ENHANCED DDoS ATTACK DETECTION THROUGH HYBRID MACHINE LEARNING TECHNIQUES

Feraidoon Farahmandnia; Serhat Özekes

Article Details

ENHANCED DDoS ATTACK DETECTION THROUGH HYBRID MACHINE LEARNING TECHNIQUES

Authors:

Feraidoon Farahmandnia | Serhat Özekes

Publisher:

Istanbul Ticaret University

Main Topics:

Sistem ve Ağ Güvenliği

Journal:

İstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi Vol.7 Issue 2, pp.275-307

Document Type:

Article

Publication Date:

2/2025

Document Language:

English

Document ID (Org No.):

2001341235

pISSN:

2645-8969

Keywords:

Abstract:

 This research focuses on enhancing the detection mechanisms for Distributed Denial of Service DDoS attacks using advanced machine learning techniques. We explore two innovative approaches: a metaclassifier stacking model and a transfer learning model, utilizing the CICDDoS2019 and CICIDS2017 datasets for training and evaluation. The first approach integrates K-Nearest Neighbors KNN, Support Vector Machine SVM, and Random Forest RF algorithms through a logistic regression metaclassifier. This ensemble method harnesses the strengths of each algorithm, leading to improved metrics such as accuracy, precision, recall, and F1-score. The second approach employs transfer learning, where a pre-trained Artificial Neural Network ANN on the CICIDS2017 dataset is fine-tuned with the CICDDoS2019 dataset. This technique demonstrates the benefits of knowledge transfer, achieving high detection performance with reduced training time. Our findings reveal that both methods significantly enhance DDoS detection. The metaclassifier approach delivers superior performance metrics but requires more computational resources. In contrast, the transfer learning approach provides an efficient balance between performance and computational demand, ideal for rapid deployment scenarios. In summary, this study highlights the efficacy of combining multiple algorithms and leveraging pre-trained models to improve DDoS detection accuracy and efficiency. These approaches offer promising directions for developing robust and effective DDoS detection systems.

 This research focuses on enhancing the detection mechanisms for Distributed Denial of Service DDoS attacks using advanced machine learning techniques. We explore two innovative approaches: a metaclassifier stacking model and a transfer learning model, utilizing the CICDDoS2019 and CICIDS2017 datasets for training and evaluation. The first approach integrates K-Nearest Neighbors KNN, Support Vector Machine SVM, and Random Forest RF algorithms through a logistic regression metaclassifier. This ensemble method harnesses the strengths of each algorithm, leading to improved metrics such as accuracy, precision, recall, and F1-score. The second approach employs transfer learning, where a pre-trained Artificial Neural Network ANN on the CICIDS2017 dataset is fine-tuned with the CICDDoS2019 dataset. This technique demonstrates the benefits of knowledge transfer, achieving high detection performance with reduced training time. Our findings reveal that both methods significantly enhance DDoS detection. The metaclassifier approach delivers superior performance metrics but requires more computational resources. In contrast, the transfer learning approach provides an efficient balance between performance and computational demand, ideal for rapid deployment scenarios. In summary, this study highlights the efficacy of combining multiple algorithms and leveraging pre-trained models to improve DDoS detection accuracy and efficiency. These approaches offer promising directions for developing robust and effective DDoS detection systems.

 This research focuses on enhancing the detection mechanisms for Distributed Denial of Service DDoS attacks using advanced machine learning techniques. We explore two innovative approaches: a metaclassifier stacking model and a transfer learning model, utilizing the CICDDoS2019 and CICIDS2017 datasets for training and evaluation. The first approach integrates K-Nearest Neighbors KNN, Support Vector Machine SVM, and Random Forest RF algorithms through a logistic regression metaclassifier. This ensemble method harnesses the strengths of each algorithm, leading to improved metrics such as accuracy, precision, recall, and F1-score. The second approach employs transfer learning, where a pre-trained Artificial Neural Network ANN on the CICIDS2017 dataset is fine-tuned with the CICDDoS2019 dataset. This technique demonstrates the benefits of knowledge transfer, achieving high detection performance with reduced training time. Our findings reveal that both methods significantly enhance DDoS detection. The metaclassifier approach delivers superior performance metrics but requires more computational resources. In contrast, the transfer learning approach provides an efficient balance between performance and computational demand, ideal for rapid deployment scenarios. In summary, this study highlights the efficacy of combining multiple algorithms and leveraging pre-trained models to improve DDoS detection accuracy and efficiency. These approaches offer promising directions for developing robust and effective DDoS detection systems.

