DDoS Attack Detection with LightGBM in DART Mode: Benchmarking GridSearchCV Against Optuna Hyperparameter Tuning

Distributed Denial of Service (DDoS) attacks continue to threaten servers, websites, and critical infrastructure, with SYN flood remaining one of the most common attack types. Manual detection through firewall rules is slow, non-adaptive to new patterns, and dependent on scarce security expertise. This paper presents a machine learning approach that classifies network traffic as benign or SYN flood attack using LightGBM in DART boosting mode, and benchmarks two hyperparameter tuning strategies: GridSearchCV and Optuna. Experiments use the CIC-DDoS2019 dataset, specifically the SYN flood training subset of 3,517 samples with 37.3% benign and 62.7% attack traffic. Preprocessing removes identity columns that cause data leakage, handles infinite values, encodes labels, and keeps numeric features, while class imbalance is addressed with balanced class weights. The model is evaluated with stratified 5-fold cross-validation using precision, recall, F1-score, and F1-macro. GridSearchCV exhaustively tests 4 discrete combinations of max_depth and num_leaves, while Optuna explores a wider continuous space over 8 trials with Bayesian TPE, keeping the learning rate fixed at 0.1 for a fair comparison. GridSearchCV achieves an F1-macro of 0.9912 in 38.44 seconds, while Optuna achieves 0.9909 in 30.15 seconds, making Optuna approximately 21% faster with a negligible F1 difference of 0.0003. Confusion matrices show near-perfect detection with only 29 false negatives in both models, and feature importance analysis identifies packet size, flow duration, and inter-arrival time as the key discriminating signals. The main contribution is empirical evidence that Bayesian hyperparameter optimization matches exhaustive grid search quality while substantially reducing tuning time for intrusion detection models.