Distributed Denial of Service (DDoS) attacks are one of the severe threats to network infrastructure, sometimes bypassing traditional diagnosis algorithms because of their evolving complexity. Present Machine Learning (ML) techniques for DDoS attack diagnosis normally apply network traffic statistical features such as packet sizes and inter-arrival times. However, such techniques sometimes fail to capture complicated relations among various traffic flows. In this paper, we present a new multi-scale ensemble strategy given the Graph Neural Networks (GNNs) for improving DDoS detection. Our technique divides traffic into macro- and micro-level elements, letting various GNN models to get the two corase-scale anomalies and subtle, stealthy attack models. Through modeling network traffic as graph-structured data, GNNs efficiently learn intricate relations among network entities. The proposed ensemble learning algorithm combines the results of several GNNs to improve generalization, robustness, and scalability. Extensive experiments on three benchmark datasets—UNSW-NB15, CICIDS2017, and CICDDoS2019—show that our approach outperforms traditional machine learning and deep learning models in detecting both high-rate and low-rate (stealthy) DDoS attacks, with significant improvements in accuracy and recall. These findings demonstrate the suggested method’s applicability and robustness for real-world implementation in contexts where several DDoS patterns coexist.

Keywords