Unsupervised Deep Learning-Based Network Traffic Anomaly Detection for DDoS Mitigation in Smart Microgrid Communication Infrastructure

Behar Haxhismajli, Galia Marinova, Edmond Hajrizi, Besnik Qehaja

Smart microgrids depend on continuous communication between controllers, sensors, and actuators over industrial protocols like Modbus TCP, message queuing telemetry transport (MQTT), and distributed network protocol 3 (DNP3), which were designed without built-in security mechanisms. The gateway that aggregates this traffic represents a single point of failure and is vulnerable to distributed denial-of-service (DDoS) attacks. Most existing detection methods require labeled attack data for training, a condition rarely met in operational technology (OT) environments. This paper presents an unsupervised convolutional neural network–long short-term memory (CNN-LSTM) model trained exclusively on normal microgrid gateway traffic to predict the next traffic window; anomalies are flagged when the prediction error exceeds a threshold derived from the training distribution. A dual-branch architecture processes metric time-series through LSTM layers and flow aggregate features through CNN layers, fusing both representations for prediction. The model is evaluated against three protocol-specific DDoS attack scenarios—Modbus supervisory control and data acquisition (SCADA) flooding, MQTT publish storm, and DNP3 response flooding—none of which are seen during training. Compared against an isolation forest baseline and an autoencoder baseline under identical unsupervised conditions, the CNN-LSTM achieves higher precision and recall on all attack types. The framework is deployed within a web-based monitoring platform that supports real-time detection and anomaly logging.