 Bu araştırma, Dağıtılmış Hizmet Engelleme DDoS saldırılarının tespit mekanizmalarını ileri makine öğrenme teknikleri kullanarak geliştirmeyi amaçlamaktadır. CICDDoS2019 ve CICIDS2017 veri setleri kullanılarak eğitim ve değerlendirme için iki yenilikçi yaklaşım araştırılmıştır: metaklasifikatör yığma modeli ve transfer öğrenme modeli. İlk yaklaşım, Lojistik Regresyon metaklasifikatörü aracılığıyla K-En Yakın Komşu KNN, Destek Vektör Makinesi SVM ve Rastgele Orman RF algoritmalarını birleştirir. Bu topluluk yöntemi, her algoritmanın güçlü yönlerinden yararlanarak doğruluk, kesinlik, geri çağırma ve F1-skoru gibi performans metriklerini iyileştirir. İkinci yaklaşım, CICIDS2017 veri setinde önceden eğitilmiş bir Yapay Sinir Ağı ANN modelinin CICDDoS2019 veri seti ile ince ayarlandığı transfer öğrenmeyi kullanır. Bu teknik, bilgi aktarımının faydalarını göstererek yüksek tespit performansına ve azaltılmış eğitim süresine ulaşır. Bulgularımız, her iki yöntemin de DDoS tespitini önemli ölçüde iyileştirdiğini ortaya koymaktadır. Metaklasifikatör yaklaşımı daha yüksek performans metrikleri sunar, ancak daha fazla hesaplama kaynağı gerektirir. Buna karşılık, transfer öğrenme yaklaşımı performans ve hesaplama talebi arasında verimli bir denge sağlar ve hızlı dağıtım senaryoları için idealdir. Sonuç olarak, bu çalışma, DDoS tespit doğruluğunu ve verimliliğini artırmada birden fazla algoritmanın kombinasyonunun ve önceden eğitilmiş modellerin kullanılmasının etkinliğini vurgulamaktadır. Bu yaklaşımlar, sağlam ve etkili DDoS tespit sistemleri geliştirmek için umut verici yönler sunar.

Article Details

ENHANCED DDoS ATTACK DETECTION THROUGH HYBRID MACHINE LEARNING TECHNIQUES

Authors:

Feraidoon Farahmandnia | Serhat Özekes

Publisher:

Istanbul Ticaret University

Main Topics:

Sistem ve Ağ Güvenliği

Journal:

İstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi Vol.7 Issue 2, pp.275-307

Document Type:

Article

Publication Date:

2/2025

Document Language:

English

Document ID (Org No.):

2001341235

pISSN:

2645-8969

DDoS Detection

Machine Learning

Metaclassifier

Transfer Learning

CybersecurityDDoS Tespiti

Makine Öğrenimi

Metaklasifikasyon

Transfer Öğrenme

Siber Güvenlik

Issues

Article Details

Authors: Feraidoon Farahmandnia | Serhat Özekes

Publisher: Istanbul Ticaret University

Main Topics: Sistem ve Ağ Güvenliği

Journal: İstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi Vol.7 Issue 2, pp.275-307

Document Type: Article

Publication Date: 2/2025

Document Language: English

Document ID (Org No.): 2001341235

pISSN: 2645-8969

Issues

Authors:

Feraidoon Farahmandnia | Serhat Özekes

Publisher:

Istanbul Ticaret University

Main Topics:

Sistem ve Ağ Güvenliği

Journal:

İstanbul Ticaret Üniversitesi Teknoloji ve Uygulamalı Bilimler Dergisi Vol.7 Issue 2, pp.275-307

Document Type:

Article

Publication Date:

2/2025

Document Language:

English

Document ID (Org No.):

2001341235

pISSN:

2645-8969