Distributed Denial of Service Detection: Enhancing Machine Learning Models for Multiclass Classification

ABSTRACT This study experiments with machine learning algorithms for detecting distributed denial of service attacks as a multiclass classification problem. The algorithms included the K‐nearest neighbours, decision trees, support vector machines, random forests, extreme gradient boosting, gradient boosting machines and multilayer perceptron. We validated the models using the hold‐out and cross‐validation methods, performed class and model ablation analysis to evaluate performance impacts and applied feature selection techniques, feature importance and statistical tests. For instance, using 10‐fold cross‐validation with 79 features, 11 attack types and regular network traffic, the tree‐based models achieved accuracies ranging from 75.69% to 76.24%. When using 15 features, seven attacks and regular network traffic, model accuracy improved significantly, ranging from 97.77% to 98.08%. Furthermore, in specific application scenarios, some models achieved near‐perfect classification performance. Decision tree achieved the highest accuracy score for the local network communication scenario, reaching 99.86%, followed by software distribution or updates at 99.70%, web platforms and online applications at 98.25%, video streaming or online gaming at 97.06%, infrastructure monitoring and management at 95.00% and directory services and corporate authentication at 87.15%. Depending on the application scenario, our results indicate that specialised models can support classification tasks targeting specific system components with high performance.