[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-122173-en":3,"doc-seo-122173-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},122173,7971461740886,"Theodore","https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2",8,"Research & Report","Detection and classification of DDoS flooding attacks by machine learning method - research","This study presents a machine-learning approach for detecting and classifying distributed denial of service (DDoS) flooding attacks, including SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding, using neural networks. A dataset combining normal traffic with multiple attack types trains a neural network with a 24-106-5 architecture, reaching Accuracy 99.35%, Precision 99.32%, Recall 99.54%, and F-score 0.99. Laboratory testing on virtual infrastructures confirms robustness under near real-world conditions with 95.05% accuracy and balanced F-scores across attack categories.","Detection and classification of DDoS flooding attacks by machine learning method  \nDmytro Tymoshchuk 1,∗,†, Oleh Yasniy 1,†, Mykola Mytnyk1,†, Nataliya Zagorodna1,† and Vitaliy Tymoshchuk1,†  \n1 Ternopil Ivan Puluj National Technical University, Ruska str. 56, Ternopil, 46001, Ukraine  \nAbstract  \nThis study focuses on a method for detecting and classifying distributed denial of service (DDoS) attacks, such as SYN Flooding, ACK Flooding, [HTTP](HTTP) Flooding, and UDP Flooding, using neural networks. Machine learning, particularly neural networks, is highly effective in detecting malicious traffic. A dataset containing normal traffic and various DDoS attacks was used to train a neural network model with a 24-106-5 architecture. The model achieved high Accuracy (99.35%), Precision (99.32%), Recall (99.54%), and F-score (0.99) in the classification task. All major attack types were correctly identified.  \nThe model was also further tested in the lab using virtual infrastructures to generate normal and DDoS traffic. The results showed that the model can accurately classify attacks under near-realworld conditions, demonstrating 95.05% accuracy and balanced F-score scores for all attack types. This confirms that neural networks are an effective tool for detecting DDoS attacks in modern information security systems.  \nKeywords  \nmachine learning, neural network, DDoS, flooding  \n1. Introduction  \nDistributed denial of service (DDoS) attacks are one of the most serious threats to network security. These attacks cause significant system disruptions by flooding the system with malicious traffic [1]. Among the various DDoS techniques, Flooding attacks, such as SYN Flooding, ACK Flooding, [HTTP Flooding](HTTP Flooding), and UDP Flooding, are particularly difficult to neutralise due to their ability to mimic legitimate traffic. These attacks drain server resources, making it unavailable to legitimate users.  \nMachine learning (ML) is one of the key technologies increasingly being implemented in various fields of science and technology due to its ability to automate processes, analyze  \nBAIT’2024: The 1st International Workshop on “Bioinformatics and applied information technologies”, October 02-04, 2024, Zboriv, Ukraine  \n∗ Corresponding author.  \n† These authors contributed equally.  \n [dmytro.tymoshchuk@gmail.com](dmytro.tymoshchuk@gmail.com) (D. Tymoshchuk); [oleh.yasniy@gmail.com](oleh.yasniy@gmail.com) (O. Yasniy);  \nmytnyk@networkacad.net (M. Mytnyk);[Zagorodna.n@gmail.com](Zagorodna.n@gmail.com) (N. Zagorodna); [Tymoshchuk@tntu.edu.ua](Tymoshchuk@tntu.edu.ua)[ ](Tymoshchuk@tntu.edu.ua)(V. Tymoshchuk)  \n 0000-0003-0246-2236 (D. Tymoshchuk); 0000-0002-9820-9093 (O. Yasniy); 0000-0003-3743-6310 (M. Mytnyk); 0000-0002-1808-835X (N. Zagorodna); 0009-0007-2858-9434 (V. Tymoshchuk)  \n © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0) .  \nCEUR ~~  ~~[Workshop](Workshop ceur-ws.org)[ ceur-ws.org](Workshop ceur-ws.org)[ ](Workshop ceur-ws.org)[Proceedings](Proceedings ISSN 1613-0073)[ ISSN 1613-0073](Proceedings ISSN 1613-0073)   \nlarge amounts of data, and make highly accurate predictions. In medicine, ML is used to diagnose diseases, analyze medical images, develop personalized treatment plans, and predict the spread of infectious diseases [2]. In the financial sector, machine learning allows for assessing credit risk, detecting fraud, optimizing investment portfolios, and automating trading algorithms [3] . In the automotive industry, ML underpins the development of autonomous vehicles that analyze sensor data to make real-time decisions and predict vehicle maintenance [4]. In materials science, machine learning allows predicting material properties [5,6,7]. In particular, ML minimizes the need for expensive and time-consuming experiments.  \nIn cybersecurity, machine learning has become an important tool for detecting and preventing various threats. Tradi","cbCaib2haI76F07F","https://ap.wps.com/l/cbCaib2haI76F07F","pdf",663611,1,12,"English","en",105,"# Abstract\n# Introduction\n## DDoS flooding attacks and challenges\n## Machine learning for cybersecurity\n# Methods\n## Dataset description","[{\"question\":\"Which DDoS flooding attack types are covered by the detection model?\",\"answer\":\"The study targets SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding. These attack categories are explicitly used for training and evaluation.\"},{\"question\":\"What machine learning architecture is used for classification?\",\"answer\":\"The neural network model is trained with a 24-106-5 architecture. It is evaluated on both classification accuracy metrics and attack-type identification.\"},{\"question\":\"How well does the model perform in real-world-like laboratory testing?\",\"answer\":\"In lab experiments using virtual infrastructures that generate normal and DDoS traffic, the model achieves 95.05% accuracy with balanced F-score scores across all attack types.\"}]","Detection and classification of DDoS flooding attacks by machine learning method - research | PDF",1785809189,30,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"detection-and-classification-of-ddos-flooding-attacks-by-machine-learning-method-research","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/detection-and-classification-of-ddos-flooding-attacks-by-machine-learning-method-research/122173/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Which DDoS flooding attack types are covered by the detection model?","Question",{"text":75,"@type":76},"The study targets SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding. These attack categories are explicitly used for training and evaluation.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What machine learning architecture is used for classification?",{"text":80,"@type":76},"The neural network model is trained with a 24-106-5 architecture. It is evaluated on both classification accuracy metrics and attack-type identification.",{"name":82,"@type":73,"acceptedAnswer":83},"How well does the model perform in real-world-like laboratory testing?",{"text":84,"@type":76},"In lab experiments using virtual infrastructures that generate normal and DDoS traffic, the model achieves 95.05% accuracy with balanced F-score scores across all attack types.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":29,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]