Balanced and Reduced-Dimensionality DDoS Detection: A SMOTE-ENN and RFE Approach with Naïve Bayes and SVM
Article Sidebar
Main Article Content
Abstract
Distributed Denial of Service (DDoS) attacks threaten the availability of network services, and rule-based intrusion detection systems (IDS) struggle to recognise their evolving patterns. This paper presents a machine-learning IDS pipeline for DDoS detection that combines min–max normalisation, hybrid class balancing with SMOTE-ENN, and Recursive Feature Elimination (RFE) with a Random Forest estimator, which reduces 78 flow features to 20. Naïve Bayes and Support Vector Machine (SVM) classifiers are trained on the Friday-afternoon DDoS capture of CIC-IDS2017 (225,745 flow records, obtained from Kaggle), with resampling applied to the training partition only, and are evaluated on a held-out 20% test set using accuracy, precision, recall, F1-score and execution time. Naïve Bayes achieved 98.91% accuracy, a 98.91% F1-score and a 1.2 s execution time, compared with 98.57%, 98.56% and 2.5 s for SVM, and it missed no attack flows in the test set. Both classifiers reached a ROC AUC of 0.99. These results come from a single dataset and a single train–test split without significance testing, so the small differences between the two classifiers should be regarded as indicative rather than conclusive. Within these limits, a lightweight classifier on a balanced, reduced feature space detected DDoS traffic accurately at low computational cost.
Article statistics
- Abstract views
- 140
- PDF Downloads
- 39
- Total views
- 179
Downloads
Article Details
Data Availability Statement
The dataset analysed in this study is publicly available from the Canadian Institute for Cybersecurity at https://www.unb.ca/cic/datasets/ids-2017.html. The copy used here was downloaded from Kaggle: https://www.kaggle.com/datasets/chethuhn/network-intrusion-dataset
Section
This work is licensed under a Creative Commons Attribution 4.0 International License.
All articles published in International Journal of Security Sciences (IJSS) are licensed under the terms of the Creative Commons Attribution 4.0 International License (CC BY 4.0).
This license allows others to share, copy, distribute, and adapt the work, provided that appropriate credit is given to the original author(s) and the source.
Authors retain copyright and grant International Journal of Security Sciences (IJSS) the right of first publication.
How to Cite
References
1. M. Najafimehr, S. Zarifzadeh, and S. Mostafavi, “DDoS attacks and machine-learning-based detection methods: A survey and taxonomy,” Eng. Rep., vol. 5, no. 12, 2023, Art. no. e12697. DOI: https://doi.org/10.1002/eng2.12697 DOI: https://doi.org/10.1002/eng2.12697
2. M. A. Al-Shareeda, S. Manickam, and M. A. Saare, “DDoS attacks detection using machine learning and deep learning techniques: Analysis and comparison,” Bull. Electr. Eng. Informatics, vol. 12, no. 2, pp. 930–939, 2023. DOI: https://doi.org/10.11591/eei.v12i2.4466 DOI: https://doi.org/10.11591/eei.v12i2.4466
3. S. Siva Saravanababu et al., “A DDoS attack categorization and prediction method based on machine learning,” J. Popul. Ther. Clin. Pharmacol., vol. 30, no. 9, pp. e300–e307, 2023. DOI: https://doi.org/10.47750/jptcp.2023.30.09.030 DOI: https://doi.org/10.47750/jptcp.2023.30.09.030
4. K. Kumari and M. Mrunalini, “Detecting Denial of Service attacks using machine learning algorithms,” J. Big Data, vol. 9, no. 1, Art. no. 56, 2022. DOI: https://doi.org/10.1186/s40537-022-00616-0 DOI: https://doi.org/10.1186/s40537-022-00616-0
5. R. R. Sekar, A. M. Jenny, D. Sreshta, M. Vikas, D. B. N. Ajay, and M. Ganesh, “Prediction of distributed denial of service attacks in SDN using machine learning techniques,” in Proc. 3rd Int. Conf. Intell. Technol. (CONIT), 2023. DOI: https://doi.org/10.1109/CONIT59222.2023.10205887 DOI: https://doi.org/10.1109/CONIT59222.2023.10205887
