Machine Learning-Enhanced DDoS Attack Detection: A Random Forest Approach Using High-Fidelity Simulated Network Traffic Logs

Distributed Denial-of-Service (DDoS) attacks constitute a principal threat to networked services by saturating targets with illegitimate HTTP requests. This paper presents an adaptive detection framework based on high-fidelity synthetic traffic generated over seven continuous days at ≤ 10μs timestamp precision. Baseline traffic follows a Poisson process (λ<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</inf>≈ 50reqs<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−1</sup>) and is augmented by four attack events—including volumetric bursts peaking at 2×10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">4</sup>reqs<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−1</sup>—yielding ≈ 3.57×10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">7</sup> request logs (≈ 4.8GB) on a single 8-core x86 workstation (32 GB RAM, NVMe SSD). A hyper-parameter-tuned Random Forest classifier achieves AUROC = 0.994 (95% CI ±0.003), true-positive rate ≥ 0.941, false-positive rate ≤ 0.004, precision ≈ 0.970, and recall ≈ 0.941; statistical significance is confirmed with McNemar’s test and Wilson confidence intervals. The study delivers a rigorously specified synthetic baseline and lays the groundwork for future validation on live traffic.