COMPARISON OF MACHINE LEARNING TECHNIQUES FOR CLASSIFICATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS - BASED ON FEATURE ENGINEERING IN SDN-BASED NETWORKS

Aug 6, 2026

Distributed Denial-of-Service (DDoS) attacks pose a major cybersecurity risk to software-defined networks (SDNs). This study develops a detection approach combining feature engineering with machine learning to classify DDoS attacks in SDNs. A Kaggle-derived dataset is cleaned and normalized, then the Correlation-based Feature Selection (CFS) method identifies an optimal feature subset. Multiple classifiers (RF, Decision Tree, AdaBoost, k-NN, Gradient Boosting, XGBoost, LightGBM, CatBoost) are trained and compared, with XGBoost achieving the best overall metrics and enabling effective detection and identification.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages18

Reading Time45 min

AccessFree to download

Abstract

Introduction

SDN architecture and traffic growth

Security risks and DDoS threats in SDN

Motivation for feature engineering and ML-based detection

COMPARISON OF MACHINE LEARNING TECHNIQUES FOR CLASSIFICATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS BASED ON FEATURE ENGINEERING IN SDN-BASED NETWORKS Muhammad Ikhwananda Rizaldi*1), Didih Rizki Chandranegara2), Denar Regata Akbi3) 1. Universitas Muhammadiyah Ma lang, Indonesia 2. Universitas Muhammadiyah Ma lang, Indonesia 3. Universitas Muhammadiyah Ma lang, Indonesia Article Info Keywords: Correlation-Based Feature Selection; DDoS Attacks; Feature Engineering; Machine Learning; Software-Defined Networking Article history: Received 7 June 2024 Revised 21 July 2024 Accepted 14 August 2024 Available online 1 September 2024 DOI : [https://doi.org/10.29100/jipi.v9i3.5262](https://doi.org/10.29100/jipi.v9i3.5262) * Corresponding author. Muhammad Ikhwananda Rizaldi E-mail address: [aldirizaldy977@webmail.umm.ac.id](aldirizaldy977@webmail.umm.ac.id) ABSTRACT Distributed Denial-of-Service (DDoS) attacks present a noteworthy cybersecurity hazard to software-defined networks (SDNs). This investigation presents an approach that depends on feature engineering and machine learning to discern DDoS attacks in SDNs. Initially, the data set acquired from Ka ggle goes through cleansing and normalization procedures, and the optimal subset of features is determined by employing the Correlation-based Feature Selection (CFS) algorithm . Subsequently, the optimal subset of features is trained and evaluated utilizing diverse Machine Learning algorithms, specifically Random Forest (RF), Decision Tree, Adaptive Boosting (Ada Boost), K-Nearest Neighbor (k-NN), Gradient Boosting, Extreme Gradient Boosting (XGBoost), Light Gradient Boosting Machine (LightGBM), and Categorical Boosting (CatBoost). The outcomes demonstrate that XGBoost outperforms the other algorithms in various performance metrics (e.g., accuracy, precision, recall, F1, and AUC values). Furthermore, a comparative analysis was carried out among various models and algorithms, revealing that the technique proposed by the researchers yielded the most favourable outcomes and effectively detected and identified DDoS attacks in SDN. Consequently, this investigation provides a novel perspective and resolution for SDN security. . I. INTRODUCTION The landscape of network infrastructure has experienced a significant transformation due to the rapid advancement and widespread use of state-of-the-art technologies like cloud computing and big data. This transformation has resulted in a tremendous increase in network traffic and an unparalleled dependence on networks for various purposes. It is important to note that 2020 witnessed an extraordinary global crisis in the form of the COVID-19 pandemic, which compelled individuals and organizations to rely heavily on online platforms for work, education, and entertainment. As a result, this surge in online activity placed immense pressure on the stability and security of networks, thereby exacerbating the challenges associated with conventional networking models. It is becoming increasingly evident that these traditional models must be adequately equipped to effectively meet users' diverse and complex needs in today's era. In light of this urgent demand for innovation and adaptability, Software-Defined Networking (SDN) has arisen as the most favored and desired networking technology owing to its incomparable adaptability, programmability, dynamism, and simplicity. SDN embodies a fundamental alteration in the manner in which networks are administered and operated, granting organizations the capability to address the constantly evolving requirements of the contemporary digital environment in a proficient and efficacious manner [1] . The architectural configuration of SDN distinguishes between the control plane and the data plane, which encompasses the application, management, and data planes. The data plane comprises switches and routers that are programmed and managed by the control plane. Theinteraction between

FAQs

How does the study prepare the dataset for DDoS detection?

The dataset is obtained from Kaggle, then cleaned and normalized before feature selection is performed.

Which feature selection method is used to select the optimal feature subset?

The Correlation-based Feature Selection (CFS) algorithm is used to determine the best subset of features.

Which machine learning model performs best in the reported comparisons?

XGBoost outperforms the other evaluated algorithms across multiple performance metrics such as accuracy, precision, recall, F1, and AUC.

Aug 6, 2026

Upload by Lucas Martin