6. V. Deepa, K. M. Sudar, and P. Deepalakshmi, “Detection of DDoS attack on SDN control plane using hybrid machine learning techniques,” in Proc. Int. Conf. Smart Syst. Inventive Technol. (ICSSIT), Tirunelveli, India, 2018, pp. 299–303. DOI: https://doi.org/10.1109/ICSSIT.2018.8748836 DOI: https://doi.org/10.1109/ICSSIT.2018.8748836
7. W. Alhalabi, A. Gaurav, V. Arya, I. F. Zamzami, and R. A. Aboalela, “Machine learning-based distributed denial of services (DDoS) attack detection in intelligent information systems,” Int. J. Semant. Web Inf. Syst., vol. 19, no. 1, pp. 1–17, 2023. DOI: https://doi.org/10.4018/IJSWIS.327280 DOI: https://doi.org/10.4018/IJSWIS.327280
8. İ. Avçı and M. Koca, “Predicting DDoS attacks using machine learning algorithms in building management systems,” Electronics, vol. 12, no. 19, Art. no. 4142, 2023. DOI: https://doi.org/10.3390/electronics12194142 DOI: https://doi.org/10.3390/electronics12194142
9. S. A. Abbas and M. S. Almhanna, “Distributed denial of service attacks detection system by machine learning based on dimensionality reduction,” J. Phys.: Conf. Ser., vol. 1804, no. 1, Art. no. 012136, 2021. DOI: https://doi.org/10.1088/1742-6596/1804/1/012136 DOI: https://doi.org/10.1088/1742-6596/1804/1/012136
10. Y. Gu, K. Li, Z. Guo, and Y. Wang, “Semi-supervised K-means DDoS detection method using hybrid feature selection algorithm,” IEEE Access, vol. 7, pp. 64351–64365, 2019. DOI: https://doi.org/10.1109/ACCESS.2019.2917532 DOI: https://doi.org/10.1109/ACCESS.2019.2917532
11. H. Polat, O. Polat, and A. Cetin, “Detecting DDoS attacks in software-defined networks through feature selection methods and machine learning models,” Sustainability, vol. 12, no. 3, p. 1035, 2020. DOI: https://doi.org/10.3390/su12031035 DOI: https://doi.org/10.3390/su12031035
12. W. G. Gadallah, N. M. Omar, and H. M. Ibrahim, “Machine learning-based distributed denial of service attacks detection technique using new features in software-defined networks,” Int. J. Comput. Netw. Inf. Secur., vol. 13, no. 3, pp. 15–27, 2021. DOI: https://doi.org/10.5815/ijcnis.2021.03.02 DOI: https://doi.org/10.5815/ijcnis.2021.03.02
13. C. Tennakoon and S. Fernando, “Deep learning model for distributed denial of service (DDoS) detection,” Int. J. Adv. Appl. Sci., vol. 9, no. 2, pp. 109–118, 2022. DOI: https://doi.org/10.21833/ijaas.2022.02.012 DOI: https://doi.org/10.21833/ijaas.2022.02.012
14. F. M. Aswad, A. M. S. Ahmed, N. A. M. Alhammadi, B. A. Khalaf, and S. A. Mostafa, “Deep learning in distributed denial-of-service attacks detection method for Internet of Things networks,” J. Intell. Syst., vol. 32, no. 1, Art. no. 20220155, 2023. DOI: https://doi.org/10.1515/jisys-2022-0155 DOI: https://doi.org/10.1515/jisys-2022-0155
15. M. Najafimehr, S. Zarifzadeh, and S. Mostafavi, “A hybrid machine learning approach for detecting unprecedented DDoS attacks,” J. Supercomput., vol. 78, no. 6, pp. 8106–8136, 2022. DOI: https://doi.org/10.1007/s11227-021-04253-x DOI: https://doi.org/10.1007/s11227-021-04253-x
16. R. Li and B. Wu, “Early detection of DDoS based on φ-entropy in SDN networks,” in Proc. IEEE 4th Inf. Technol., Netw., Electron. Autom. Control Conf. (ITNEC), Chongqing, China, 2020, pp. 731–735. DOI: https://doi.org/10.1109/ITNEC48623.2020.9084885 DOI: https://doi.org/10.1109/ITNEC48623.2020.9084885
17. A. Yadav, A. S. Kori, N. D. G, P. Shettar, and M. M. Moin, “A hybrid approach for detection of DDoS attacks using entropy and machine learning in software defined networks,” in Proc. 12th Int. Conf. Comput. Commun. Netw. Technol. (ICCCNT), Kharagpur, India, 2021, pp. 1–7. DOI: https://doi.org/10.1109/ICCCNT51525.2021.9580057 DOI: https://doi.org/10.1109/ICCCNT51525.2021.9580057
