API-Driven Intelligent Agent for Real-Time Detection and Response Against Distributed Denial of Serv

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

API-Driven Intelligent Agent for Real-Time Detection and Response Against Distributed Denial of Service (DDoS) Attacks Using Hybrid Machine Learning

Priyanshi Dahivelkar1 , Anupama Dasari2 , Aditi Elag3 , Kumud Wasnik4

1Student, Dept of Computer Science and technology, Usha Mittal Institute of Technology, Maharashtra, India

2Student, Dept of Computer Science and technology, Usha Mittal Institute of Technology, Maharashtra, India

3Student, Dept of Computer Science and technology, Usha Mittal Institute of Technology, Maharashtra, India

4Professor, Dept of Computer Science and technology, Usha Mittal Institute of Technology, Maharashtra, India

Abstract - Distributed Denial of Service (DDoS) attacks still hit network infrastructure hard they take services offline, drain money, and throw operations into chaos [1] These attacks keep getting more complex and bigger, so the usual signature-based Intrusion Detection Systems just can’t keep up [3]. They don’t adapt in real time, can’t automate defenses, and struggle to scale in fast-moving cloudsetups. In this paper, we introduce an API-driven intelligent agent framework that tackles DDoS threats as they happen. We use a hybrid machine learning setup: ensemble models like Random Forest and Gradient Boosting work alongside deep learning with Long Short-Term Memory (LSTM) networks [5]. This combo lets us catch both patterns in the data and shifts over time. We built a RESTful API layer on Fast API so the system can roll out in real time, hook into firewall systems, and fire off automated responses. Testing on well-known datasets CICIDS2017 and CICDDoS2019 shows the system nails binary classification with 98.7% accuracy and hits 96.2% on multi-class detection. False positives stay under 2%, and detection happens in less than 200 milliseconds on average. Bottom line: this framework works, scales, and fits right into enterprise or cloud environments

Key Words: DDoS, Hybrid Machine Learning, LSTM, Random Forest, Cybersecurity, Intrusion Detection System,APISecurity,AIAgents

1. INTRODUCTION

These days, more people rely on internet services, cloudplatforms,andsmartdevices thaneverbefore, butthatcomesataprice.DDoSattacksareontherise, andthey’ve onlygotten more complex[1] Attackers now use everything from botnets to reflection and multi-vector attacks, all trying to overwhelm bandwidthorserversandbringservicestoahaltfor realusers.Old-schoolintrusiondetectionmostlyrelies onsignaturesorpresetrules[3].Theseworkokayfor threats we already know about, but they fall short againstnew,unknownattacksorwhentrafficpatterns keep changing. Plus, most systems only spot attacks

they don’t automatically stop them. That means someone has to jump in and fix things, which slows down the response and leaves systems exposed. Machinelearninganddeeplearningoffersomehope here[2] AlgorithmslikeRandomForestandGradient Boostingdoasolidjobanalyzingstructurednetwork data [4]. Deep learning models, like LSTM networks, can pick up on patterns over time, which helps spot DDoS attacks as they unfold. Still, these approaches aren’t perfect [1]. They can overfit, chew up a lot of resources,orjustdon’tscalewellwhenyoutrytoroll them out in the real world. And it’s not just about classification. When you try to use these systems outside the lab, you run into all sorts of other problems: tight latency requirements, fitting with legacysystems,APIintegrationheadaches,andactually automating responses. Most academic work just focusesongettingthehighestaccuracy,ignoringthese real-world deploymentissues [6].This paper tackles those gaps. We introduce a hybrid machine learning framework with a RESTful API for real-time DDoS detection and mitigation. By combining ensemble learning with deep models, we get more stable detection and cut down on false positives. The APIdriven setup lets detection tools, firewalls, and monitoringsystemstalktoeachothereasily.Wealso built in automated mitigation, so the system can respond immediately to attacks. Here’s what we’re bringing to the table: A hybrid detection model that blends ensemble and deep learning. An API-based intelligent agent framework for real-time use. Automated mitigation no more waiting for manual fixes. Thorough evaluation with benchmark datasets and latency checks. A scalable design that works for enterprise,cloud, andIoTenvironments. Here’s how therestofthepaperbreaksdown:SectionII-Related Work. Section III -System Architecture. Section IVMethodology.SectionV-ExperimentalSetup.SectionVI

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

- Implementation Section VII- Results and Analysis. Finally,SectionVIIIConclusionsandFutureWorks.

