Support Vector Machine Classification Algorithm for Detecting DDoS Attacks on Network Traffic

Distributed Denial of Service (DDoS) attacks represent a significant danger in network security because they can lead to extensive service interruptions. With these attacks increasingly mirroring regular traffic, smart and effective detection systems are essential. This research seeks to assess the efficacy of the Support Vector Machine (SVM) classification algorithm in identifying DDoS attacks in network traffic. The data utilized is CICIDS2017, focusing on the subset Friday-WorkingHours-Afternoon-DDos.pcap_ISCX.csv, which contains both legitimate traffic and DDoS attacks like DoS-Hulk, DoS-GoldenEye, and DDoS. The preprocessing stage included eliminating duplicates and null entries, label binary encoding, normalization through Min-Max Scaler, and feature selection applying the Chi-Square technique. The data was divided into 80% for training and 20% for testing purposes. The Radial Basis Function (RBF) kernel was utilized to train the SVM model, and hyperparameter optimization was performed with GridSearchCV. The evaluation of the model's performance was conducted through accuracy, precision, recall, F1-score, confusion matrix, and visual representations including ROC and Precision-Recall Curves. The findings indicate that prior to tuning, the model reached an accuracy of 97%, which increased to 99% post-tuning, accompanied by an F1-score of 0.99. This shows that the SVM algorithm, when paired with appropriate preprocessing and optimization, is very efficient in identifying DDoS attacks within network traffic.