasses the state of the art while providing concrete runtime and memory guarantees. Together, these results indicate that CDBi-LSTM is both accurate and deployment-ready for real-time IoT defence, with a clear path to further optimisation and cross-hardware validation.