Detection and classification of DDoS flooding attacks by machine learning method - research

Aug 4, 2026

This study presents a machine-learning approach for detecting and classifying distributed denial of service (DDoS) flooding attacks, including SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding, using neural networks. A dataset combining normal traffic with multiple attack types trains a neural network with a 24-106-5 architecture, reaching Accuracy 99.35%, Precision 99.32%, Recall 99.54%, and F-score 0.99. Laboratory testing on virtual infrastructures confirms robustness under near real-world conditions with 95.05% accuracy and balanced F-scores across attack categories.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

AccessFree to download

Abstract

Introduction

DDoS flooding attacks and challenges

Machine learning for cybersecurity

Methods

Dataset description

Detection and classification of DDoS flooding attacks by machine learning method Dmytro Tymoshchuk 1,∗,†, Oleh Yasniy 1,†, Mykola Mytnyk1,†, Nataliya Zagorodna1,† and Vitaliy Tymoshchuk1,† 1 Ternopil Ivan Puluj National Technical University, Ruska str. 56, Ternopil, 46001, Ukraine Abstract This study focuses on a method for detecting and classifying distributed denial of service (DDoS) attacks, such as SYN Flooding, ACK Flooding, [HTTP](HTTP) Flooding, and UDP Flooding, using neural networks. Machine learning, particularly neural networks, is highly effective in detecting malicious traffic. A dataset containing normal traffic and various DDoS attacks was used to train a neural network model with a 24-106-5 architecture. The model achieved high Accuracy (99.35%), Precision (99.32%), Recall (99.54%), and F-score (0.99) in the classification task. All major attack types were correctly identified. The model was also further tested in the lab using virtual infrastructures to generate normal and DDoS traffic. The results showed that the model can accurately classify attacks under near-realworld conditions, demonstrating 95.05% accuracy and balanced F-score scores for all attack types. This confirms that neural networks are an effective tool for detecting DDoS attacks in modern information security systems. Keywords machine learning, neural network, DDoS, flooding 1. Introduction Distributed denial of service (DDoS) attacks are one of the most serious threats to network security. These attacks cause significant system disruptions by flooding the system with malicious traffic [1]. Among the various DDoS techniques, Flooding attacks, such as SYN Flooding, ACK Flooding, [HTTP Flooding](HTTP Flooding), and UDP Flooding, are particularly difficult to neutralise due to their ability to mimic legitimate traffic. These attacks drain server resources, making it unavailable to legitimate users. Machine learning (ML) is one of the key technologies increasingly being implemented in various fields of science and technology due to its ability to automate processes, analyze BAIT’2024: The 1st International Workshop on “Bioinformatics and applied information technologies”, October 02-04, 2024, Zboriv, Ukraine ∗ Corresponding author. † These authors contributed equally. [dmytro.tymoshchuk@gmail.com](dmytro.tymoshchuk@gmail.com) (D. Tymoshchuk); [oleh.yasniy@gmail.com](oleh.yasniy@gmail.com) (O. Yasniy); mytnyk@networkacad.net (M. Mytnyk);[Zagorodna.n@gmail.com](Zagorodna.n@gmail.com) (N. Zagorodna); [Tymoshchuk@tntu.edu.ua](Tymoshchuk@tntu.edu.ua)[ ](Tymoshchuk@tntu.edu.ua)(V. Tymoshchuk) 0000-0003-0246-2236 (D. Tymoshchuk); 0000-0002-9820-9093 (O. Yasniy); 0000-0003-3743-6310 (M. Mytnyk); 0000-0002-1808-835X (N. Zagorodna); 0009-0007-2858-9434 (V. Tymoshchuk) © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0) . CEUR ~~ ~~[Workshop](Workshop ceur-ws.org)[ ceur-ws.org](Workshop ceur-ws.org)[ ](Workshop ceur-ws.org)[Proceedings](Proceedings ISSN 1613-0073)[ ISSN 1613-0073](Proceedings ISSN 1613-0073) large amounts of data, and make highly accurate predictions. In medicine, ML is used to diagnose diseases, analyze medical images, develop personalized treatment plans, and predict the spread of infectious diseases [2]. In the financial sector, machine learning allows for assessing credit risk, detecting fraud, optimizing investment portfolios, and automating trading algorithms [3] . In the automotive industry, ML underpins the development of autonomous vehicles that analyze sensor data to make real-time decisions and predict vehicle maintenance [4]. In materials science, machine learning allows predicting material properties [5,6,7]. In particular, ML minimizes the need for expensive and time-consuming experiments. In cybersecurity, machine learning has become an important tool for detecting and preventing various threats. Tradi

FAQs

Which DDoS flooding attack types are covered by the detection model?

The study targets SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding. These attack categories are explicitly used for training and evaluation.

What machine learning architecture is used for classification?

The neural network model is trained with a 24-106-5 architecture. It is evaluated on both classification accuracy metrics and attack-type identification.

How well does the model perform in real-world-like laboratory testing?

In lab experiments using virtual infrastructures that generate normal and DDoS traffic, the model achieves 95.05% accuracy with balanced F-score scores across all attack types.

Aug 4, 2026

Upload by Theodore