Fog-Deployable XGBoost Framework for DDoS Detection in IoT Networks

The rapid growth of Internet of Things (IoT) deployment has increased exposure to Distributed Denial of Service (DDoS) attacks, while the latency and bandwidth costs of cloud-centric intrusion detection constrain real-time response. This paper presents a fog-based DDoS detection framework that combines XGBoost with information-gain feature selection. The framework uses 23 of the 78 features, a 70.5% reduction, at a measured accuracy cost of 0.007 percentage points. The evaluation used a sample drawn from every file of the CICDDoS2019 release, with benign traffic retained and attack traffic sampled to an attack-to-benign ratio of approximately 10:1. Feature selection, hyperparameter tuning, and threshold calibration were confined to the training partition. Under a random stratified split, the model reached 99.98% accuracy at a 0.058% false-positive rate. Under the capture-day split designated by the dataset authors, accuracy fell to 91.61%, and the false-positive rate rose to 8.82%, equivalent to 8820 false alerts per 100,000 benign flows. Per-request inference on a two-core profile took 1.0 to 5.2 ms over three repeated runs; feature extraction and network transit were not measured. Deployment would require monitoring for distribution shift and periodic retraining.