Securing campus networks with intelligence: a review of machine learning techniques for ddos and arp protection

Abstract The increasing digitization of academic environments has made campus networks essential for learning, research, and administration; however, these networks are highly vulnerable to evolving cyber threats. Among these threats, Distributed Denial of Service (DDoS) and Address Resolution Protocol (ARP) spoofing attacks pose significant risks to network availability, integrity, and confidentiality. Traditional rule-based and signature-based intrusion detection systems are limited by their static nature and poor adaptability to the dynamic traffic patterns typical of campus networks. This review systematically examines Machine Learning (ML) techniques for detecting and preventing DDoS and ARP attacks. Guided by the PRISMA framework, a total of 110 studies were selected from 206 peer-reviewed papers published from 2020 to 2025. Supervised, unsupervised, and hybrid ML models utilizing algorithms such as Random Forests, Support Vector Machines, Convolutional Neural Networks, Long Short-Term Memory networks, and CNN-LSTM ensembles demonstrate high detection accuracy and robust anomaly modeling under real-time, resource-constrained conditions. Integration with Software-Defined Networking (SDN), federated learning, and edge computing enhances scalability, privacy preservation, and low-latency mitigation. Despite these advances, challenges remain in dataset representativeness, model generalization, interpretability, computational overhead, and the development of unified frameworks capable of simultaneously mitigating volumetric DDoS, application-layer attacks, and Layer-2 ARP spoofing. Emerging approaches, such as reinforcement learning and explainable AI, offer promise for adaptive, zero-day, and adversarial threat mitigation. The review highlights the need for modular, context-aware, and scalable ML frameworks validated on real campus traffic to enable resilient and operationally feasible intrusion detection and prevention. These insights provide a foundation for designing secure, adaptive, and intelligent network defense strategies in modern campus environments.