Distributed denial-of-service (DDOS) attack detection using supervised machine learning algorithms.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Distributed Denial-of-Service (DDoS) attacks pose a significant threat to online services, causing service disruptions.
• Effective detection of DDoS attacks is crucial for maintaining the integrity of e-commerce, financial, and online platforms.
• Supervised machine learning offers a promising approach for identifying and mitigating these malicious network activities.

Purpose of the Study:

• To propose and evaluate a PCA-based Enhanced Distributed DDoS Attack Detection (EDAD) framework.
• To assess the performance of various supervised machine learning algorithms for DDoS attack detection.
• To identify the most effective machine learning model for differentiating between normal and attack network traffic.

Main Methods:

• Utilized Principle Component Analysis (PCA) for feature selection within the EDAD framework.
• Implemented and compared supervised machine learning models: Support Vector Machine (SVM), Logistic Regression (LR), Random Forest (RF), K-Nearest Neighbours (KNN), and Decision Tree (DT).
• Evaluated model performance using the CICIDS2018, CICIDS2017, and CICDDoS-2019 benchmark datasets.

Main Results:

• Random Forest (RF) achieved the highest accuracy (98.9%) on the CICIDS2017 dataset.
• RF and K-Nearest Neighbours (KNN) demonstrated high accuracy (98.7%) on the CICDDoS2019 dataset.
• Support Vector Machine (SVM) achieved the highest accuracy (98.7%) on the CICIDS2018 dataset.

Conclusions:

• The proposed EDAD framework, combined with machine learning, effectively detects DDoS attacks.
• Different machine learning models show varying performance across different datasets, highlighting the need for dataset-specific optimization.
• RF, KNN, and SVM are identified as highly accurate models for DDoS attack detection in the evaluated datasets.