Organizations deploy web servers to provide websites, web applications, APIs, and other online services. These services receive HTTP requests from clients and process incoming network traffic to deliver application functionality.
Distributed Denial-of-Service (DDoS) attacks attempt to disrupt service availability by generating excessive traffic from multiple sources or through distributed systems. When incoming traffic exceeds the capacity of a web server or its supporting resources, legitimate users may experience slow responses, connection failures, or temporary service unavailability.
Traditional security mechanisms may use predefined traffic thresholds, connection limits, or known attack patterns to identify suspicious activity. However, traffic characteristics can vary across attack types, traffic volumes, and legitimate usage patterns. Deep learning provides an additional approach by learning patterns from labelled network traffic records and classifying traffic according to its observed characteristics.
In this use case, an Nginx web server is deployed on Ubuntu within an isolated laboratory environment. Kali Linux is used as the controlled security-testing system. VirtualBox provides the virtualized environment in which the web server and testing system operate.
A public DDoS traffic dataset is used as the existing data source for the machine-learning stage. Normal and DDoS traffic records are selected and processed to extract the numerical features required for model training. The dataset is obtained from an existing public source rather than manually created for this project.
A One-Dimensional Convolutional Neural Network (1D CNN) is used to learn patterns in the processed network traffic features and classify traffic as normal or DDoS-related. The model is evaluated using held-out dataset records before being integrated into the laboratory traffic-analysis workflow.
During practical validation, network traffic associated with normal web-server activity and controlled security testing is captured and processed. The trained model evaluates the extracted features and produces a traffic classification result. The detection result is then used to trigger or recommend a controlled mitigation action, such as applying rate limits or a restrictive firewall rule within the laboratory.
The mitigation mechanism is evaluated separately to determine whether it reduces the impact of controlled test traffic while preserving legitimate access. The experiment also measures detection performance and inference time to assess the feasibility of the proposed workflow.
Public DDoS Traffic Dataset → Data Preprocessing → Traffic Feature Extraction → 1D CNN Training → Model Evaluation → Nginx Web Server on Ubuntu → Network Traffic Capture → Feature Extraction → DDoS Traffic Classification → Detection Decision → Controlled Mitigation → Mitigation Validation
Service: Nginx Web Server on Ubuntu
Nginx is the target web-server service in this use case. It receives and processes HTTP requests from clients and provides web content or application access.
The Nginx service is deployed within an isolated laboratory environment so that legitimate traffic, controlled test traffic, and mitigation behavior can be observed without affecting external systems.
Web servers depend on available network bandwidth, connection capacity, CPU resources, memory, and supporting application resources to process incoming requests. A DDoS attack can generate a high volume of traffic that competes with legitimate client requests for these resources.
If excessive traffic is not identified and handled appropriately, the web server may experience degraded performance, increased response times, connection exhaustion, or temporary service unavailability.
Traditional threshold-based detection can identify traffic that exceeds configured limits, but fixed thresholds may not adequately distinguish all legitimate traffic surges from malicious activity. A detection approach that analyzes multiple traffic characteristics can provide additional information for identifying potential DDoS activity.
The proposed solution uses a 1D CNN trained on an existing public DDoS traffic dataset to classify network traffic based on extracted features. The model's output is evaluated against captured traffic and used within a controlled mitigation workflow. Detection performance and the effect of mitigation on legitimate access are measured during laboratory testing.
Specific Attack: Controlled Distributed Denial-of-Service Traffic Test Against an Nginx Web Server
The controlled attack scenario evaluates whether the proposed detection workflow can identify DDoS-related traffic patterns and support a mitigation response against the Nginx web server.
Testing is restricted to the isolated VirtualBox laboratory. The objective is to generate controlled traffic for evaluating detection and mitigation, not to disrupt public services or external systems.
The test traffic is captured and processed using the same feature representation expected by the trained model. The resulting prediction is compared with the known test scenario to evaluate whether the model identifies the traffic correctly.
Deep Learning-Based DDoS Detection and Adaptive Traffic Mitigation
The primary security concept is deep learning-based network traffic classification combined with controlled DDoS mitigation.