18. G. Ajeetha and G. Madhu Priya, “Machine learning-based DDoS attack detection,” in Proc. Innov. Power Adv. Comput. Technol. (i-PACT), Vellore, India, 2019, pp. 1–5. DOI: https://doi.org/10.1109/i-PACT44901.2019.8959961 DOI: https://doi.org/10.1109/i-PACT44901.2019.8959961
19. P. S. Saini, S. Behal, and S. Bhatia, “Detection of DDoS attacks using machine learning algorithms,” in Proc. 7th Int. Conf. Comput. Sustain. Global Dev. (INDIACom), New Delhi, India, 2020, pp. 16–21. DOI: https://doi.org/10.23919/INDIACom49435.2020.9083716 DOI: https://doi.org/10.23919/INDIACom49435.2020.9083716
20. K. M. Sudar, M. Beulah, P. Deepalakshmi, P. Nagaraj, and P. Chinnasamy, “Detection of distributed denial of service attacks in SDN using machine learning techniques,” in Proc. Int. Conf. Comput. Commun. Informat. (ICCCI), Coimbatore, India, 2021, pp. 1–5. DOI: https://doi.org/10.1109/ICCCI50826.2021.9402517 DOI: https://doi.org/10.1109/ICCCI50826.2021.9402517
21. N. N. Tuan, P. H. Hung, N. D. Nghia, N. V. Tho, T. V. Phan, and N. H. Thanh, “A DDoS attack mitigation scheme in ISP networks using machine learning based on SDN,” Electronics, vol. 9, no. 3, p. 413, 2020. DOI: https://doi.org/10.3390/electronics9030413 DOI: https://doi.org/10.3390/electronics9030413
22. B. Al-Duwairi et al., “SIEM-based detection and mitigation of IoT-botnet DDoS attacks,” Int. J. Electr. Comput. Eng., vol. 10, no. 2, pp. 2182–2191, 2020. DOI: https://doi.org/10.11591/ijece.v10i2.pp2182-2191 DOI: https://doi.org/10.11591/ijece.v10i2.pp2182-2191
23. A. Kajal and S. K. Nandal, “Cyber security against DDoS, malware, spoofing attacks using machine learning with genetic algorithm,” Int. J. Adv. Sci. Technol., vol. 29, no. 5, pp. 5388–5400, 2020.
24. R. Jangra and A. Kajal, “A review of deep learning based intrusion detection systems,” in Proc. Int. Conf. Comput., Commun., Intell. Syst. (ICCCIS), 2023, pp. 1004–1009. DOI: https://doi.org/10.1109/ICCCIS60361.2023.10425595 DOI: https://doi.org/10.1109/ICCCIS60361.2023.10425595
25. I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. 4th Int. Conf. Inf. Syst. Secur. Privacy (ICISSP), 2018, pp. 108–116. DOI: https://doi.org/10.5220/0006639801080116 DOI: https://doi.org/10.5220/0006639801080116
26. N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “SMOTE: Synthetic minority over-sampling technique,” J. Artif. Intell. Res., vol. 16, pp. 321–357, 2002. DOI: https://doi.org/10.1613/jair.953 DOI: https://doi.org/10.1613/jair.953
27. D. L. Wilson, “Asymptotic properties of nearest neighbor rules using edited data,” IEEE Trans. Syst., Man, Cybern., vol. SMC-2, no. 3, pp. 408–421, Jul. 1972. DOI: https://doi.org/10.1109/TSMC.1972.4309137 DOI: https://doi.org/10.1109/TSMC.1972.4309137
28. G. E. A. P. A. Batista, R. C. Prati, and M. C. Monard, “A study of the behavior of several methods for balancing machine learning training data,” ACM SIGKDD Explor. Newsl., vol. 6, no. 1, pp. 20–29, 2004. DOI: https://doi.org/10.1145/1007730.1007735 DOI: https://doi.org/10.1145/1007730.1007735
29. I. Guyon, J. Weston, S. Barnhill, and V. Vapnik, “Gene selection for cancer classification using support vector machines,” Mach. Learn., vol. 46, no. 1–3, pp. 389–422, 2002. DOI: https://doi.org/10.1023/A:1012487302797 DOI: https://doi.org/10.1023/A:1012487302797
30. L. Breiman, “Random forests,” Mach. Learn., vol. 45, no. 1, pp. 5–32, 2001. DOI: https://doi.org/10.1023/A:1010933404324 DOI: https://doi.org/10.1023/A:1010933404324
31. P. M. Granitto, C. Furlanello, F. Biasioli, and F. Gasperi, “Recursive feature elimination with random forest for PTR-MS analysis of agroindustrial products,” Chemom. Intell. Lab. Syst., vol. 83, no. 2, pp. 83–90, 2006. DOI: https://doi.org/10.1016/j.chemolab.2006.01.007 DOI: https://doi.org/10.1016/j.chemolab.2006.01.007