Layered feature optimization framework based on Filtering, Embedding and data Balancing (L-FEB) for efficient DDoS attack detection

Abstract

The task of identifying Distributed Denial of Service (DDoS) attacks demands effective feature selection techniques to streamline the classification process without compromising accuracy. This research proposes a Layered framework based on Filtering, Embedding, and data Balancing (L-FEB) for feature optimization to enhance multi-classification in DDoS attack detection, an area that has been underrated in the literature. The L-FEB framework incorporates data preprocessing, feature selection through filtering and embedding techniques, and data balancing to reduce feature dimensionality while improving detection accuracy and efficiency. The study utilized five classification models: Random Forest (RF), XGBoost (XGB), k-Nearest Neighbors (k-NN), Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM) on the CICDDoS2019 dataset, which contains 13 types of DDoS attacks. The L-FEB framework reduced the feature set from 86 to 16, achieving 81.4% reduction. With the reduced feature set, all models demonstrated improved accuracy and reduced training and classification time. XGB achieved the highest accuracy of 85.8%, while MLP achieved the lowest training and classification time of 850 s. The MLP model was further optimized using a Triple-Layered Cross-Validation (TLCV) approach, reducing time by 75.37% while maintaining similar accuracy. The results demonstrate that the L-FEB framework effectively enhances both model performance and efficiency in multi-class DDoS attack detection.