2. RELATED WORK

Machinelearninganddeeplearninghavereallypushed DDoS detection forward [2] The old rule-based and signature-basedsystemsjustcan’tkeepupwithzerodayorconstantlychangingattacks,butthesenewdatadriven approaches pick up on the weird patterns in network traffic that traditional methods miss. Deep learningmodelslikeCNNs,LSTMs,andGRUsdoasolid jobatpickingaparttrafficsequencesandspottingwhat doesn’tbelong[1].CNNsaregreatatpickingupspatial relationships between features, while LSTMs handle sequenceswellbecausetheyrememberwhathappened before. When you put several classifiers together through ensemble learning, you get even better results less bias, less variance [4]. Some hybrid setups, like combining Random Forests with deep learning,haveevenhitover98%accuracyonstandard datasets [5]. Most researchers test on datasets like CICIDS2017 and CICDDoS2019, mostly because they offerrealisticattackscenariosandamixoftraffictypes [6] Theproblem?Almosteveryonefocusesonaccuracy and forgets about what actually matters in the real worldlikehandlingthingsinrealtime,makingsurethe system works with APIs, automatically fighting off attacks, and keeping everything fast. So, there’s this cleargap:weneedascalable,low-latencysolutionthat not only detects attacks but also reacts to them automatically and plays nice with other systems through APIs. That’s exactly what this work aims to deliver,bycombininghybridlearningtechniqueswith smart,agent-basedmitigation.

Table -1: SummaryRelatedWorkonDDoSDetection

Ref. Method

[1] A. Hussain, M. S. Akbar, et al.,2023

Key Results

DES-LSTMwithMultiAgentFramework ~99% accuracy;low FAR; improved detection speed

[2]H.K.Nguyen, D. Kim, et al., 2023 RNN, LSTM, GRU comparison ~99% accuracy; GRU fastest

[3]Sodhiroet al.,2023 Ensemble (RF,XGBoost, LSTM) forIoMT

execution

98–99% accuracy; lightweight for healthcare

[4] Ghaleb et al.,2022 Adaptive ML integratedwithSDN High accuracy; real-time mitigation

[5]Chengetal., 2023 Hybrid ML/DL with image-based traffic conversion 99–100% (binary); 87–96% (multiclass)

3. SYSTEM ARCHITECTURE

Thissystemhasfivemainparts:theTrafficMonitoring Agent, Feature Extraction Module, Hybrid Machine Learning Detection Engine, RESTful API Layer, and Mitigation Agent. Check out Figure 1 it shows the wholesetupfortheAPI-drivenhybridDDoSdetection system. Here’s how everything works together. The TrafficMonitoringAgentgrabsreal-timenetworkflow data,turningrawpacketsintoorganizedflowrecords [6] After that, the Feature Extraction Module goes throughthoserecordsandpullsoutthekeystatistical and timing features [2] Then the Hybrid Detection Engine gets to work. It analyzes those features and sortsthetraffic[5].Onceitfiguresoutwhat’sgoingon, theMitigationAgentjumpsinandtakesaction[3].It mightupdatefirewallrulesortalktoSDNcontrollers with API calls whatever it takes to keep the system secure[3].

Fig -1:SimplifiedProposedSystem

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

4. METHODOLOGY

This is how we move from raw data to factual prognostications stepbystep.

A. Data Collection and Preprocessing

WerunourtrialsusingtwomaindatasetsCICIDS2017 andCICDDoS2019[6].Beforejumpingintomodeling, we clean up effects, drop any missing or indistinguishable values, apply Min- Max normalization, render markers, and gauge the data. However,ifoneclassappearssignificantlymoreoften than others, we address this imbalance using oversampling,soourmodelslearnmoreevenly[2].

B. Feature Engineering

Next, we pull out crucial features, such as inflow duration,packetlengthstats(mean,friction,standard divagation),countsofforwardandbackwardpackets, output in bytes per second, and entropy for randomness in business [6]. To narrow down what matters most, we use both correlation analysis and RecursivepointElimination(RFE)[4].

C. Model Training

We use a Random Forest model with 100 decision trees,alloptimizedusingGinicontamination[4].For ourLSTMsetup,therearetwolayers onewith128 units, the other with 64 [1].We add powerhouse regularizationatarateof0.3,andwrapupwithathick affairsubcasteusingSoftMax[2].Everythingtrainson an 80/20 split between training and testing data, runningwiththeAdamoptimizeranda0.001learning rate.

D. API Deployment and Integration

After training, wecontribute themongrelmodeland serve it with FastAPI. The discovery machine hooks straightintofirewallrobotizationscripts,soassoonas we spot a vicious IP, it gets blocked right down [3] ThankstoDocker,thewholesetupismovableandeasy toscaleouthorizontally.

