Ensemble Shields: Optimizing DDoS Detection in IoT Networks Using Machine Learning

DDoS (Distributed Denial-of-Service) attacks are significant cyber threats that affect network infrastructures and cause massive service disruption. DDoS attacks have become even more threatening, owing to the poor security of IoT devices. This paper proposes two ensemble approaches: (1) Optimized Ensemble Stacking Approach 4 (OESA-4) and (2) Optimized Ensemble Voting Approach 4 (OEVA-4). Both proposed approaches use four supervised machine learning classifiers, such as K-Nearest Neighbors (KNN), Random Forest (RF), Extreme Gradient Boosting (XGB), and Decision Tree (DT). OESA-4 combines the base learners’ outputs via a meta-learner, and OEVA-4 uses weighted soft-voting, assigning different weights to base learners to improve the output’s efficiency. An experimental analysis was conducted on a subset of the CIC-DDoS2019 dataset offered by the Canadian Institute for Cybersecurity to test the performance of state-of-the-art classifiers and proposed approaches. This subset of the dataset contains 325,965 occurrences. The results show that the proposed OESA-4 and OEVA-4 demonstrated reliable performance with accuracies of 99.87% and 99.73%, respectively, on a single split, whereas stratified five-fold cross-validation resulted in mean accuracies of 99.51% ± 0.08% for OESA-4 and 99.28% ± 0.11% for OEVA-4 respectively. The relatively low errors in both cases are indicative of consistent performance in all the five folds tested, demonstrating strong and consistent classification capabilities within the experiments. Thus, the presented paper shows that OESA-4 and OEVA-4 approaches achieve higher performance in identifying various types of DDoS attacks compared to individual classifiers.