Distributed Denial of Service Detection: Enhancing Machine Learning Models for Multiclass Classification

Abstract

This study experiments with machine learning algorithms for detecting distributed denial of service attacks as a multiclass classification problem. The algorithms included the K-nearest neighbours, decision trees, support vector machines, random forests, extreme gradient boosting, gradient boosting machines and multilayer perceptron. We validated the models using the hold-out and cross-validation methods, performed class and model ablation analysis to evaluate performance impacts and applied feature selection techniques, feature importance and statistical tests. For instance, using 10-fold cross-validation with 79 features, 11 attack types and regular network traffic, the tree-based models achieved accuracies ranging from 75.69% to 76.24%. When using 15 features, seven attacks and regular network traffic, model accuracy improved significantly, ranging from 97.77% to 98.08%. Furthermore, in specific application scenarios, some models achieved near-perfect classification performance. Decision tree achieved the highest accuracy score for the local network communication scenario, reaching 99.86%, followed by software distribution or updates at 99.70%, web platforms and online applications at 98.25%, video streaming or online gaming at 97.06%, infrastructure monitoring and management at 95.00% and directory services and corporate authentication at 87.15%. Depending on the application scenario, our results indicate that specialised models can support classification tasks targeting specific system components with high performance.