Feature extraction and selection for flooding-based multi-class DDoS attacks detection in IoT network

Abstract

In the realm of IoT network security, feature selection and machine learning driven DDoS detection acquired appeal due to their capacity for tracking traffic and recognize threats. Nevertheless, recent studies have demonstrated that these attacks can be identified using outdated datasets, which could not appropriately reflect modern network threats and degrade the accuracy of detection. Few ML applications employed over 40 features in the past; today, there are tens or even hundreds of features available. This makes processing the information complex and requires more resources and time. In order to facilitate the multi-class detection of DDoS flooding attacks, we made available the PCAP extractor, which allows for the extraction and processing of raw network data into a ML suitable format. Next, we generated flooding-based DDoS attack dataset specifically intended for classification into multiple classes, and we assessed the efficacy of adaptable ML models. We conducted three systematic experimental analysis. The flooding-based DDoS multi-class dataset that was produced for the study was used in the preliminary experiment. To evaluate the effectiveness of our efforts, we conducted the second and third experiments using the IoTID20 and CIC-IoT23, which are the most modern, up-to-date and incorporates variety DDoS attack datasets. Finally, Boruta outperforms RFE in terms of choosing important features and time to complete the task in all datasets. We showed that across all experiment groups, the random forest model exhibited an accuracy of greater than 90%.