Mathematical curves based TSO feature selection algorithm with decaying perturbation dynamic transfer function for DDoS attack detection

With the rapid development of Internet technology, distributed denial-of-service (DDoS) attacks have become one of the major threats in cybersecurity. DDoS attack data typically exhibit large-scale, sparse and class-imbalanced characteristics. A large amount of redundant and irrelevant features not only increases the computational cost of the detection model but also affects the recognition performance of the attack traffic. Regarding the feature selection problem in DDoS attack detection, a mathematical curve TSO feature selection algorithm (ASTSO-STF) was proposed based on a decaying perturbation dynamic transfer function. The basic S-shaped, V-shaped and U-shaped transfer functions are respectively combined with three random walk models: Lévy flight, Brownian motion and tangent flight, and a dynamically changing attenuation coefficient is introduced to enhance the exploration and development ability of the algorithm in the feature space. Secondly, the original trochoid search trajectory of TSO is replaced with eight mathematical curves with different geometric characteristics for comparison. Through different search trajectories, the feature space search ability of the algorithm is enhanced and finally, the ASTSO-STF based on the Archimedean spiral is constructed. To verify the effectiveness of the proposed method, experiments are conducted on 9 large-scale sparse datasets with different dynamic transfer functions and mathematical curve search mechanisms, and 2.5%, 4% and the original attack rate scenarios are constructed on the CIC-DDoS2019 and CIC-IDS-2017 datasets, and compared with 6 intelligent optimization algorithms for DDoS feature selection performance. Comprehensive evaluation is conducted from aspects, such as classification accuracy, attack detection capability, and false alarm and missed detection situations. The experimental results show that ASTSO-STF exhibits better classification performance and overall competitiveness in most experimental scenarios and can effectively select features related to DDoS attack detection.