What type of study is this?

September 5, 2025Open Access

Using a Combination of Effective Feature Selection Methods and an Entropy-based Approach to Identify DDoS Anomalies

Key Points

Achieving detection accuracy above 97%, the method identifies various DDoS attacks effectively using entropy.
Using five key features, the approach maintains a near-zero false positive rate in DDoS detection.
The combined machine learning techniques enhance identification of DDoS anomalies, contributing significantly to network security.
Evaluation on the CIC-DDoS2019 database confirms the robustness of the proposed detection method in real-world scenarios.

Abstract

Distributed Denial of Service (DDoS) attacks are among the most dangerous types of attacks. These kinds of attacks bring targeted servers down and make their services unavailable to legal users. The first objective of this study is to identify infected Ethernet and detect various kinds of up-to-date DDoS attacks using a dynamic threshold by implementing multiple features of entropy and the Sequential Probabilities Ratio Test approach (E-SPRT). The second is to select relevant features to improve the performance of detection by implementing a new combination of machine learning techniques, which are ANOVA, Extra Trees Classifier, Random Forest, and Correlation Matrix with Pearson Correlation approaches. Canadian Institute for Cybersecurity (CIC-DDoS2019) databases were utilised to evaluate the implementation. ESPRT using a feature selection approach with five features achieved an accuracy of over 97% with an average False Positive Rate (FPR) close to 0 in identifying most different kinds of DDoS attacks.

Using a Combination of Effective Feature Selection Methods and an Entropy-based Approach to Identify DDoS Anomalies

Key Points

Abstract

Cite This Study

Also Consider

Also Consider