Open Access

ARTICLE

A Multi-Scale Graph Neural Networks Ensemble Approach for Enhanced DDoS Detection

Noor Mueen Mohammed Ali Hayder^1,2, Seyed Amin Hosseini Seno^2,*, Hamid Noori², Davood Zabihzadeh³, Mehdi Ebady Manaa^4,5

1 Faculty of Nursing, Babylon University, Hilla, 11001, Iraq
2 Department of Computer Engineering, Ferdowsi University of Mashhad, Mashhad, 91369, Iran
3 Computer Engineering Department, Hakim Sabzevari University (HSU), Sabzevar, 91369, Iran
4 Intelligent Medical Systems Department, College of Sciences, Al-Mustaqbal University, Hilla, 51001, Babylon, Iraq
5 College of Information Technology, University of Babylon, Hilla, 51001, Babylon, Iraq

* Corresponding Author: Seyed Amin Hosseini Seno. Email:

(This article belongs to the Special Issue: Advances in Machine Learning and Artificial Intelligence for Intrusion Detection Systems)

Computers, Materials & Continua 2026, 87(1), 49 https://doi.org/10.32604/cmc.2025.073236

Received 13 September 2025; Accepted 26 November 2025; Issue published 10 February 2026

Abstract

Distributed Denial of Service (DDoS) attacks are one of the severe threats to network infrastructure, sometimes bypassing traditional diagnosis algorithms because of their evolving complexity. Present Machine Learning (ML) techniques for DDoS attack diagnosis normally apply network traffic statistical features such as packet sizes and inter-arrival times. However, such techniques sometimes fail to capture complicated relations among various traffic flows. In this paper, we present a new multi-scale ensemble strategy given the Graph Neural Networks (GNNs) for improving DDoS detection. Our technique divides traffic into macro- and micro-level elements, letting various GNN models to get the two corase-scale anomalies and subtle, stealthy attack models. Through modeling network traffic as graph-structured data, GNNs efficiently learn intricate relations among network entities. The proposed ensemble learning algorithm combines the results of several GNNs to improve generalization, robustness, and scalability. Extensive experiments on three benchmark datasets—UNSW-NB15, CICIDS2017, and CICDDoS2019—show that our approach outperforms traditional machine learning and deep learning models in detecting both high-rate and low-rate (stealthy) DDoS attacks, with significant improvements in accuracy and recall. These findings demonstrate the suggested method’s applicability and robustness for real-world implementation in contexts where several DDoS patterns coexist.

---

Keywords

---