The first objective is to establish a labelled traffic representation using an existing public DDoS traffic dataset. Normal and DDoS-related records are processed into numerical features suitable for the 1D CNN model.
The second objective is to evaluate whether the trained model can distinguish normal traffic from DDoS-related traffic. The model's predictions are assessed using held-out data and controlled laboratory traffic. Real-time performance is measured separately rather than assumed from offline classification results.
The third objective is to connect the detection result to a controlled mitigation mechanism. When the detection criteria are satisfied, the laboratory system can apply a predefined rate-limiting or firewall action. The resulting effect on server responsiveness and legitimate client access is then evaluated.
The security concept defines the overall security strategy.
The following are the specific defensive mechanisms implemented in this use case.
A 1D CNN model is trained using processed and labelled network traffic records to distinguish normal traffic from DDoS-related traffic.
The same feature definitions and compatible preprocessing steps are applied to training data and traffic captured during testing.
Traffic associated with the Nginx web server is captured and processed to provide the input required by the detection workflow.
A predefined mitigation action is triggered or recommended when the detection criteria are satisfied. The action may apply a restricted firewall rule or rate limit to the relevant laboratory traffic.
Model predictions, inference time, service responsiveness, and false-positive results are recorded during testing.
Nginx provides the web-server service used to evaluate traffic detection and controlled mitigation.
Ubuntu provides the environment for hosting Nginx and running the traffic-analysis and mitigation components.
Kali Linux provides the controlled testing environment used to generate legitimate requests and authorized test traffic against the laboratory server.
VirtualBox provides the isolated virtual environment used to host the Ubuntu server and Kali testing system.
Python provides the primary environment for data processing, model development, traffic classification, and result analysis.
TensorFlow/Keras is used to implement and train the 1D CNN model.
Pandas is used to load, filter, clean, and organize the existing public traffic records.
NumPy supports numerical transformations and array operations required for preparing model inputs.
Wireshark is used to inspect captured network traffic and validate the traffic generated during controlled laboratory testing.
tcpdump is used to capture network packets from the authorized laboratory interface when packet-level evidence is required.
Nmap is used to identify the exposed services of the designated laboratory server.
Linux firewall rules and appropriate traffic-control mechanisms are used to implement and evaluate controlled mitigation.
An existing public DDoS traffic dataset provides labelled network traffic records for model development and evaluation.
Matplotlib is used to visualize model performance and traffic-classification results.
An isolated cybersecurity laboratory is established using VirtualBox, Ubuntu Linux, and Kali Linux, providing a controlled environment for evaluating DDoS detection and mitigation against an Nginx web server.
The Nginx web server is deployed and validated within the laboratory, establishing a functioning web service for legitimate request processing and controlled traffic testing.
An existing public DDoS traffic dataset is processed to select labelled normal and DDoS-related traffic records, providing the data required for supervised deep-learning model development without manually creating the training dataset.
The selected traffic records are preprocessed and converted into numerical features compatible with a 1D CNN, establishing a consistent representation for model training and evaluation.
A 1D CNN model is trained using the selected labelled traffic records and evaluated against held-out data to measure classification performance, including precision, recall, F1-score, false-positive rate, and inference time.
Normal Nginx traffic and controlled laboratory test traffic are captured and processed to evaluate the practical compatibility of the traffic-analysis workflow with the trained model.
The trained model generates traffic-classification predictions for compatible captured traffic, allowing the experiment to assess whether the controlled test traffic is identified as DdoS-related.
A controlled mitigation mechanism is implemented using appropriate Linux firewall or rate-limiting controls, connecting the detection workflow to a testable response action within the isolated laboratory.
The effect of mitigation is evaluated by examining the handling of controlled test traffic and the availability of legitimate HTTP requests, providing evidence of both mitigation behavior and potential false-positive impact.
The complete workflow of public traffic-data processing, 1D CNN training, network traffic capture, DDoS classification, inference-time evaluation, controlled mitigation, service-availability validation, and final security assessment is demonstrated within the authorized laboratory environment.
Research Breakthrough Possible @S-Logix