Analysis of Network Traffic Parameters to Detect DDOS-Attacks Based on Machine Learning Methods

This study proposes a technique for detecting the beginning of a DDoS attack and subsequently identifying the sources of malicious traffic using machine learning methods. Before the stage of training the model to detect a DDoS attack, the most common data sets were analyzed, their main characteristics, the amount of legitimate and malicious traffic in the samples were described. As a result of the analysis, the CICIDS2017 reference dataset was selected, which meets all the criteria for a reliable dataset. Next, the data set went through pre-processing, which included removing uninformative, incorrect and zero-value fields. After the data set was ready, significance was assessed and features were selected, thereby optimizing and preparing the data set for machine learning algorithms. Based on the results of determining the weights for each feature using algorithms based on decision trees, it was decided to leave the 10 most informative features. The data set was then divided into a training set and a test set. After careful examination of machine learning techniques for anomaly detection, the selected algorithms for model training include random forest, decision trees, boosting, and k-nearest neighbors. These algorithms exhibit exceptional performance, strong learning capabilities, scalability, and speed, making them ideal for effective anomaly detection. Using a flowchart, the process of training the model in stages was presented. For each classifier, the optimal parameters for training are described, at which high efficiency of the model was achieved. At the last stage, performance metrics (accuracy, precision, recall, F1) were analyzed and the most effective model was selected. For classifying malicious traffic, among the machine learning algorithms studied, the random forest algorithm showed the best results on test data (99%).