TAFS-Net: A Transformer Attention-Based Feature Selection and BiLSTM Framework for Intelligent Cloud DDoS Attack Detection Using the BCCC-Packet-2024 Dataset

Dharmesh N. Dhangar1, Dr. Vikram Agrawal2

1Ph. D. Scholar- CE/IT Engineering, Gujarat Technological University, Ahmedabad, Gujarat, India.

2Assistant Professor, Computer Engineering Department, BBIT, Vallabh Vidhyanagar, Anand,

Gujarat, India.

Abstract - Distributed Denial-of-Service (DDoS) attacks continue to pose a significant threat to modern cloud computing environments due to their increasing scale, diversity, and ability to evade conventional intrusion detection systems. Existing machine learning-based detection approaches often rely on static feature selection techniques that fail to adapt to dynamic traffic characteristics, resulting in reduced detection robustness and increased computational overhead. To address these limitations, this paper proposes TAFS-Net, an adaptive deep learning framework that integrates a Transformer-based attention mechanism for dynamic feature selection with a Bidirectional Long Short-Term Memory (BiLSTM) network for traffic classification. The attention module automatically learns the relative importance of network traffic features by exploiting global contextual relationships, thereby eliminating the dependence on manually engineered feature selection methods. The selected discriminative representations are subsequently processed by the BiLSTM classifier to capture temporal dependencies within packet sequences and accurately distinguish benign traffic from DDoS attacks. The proposed framework is evaluated exclusively on the BCCC-Packet-2024 dataset, a recent benchmark designed to represent contemporary cloud network traffic and attack behaviors. Experimental evaluation demonstrates that the proposed architecture achieves superior detection capability while maintaining efficient computational performance and strong generalization across network traffic patterns. The integration of adaptive attention-driven feature selection with temporal sequence learning significantly improves classification reliability compared with conventional deep learning architectures. The proposed framework contributes an intelligent and scalable DDoS detection solution suitable for deployment in next-generation cloud security infrastructures.

Key Words:  Distributed Denial-of-Service (DDoS); Cloud Security; Transformer Attention; Feature Selection; Bidirectional Long Short-Term Memory (BiLSTM); Deep Learning; Intrusion Detection System (IDS); BCCC-Packet-2024 Dataset