Human-in-theLoop 1D-CNN DdoS Detection Integrated with MikroTik Firewall Mitigation

Abstract

Distributed Denial of Service (DDoS) attacks threaten network availability, while conventional firewalls exhibit limited adaptability. This study develops a 1D Convolutional Neural Network (1D-CNN) for binary DDoS classification using CICIDS2017 and integrates detection with a physical MikroTik firewall via a human-in-the-loop workflow. To eliminate data leakage, normalization and SMOTE were applied exclusively to the clean training subset. Evaluated on an independent test set ($N = 421,067$), the optimal 1D-CNN achieved 99.92% accuracy, 99.87% precision, 98.80% recall, 99.33% F1-score, and a 0.0086% BENIGN false positive rate, outperforming the classical Random Forest baseline (99.85% accuracy). For physical mitigation, raw traffic captured via MikroTik Packet Sniffer was dynamically parsed using a Scapy-based feature extraction engine to reconstruct 5-tuple flows and calculate 77 statistical attributes. Identified DDoS source IPs and confidence scores were presented to administrators for manual verification before executing a firewall DROP rule. In physical deployment testing, the system successfully reconstructed 22 unique session flows from raw PCAP captures, flagged 21 malicious DDoS flows, and enabled targeted firewall blocking to restore stability. This workflow effectively connects deep learning detection with physical hardware enforcement, offering a novel bridge between high-accuracy offline machine learning models and actionable operational firewall enforcement without risking automated false-alert disruption.