Network Analysis of Multisource Packet Capture Files Using Machine Learning

The study uses machine learning methods to identify and detect Distributed Denial of Service (DDoS) attacks. The dataset used in this research was captured from the Packet capture (PCAP) files of the CTU-13, CIC-DDoS2019, and CIC-DoS2017 datasets, which contain different kinds of DDoS attacks such as ICMP, UDP, TCP, and HTTP flooding. Data features were extracted from attack packets classified using time windows, with the packet windows being of different lengths to correct the distribution of packets into the classes. Network analysis helps conceptualize and solve DDoS-related problems by analyzing traffic. To detect DDoS attacks, the proposed systems use machine learning classifiers: Logistic Regression, Decision Tree, Random Forest, K-NN (K5), XGBoost (XGB), and Light GBM (LGBM). The investigation of the ‘PKT_COUNT’ attribute led to a positive correlation and subsequent feature selection process, while only outliers were ‘cleaned out’ to yield higher gains in model accuracy. The target variable ‘PKT_COUNT’ was then transformed into a binary form to detect the analyzed malware easily. To create a robust model, significant efforts were made to clean the dataset with processing, such as detecting and removing the outliers, ensuring the model's reliability. The analysis of models was assessed concerning the area under the Receiver Operating Characteristic - Accuracy (ROC-AUC), mean Average Precision (AP), and Accuracy Scores. Therefore, the novel machine learning-based system presented in this paper introduces a robust method of DDoS attack detection that overcomes the drawbacks of existing steps to analyze network traffic. The study raises the possibility of developing more sophisticated classifiers to be incorporated into an environment to optimize DDoS attack detection and improve network security.