E. Performance Evaluation Metrics

Forperformance,wetrackaccuracy,precision,recall, andF1score:

Accuracy=(TP+TN)/(TP+TN+FP+FN) [1]

Precision=TP/(TP+FP [2]

Recall=TP/(TP+FN) [3]

F1=2×Precision×Recall/(Precision+Recall) [4]

Wealsokeepaneyeondiscoveryquiescence that’s theaveragetimebetweensubmittingabusinessand gettingabracketresult[3]

5. EXPERIMENTAL SETUP

Let’s break down how we set up everything for this mongrelintelligentagent tackle,software,data,the way we trained and tested the models, and how we measuredperformance.

A. Hardware Configuration

Alltrialsranonahigh-endworkstationtomakesure training and real-time conclusion ran easily. Then’s whatweused

-IntelCorei7

-11700@2.5GHz

-32GBDDR4RAM

-NVIDIAGeForceRTX3060(12GBVRAM)

-1TBSSDstorehouse

-Ubuntu22.04LTS/Windows11

Deep literacy models like CNN and LSTM made the utmostofGPUacceleration FortheRandomForestand XGBoost models, we stuck with CPU-based parallel processing.

B. Software Environment

Everything was built in Python, using a bunch of modernframeworksandlibraries:

-Python3.10

-TensorFlowandKerasfordeeplearning

-Scikit-learn,XGBoostfortraditionalmachinelearning

-FastAPIfortheAPIlayer

-NumPyandPandasfordatawork

-Joblibforsavingmodels

-MatplotlibandSeaborntovisualizeresults

We ranthe REST APIendpointswithUvicorn,so the systemcouldhandlereal-timedetectionandmitigation calls.

C. Dataset Description

To see if our hybrid approach actually works, we pickedtwowell-knownDDoSdatasets:

-CICIDS2017

-CICDDoS2019[6]

Both datasets cover a range of attack types UDP Flood, TCP SYN Flood, HTTP Flood, ICMP Flood, and even botnet-based DDoS [1]. Each one comes with labeled network flow features, all extracted using CICFlowMeter[6]

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

D. Data Preprocessing

Beforetraining,wecleanedandpreppedthedata:

-Gotridofnullsandduplicates

-Encodedlabelsforcategoricalfeatures

-ScaledfeatureswithMin-Maxnormalization

-Didfeatureselectionusingcorrelationfiltering

-BalancedthedatasetusingSMOTEwhenneeded[2]

Then, we split the data: 80% for training, 20% for testing.

E. Evaluation Metrics

Tomeasurehowwellthemodelperformed,weused standardclassificationmetrics:

-Accuracy

-Precision

-Recall

-F1-Score

-ConfusionMatrix

Here’showeachoneiscalculated:

Accuracy=(TP+TN)/(TP+TN+FP+FN) [5]

Precision= TP/(TP+FP) [6]

Recall=TP/(TP+FN)F1=2×(Precision×Recall)/ (Precision+Recall) [7]

F. Real-Time API Testing

Oncetrained,wepluggedthehybridmodelintoa FastAPIbasedagent.Wetestedthreeendpoints:

-/api/detectforsingleflowdetection

-/api/detectbatchforbatchtrafficdetection

-/api/mitigateforautomaticmitigation

Inourreal-timetests,detectionstayedunder100ms perrequest fastenoughforenterprise-leveluse[3]

6. IMPLEMENTATION RESULTS

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

Fig -7: LiveMonitoringDashboardSummary

Fig -8: ProtocolDistributionVisualization

Fig -9: SystemResourcesandActivityLogsPanel

Fig -10: MitigationActionsandBlockedIPAddresses

Fig -11: SystemSettings–DetectionConfiguration

Fig -12: SystemSettings–MitigationConfiguration

Fig -13: SystemSettings–MonitoringConfiguration

6. RESULTS AND ANALYSIS

The hybrid model outperforms the standalone ones, handsdown[5] Here’showtheystackup:

Table -2: PerformanceComparisonofMachineLearning ModelsforDDoSDetection

False positives stay under 2%, so the system rarely misidentifies threats [1]. Detection happens fast on average;ittakeslessthan200milliseconds[3].That’s quickenoughforreal-timeuse.Thehybridapproach combines ensemble voting with temporal learning, which makes it more stable than the usual models

© 2026, IRJET | Impact Factor value: 8.315 | ISO 9001:2008 Certified Journal | Page2060

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

[4][5].Plus,itscalesupeasilyanddoesn’tneedmuch hands-on management compared to traditional IDS setups[3]

IRJET

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026 www.irjet.net p-ISSN: 2395-0072

7. CONCLUSION AND FUTURE SCOPE

Whenyouwanttodeploysecurely,afewthingsreally matter:

•UseJWTtokensforauthentication.

