A Hybrid Rule-Based and Machine Learning Approach for Distributed Denial of Service (DDoS) Attack Detection and Mitigation in Wireless Sensor Network–Enabled Smart Healthcare Systems

This paper presents a rule-based and machine learning (ML)-driven technique for the efficient detection of Distributed Denial of Service (DDoS) attacks in healthcare wireless sensor networks (WSNs). The proposed method involves design and analysis of various rules on extracted features of the WSN-DS dataset. The rule-based approach selects efficient rules to identify normal flow, and in case of suspicious flow, ML techniques are utilised to identify types of DDoS attacks, such as “Blackhole”, “Flooding”, “Grayhole”, and “TDMA.” Decision Tree, Support Vector Machine classifiers, Gaussian Naïve Bayes, and K-Nearest Neighbour are applied to evaluate the accuracy of the model. The rule-based classifier effectively differentiates normal and suspicious traffic, with an accuracy of 97.29%. Following detection, the decision tree classifier attains the highest accuracy - 99.43% - in classifying the various DDoS attack types. After identifying the specific variant of the DDoS attack, appropriate mitigation strategies can be effectively implemented. The proposed method introduces simple rules to classify normal and suspicious traffic flows. These rules are computationally lightweight and therefore help to reduce the overall cost of the intrusion detection system. The proposed method enhances the security of healthcare WSN/wireless body area network, highlighting its potential for real-world application in safeguarding healthcare infrastructure against DDoS attacks.