Comparative Analysis of Selected Machine Learning Techniques for HTTP-Based Distributed Denial Of Service (DDOS) Attack Detection in Web Applications

HTTP-based Distributed Denial of Service (DDoS) attacks threaten the availability of web applications by generating large volumes of requests that may resemble legitimate user activity. Because application-layer requests can appear valid, detection systems must distinguish malicious traffic from normal traffic while controlling false alarms. This study comparatively evaluated five supervised machine-learning classifiers—Random Forest, J48 Decision Tree, Logistic Regression, Naïve Bayes and Multilayer Perceptron (MLP)—for HTTP DDoS detection using the CICDDoS2019 dataset and the WEKA data-mining environment. The working dataset contained 55,508 traffic records and 78 attributes, including the class attribute. The records were pre-processed, non-predictive identifiers and a potentially leakage-related label field were excluded, and numeric attributes were normalized. The reported experiment allocated approximately 65% of the records to training and 35% to testing. Accuracy, precision, recall/true-positive rate and confusion-matrix counts were used to compare the classifiers. Random Forest produced the highest reported accuracy (99.9125%), with 3 false positives and 14 false negatives. J48 followed with 99.8816% accuracy, 7 false positives and 16 false negatives. Logistic Regression and MLP recorded 99.4853% and 99.4647% accuracy respectively, while Naïve Bayes recorded 95.9440% and the highest false-positive count (693). The results indicate that Random Forest and J48 were the strongest classifiers in this experiment, although J48 may be attractive where interpretability is important. The findings are limited to the dataset, preprocessing and experimental configuration used; they do not establish equivalent performance on all live networks. The study recommends independent validation, transparent reporting of data-splitting procedures, and testing under realistic traffic conditions before operational deployment.