Cloud-based DDoS detection using hybrid feature selection with deep reinforcement learning (DRL).

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Cloud Computing

Background:

• Distributed Denial of Service (DDoS) attacks increasingly threaten cloud infrastructure.
• Traditional Intrusion Detection Systems (IDSs) struggle with the dynamic nature of modern cyber threats.
• There is a need for adaptive and real-time DDoS detection solutions in cloud environments.

Purpose of the Study:

• To propose and evaluate a deep reinforcement learning (DRL)-based framework for real-time DDoS detection in cloud computing.
• To compare the performance of three actor-critic DRL algorithms: TD3, DDPG, and A2C.
• To develop a robust hybrid feature selection strategy for enhanced detection accuracy and interpretability.

Main Methods:

• Implemented a DRL framework utilizing TD3, DDPG, and A2C algorithms for network traffic classification.
• Employed a hybrid feature selection method combining Boruta, SHAP, and cross-validation stability.
• Trained and evaluated models on CICDDoS2019 and UNSW-NB15 datasets with preprocessing and class imbalance handling.

Main Results:

• The TD3 algorithm achieved the highest performance with 99.12% accuracy and 99.21% AUC.
• Inference latency was as low as 1.87 milliseconds per sample, suitable for real-time applications.
• SHAP-based analysis provided interpretability by identifying key features influencing DDoS detection.

Conclusions:

• The proposed DRL-based framework, particularly TD3, offers an effective, scalable, and interpretable solution for real-time DDoS detection.
• This approach overcomes the limitations of traditional IDSs in dynamic cloud environments.
• The hybrid feature selection and DRL model provide an adaptive defense against evolving cyber threats.