FORTIFYING FIREWALLS AGAINST EVOLVING DDOS ATTACKS WITH CONTRASTIVE AI AND LLMS
Fuente:
Zenodo
Enregistré dans:
| Auteur principal: | |
|---|---|
| Format: | Recurso digital |
| Publié: |
Zenodo
2026
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866902162288672768 |
|---|---|
| author | SRINIVASARAO DHARMIREDDI, DESIDI NARSIMHA REDDY, MRS. MODUGULA SIVAJYOTHI, MARISETTI KALYAN RAMUDU, ELANGOVAN MUNIYANDY, UDAY KIRAN KASI |
| author_facet | SRINIVASARAO DHARMIREDDI, DESIDI NARSIMHA REDDY, MRS. MODUGULA SIVAJYOTHI, MARISETTI KALYAN RAMUDU, ELANGOVAN MUNIYANDY, UDAY KIRAN KASI |
| contents | <p>Distributed Denial of Service (DDoS) attacks continue to threaten network availability and challenge firewall decision logic. Existing firewall-centric defences often fail to detect low-rate, multi-vector, and carpet-bombing DDoS patterns while meeting inline latency constraints. This paper proposes Contrastive-LLM Firewall (C-LLM-FW), a hybrid defence that integrates self-supervised contrastive representation learning with a distilled Large Language Model (LLM) encoder to produce context-aware flow representations for real-time classification and mitigation. The proposed method pretrained a contrastive encoder on benign flows to form a stable latent manifold and then used an LLM encoder as a contextualizer over short flow-sequence tokens; a compact cross-attentive fusion and a lightweight classifier issued firewall decisions while an enforcement agent applied actions in the Data Plane. Experiments were performed on the publicly available BCCC-cPacket-Cloud-DDoS-2024 corpus and on a simulated urban IoT emulation dataset for large-scale botnet scenarios. The method was compared to XGBoost as a classical baseline and to DoLLM as an advanced LLM baseline. C-LLM-FW improved F1 to 93.5% on the primary dataset, an absolute gain of 2.8 points versus DoLLM and 9.4 points versus XGBoost; inference latency reduced by ~28 ms on average and throughput resilience doubled at 1 Gbps attack injection. The results demonstrate that by leveraging the capabilities of contrastive AI alongside LLM encoders, practical gains in firewall detection accuracy and robustness can be achieved while maintaining production-grade inference latency that is ideal for deployment on the edge.</p> |
| format | Recurso digital |
| id | zenodo_https___doi_org_10_5281_zenodo_20253558 |
| institution | Zenodo |
| language | |
| publishDate | 2026 |
| publisher | Zenodo |
| record_format | zenodo |
| spellingShingle | FORTIFYING FIREWALLS AGAINST EVOLVING DDOS ATTACKS WITH CONTRASTIVE AI AND LLMS SRINIVASARAO DHARMIREDDI, DESIDI NARSIMHA REDDY, MRS. MODUGULA SIVAJYOTHI, MARISETTI KALYAN RAMUDU, ELANGOVAN MUNIYANDY, UDAY KIRAN KASI DDoS Detection, Contrastive Learning, Large Language Models (LLM), Firewall, Hybrid Model. <p>Distributed Denial of Service (DDoS) attacks continue to threaten network availability and challenge firewall decision logic. Existing firewall-centric defences often fail to detect low-rate, multi-vector, and carpet-bombing DDoS patterns while meeting inline latency constraints. This paper proposes Contrastive-LLM Firewall (C-LLM-FW), a hybrid defence that integrates self-supervised contrastive representation learning with a distilled Large Language Model (LLM) encoder to produce context-aware flow representations for real-time classification and mitigation. The proposed method pretrained a contrastive encoder on benign flows to form a stable latent manifold and then used an LLM encoder as a contextualizer over short flow-sequence tokens; a compact cross-attentive fusion and a lightweight classifier issued firewall decisions while an enforcement agent applied actions in the Data Plane. Experiments were performed on the publicly available BCCC-cPacket-Cloud-DDoS-2024 corpus and on a simulated urban IoT emulation dataset for large-scale botnet scenarios. The method was compared to XGBoost as a classical baseline and to DoLLM as an advanced LLM baseline. C-LLM-FW improved F1 to 93.5% on the primary dataset, an absolute gain of 2.8 points versus DoLLM and 9.4 points versus XGBoost; inference latency reduced by ~28 ms on average and throughput resilience doubled at 1 Gbps attack injection. The results demonstrate that by leveraging the capabilities of contrastive AI alongside LLM encoders, practical gains in firewall detection accuracy and robustness can be achieved while maintaining production-grade inference latency that is ideal for deployment on the edge.</p> |
| title | FORTIFYING FIREWALLS AGAINST EVOLVING DDOS ATTACKS WITH CONTRASTIVE AI AND LLMS |
| topic | DDoS Detection, Contrastive Learning, Large Language Models (LLM), Firewall, Hybrid Model. |
| url | https://doi.org/10.5281/zenodo.20253558 |