Hybrid Machine Learning Framework for Real-Time DoS Attack Detection, Classification, and Recovery in Educational Digital Systems

Abstract

This paper proposes a hybrid online-memory machine learning framework for real-time detection, classification, and recovery of Denial-of-Service (DoS) attacks in digital systems. The framework addresses the limitations of existing approaches by combining a lightweight gated recurrent unit (GRU)-based online detector with a compressed hierarchical sparse memory module, enabling efficient anomaly detection and signature matching under resource constraints. The online detector processes streaming network traffic data incrementally, computing anomaly scores dynamically to flag suspicious flows with low latency. Meanwhile, the memory module organizes attack signatures hierarchically and retrieves relevant patterns sparsely, reducing computational overhead while maintaining classification accuracy. The framework autonomously triggers recovery actions, such as traffic throttling or firewall updates, and selectively incorporates new attack signatures to adapt to emerging threats without excessive memory consumption. Moreover, it integrates seamlessly with conventional network monitoring tools and SDN controllers, ensuring compatibility with existing infrastructure. The proposed method distinguishes itself by unifying real-time detection with memory-efficient historical analysis, a critical advancement for scalable and adaptive cybersecurity in resource-constrained environments. Experimental validation demonstrates its effectiveness in identifying diverse DoS attacks while operating efficiently on edge devices and centralized servers. This work contributes a practical solution to the growing challenge of securing digital systems against increasingly sophisticated and evolving threats.