Scholarlink

<p>With the increasing complexity of network environments, Distributed Denial of Service (DDoS) reflection and exploitation attacks have become more diverse, necessitating not only detection but also accurate classification. We aim to find novel findings with universally, less complexity and better efficiency to detect and mitigate these attacks. Hence, this study proposes a lightweight and universal machine learning-based approach for multiclass DDoS detection and subcategory classification. The framework employs several models, including Complement Naïve Bayes, k-Nearest Neighbors (kNN), Random Forest (RF), and Logistic Regression—trained on universal and some minimal universal feature subsets. To address class imbalance and reduce data volume, the NearMiss under-sampling method is applied. Evaluations conducted on the CIC-DDoS2019 dataset demonstrate that the Random Forest classifier offers superior performance in terms of memory usage, while kNN with NearMiss yields faster inference times. The findings support the use of kNN in time-constrained environments and RF in memory-constrained scenarios.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A lightweight machine learning approach for DDoS detection and classification

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年4月10日

查看全文
  • Osama Ebrahem,
  • Salah Dowaji,
  • Suhel Alhammoud

摘要

With the increasing complexity of network environments, Distributed Denial of Service (DDoS) reflection and exploitation attacks have become more diverse, necessitating not only detection but also accurate classification. We aim to find novel findings with universally, less complexity and better efficiency to detect and mitigate these attacks. Hence, this study proposes a lightweight and universal machine learning-based approach for multiclass DDoS detection and subcategory classification. The framework employs several models, including Complement Naïve Bayes, k-Nearest Neighbors (kNN), Random Forest (RF), and Logistic Regression—trained on universal and some minimal universal feature subsets. To address class imbalance and reduce data volume, the NearMiss under-sampling method is applied. Evaluations conducted on the CIC-DDoS2019 dataset demonstrate that the Random Forest classifier offers superior performance in terms of memory usage, while kNN with NearMiss yields faster inference times. The findings support the use of kNN in time-constrained environments and RF in memory-constrained scenarios.