Inter-Protocol Confusion in DrDoS Attacks: An Intrinsic Overlap of Flow Features

Machine learning applied to the CIC-DDoS2019 benchmark routinely reports accuracies above 99 percent, yet multiclass studies consistently observe systematic confusion between reflection-based attacks that exploit different protocols, such as DNS against LDAP or NetBIOS against Portmap. These confusions are widely reported but seldom explained. This paper takes them as its object of study and asks whether they originate in the classifiers or in the data. A Random Forest baseline is trained on a leakage-free subset in which source and destination ports, addresses and timestamps have been removed, reducing the feature vector from 88 to 67 purely behavioural attributes. The confusion matrix of this baseline is symmetrised, converted into a distance and submitted to agglomerative clustering, which yields an attack-family hierarchy derived from the data rather than from protocol expertise. A twostage hierarchical classifier built on that hierarchy produces no measurable gain over the flat baseline, a null result that motivates a controlled separability analysis. Dedicated binary classifiers trained on individual class pairs yield areas under the ROC curve between 0.807 and 0.920 for confused pairs, whereas three control pairs reach 1.000 under an identical protocol. The control group establishes that the limitation lies in the data, not in the measurement method.