•Set up rate limits so nobody can hammer your API nonstop.

•RuneverythinginDockercontainers superhandyif youeverneedtomovethingsaround.

•Addloadbalancingtohandletrafficasyougrow.

•AlwaysgowithHTTPStokeepyourdatasafe. All of this makes your setup stronger and keeps attackersfromfindingnewwaysin.

This paper lays outa scalable, API-friendlyagentfor spotting and stopping DDoS attacks in real time. By mixing ensemble and deep learning, you get strong accuracy,barelyanyfalsealarms,andquickresponses. We didn’t just keep things theoretical, either. The frameworkactuallycombinesresearchwithpractical tools automated mitigation, API support so it fits right into real-world enterprise and cloud environments. Looking ahead, there’s plenty to explore:

* Smarter, adaptive mitigation using reinforcement learning

*RollingouttotheedgeforIoTenvironments

* Adding Explainable AI so you see why decisions happen

* Building a fully cloud-native DDoS Detection-as-aServiceplatform.

ACKNOWLEDGEMENT

We would like to express our sincere appreciation to everyonewhoprovidedinvaluableassistanceandsupport throughout this project. Special thanks to Prof. Kumud Wasnikforguidanceandconstantsupervision,toourHead ofDepartment,andtoourclassmatesfortheirfeedbackand encouragement.Finally,ourgratitudegoestoourfamilies fortheirunwaveringsupport.

REFERENCES

[1]A.Hussain,M.S.Akbar,etal.,“Amulti-agent-baseddeep learningmodelforprotectingcloudcomputingenvironment againstDDoSfloodingattacks,”AppliedSciences,vol.13,no. 15,2023,Art.no.8846,doi:10.3390/app13158846.

[2] H. K. Nguyen, D. Kim, et al., “DDoS attack detection in networktrafficusingdeeplearningalgorithms,”Sensors,vol. 23,no.4,2023,Art.no.1902,doi:10.3390/s23041902.

[3]A.H.Sodhro,M.Muzammal,etal.,“DDoS detectionfor InternetofMedicalThings,”AppliedSciences,vol.13,no.3, 2023,Art.no.1678,doi:10.3390/app13031678.

[4]F.A.Ghaleb,S.S.Alshamrani,etal.,“Adaptivemachine learningbasedDDoSdetectionandmitigationinSDN-IoT,” Sensors, vol. 22, no. 5, 2022, Art. no. 1824, doi: 10.3390/s22051824.

[5]Y.Cheng,J.Zhang,etal.,“HybridML/DLapproachesfor DDoSdetection,”Sensors,vol.23,no.3,2023,Art.no.1045, doi:10.3390/s23031045.

[6]S.BehalandK.Kumar,“TrendsinDDoSattackdetection and mitigation techniques: A survey,” Computer Science Review, vol. 25, pp. 1–25, 2017, doi: 10.1016/j.cosrev.2017.07.001.

[7]M.Z.Alom,T.M.Taha,C.Yakopcic,etal.,“Astate-oftheartsurveyondeeplearningtheoryandarchitectures,”IEEE Access, vol. 7, pp. 63674–63700, 2019, doi: 10.1109/ACCESS.2018.2888019.

[8]N.Moustafa, G.Creech,and J. Slay,“Ensemblelearning models for DDoS detection in IoT networks,” Future GenerationComputerSystems,vol.102,pp.743–755,2020, doi:10.1016/j.future.2019.09.066.

[9]I.Sharafaldin,A.H.Lashkari,andA.A.Ghorbani,“Toward generatinganewintrusiondetectiondatasetandintrusion traffic characterization,” in Proc. Int. Conf. Inf. Syst. Secur. Privacy (ICISSP), 2019, pp. 108–116, doi: 10.5220/0006639801080116.

[10]IEEE,“IEEEXploreDigitalLibrary.”[Online].Available: https://ieeexplore.ieee.org

[11]U.S.DepartmentofHealth&HumanServices,“Health Insurance Portability and Accountability Act (HIPAA).” [Online].Available:https://www.hhs.gov/hipaa [12]EuropeanUnion,“GeneralDataProtectionRegulation (GDPR).”[Online].Available:https://gdpr.eu

[13] Canadian Institute for Cybersecurity, “CICDDoS2019 Dataset.”[Online].Available:https://www.unb.ca/cic/dataset s/ddos-2019.html