Using a Combination of Effective Feature Selection Methods and an Entropy-based Approach to Identify DDoS Anomalies

Distributed Denial of Service (DDoS) attacks are among the most dangerous types of attacks. These kinds of attacks bring targeted servers down and make their services unavailable to legal users. The first objective of this study is to identify infected Ethernet and detect various kinds of up-to-date DDoS attacks using a dynamic threshold by implementing multiple features of entropy and the Sequential Probabilities Ratio Test approach (E-SPRT). The second is to select relevant features to improve the performance of detection by implementing a new combination of machine learning techniques, which are ANOVA, Extra Trees Classifier, Random Forest, and Correlation Matrix with Pearson Correlation approaches. Canadian Institute for Cybersecurity (CIC-DDoS2019) databases were utilised to evaluate the implementation. ESPRT using a feature selection approach with five features achieved an accuracy of over 97% with an average False Positive Rate (FPR) close to 0 in identifying most different kinds of DDoS attacks.