DDoS Attack Detection Using Network Traffic Features and Machine Learning

DDoS attacks pose a significant risk to contemporary network infrastructure. By overloading network resources with malicious traffic, they cause service disruptions. Conventional intrusion detection systems frequently fall short in the face of dynamic and frequent DDoS attacks because they depend on established patterns. In order to identify DDoS attacks, this paper presents a machine learning technique that examines network traffic characteristics. Due to data leakage, we removed the Source IP attribute from a dataset consisting of 852,585 instances. We used stratified train-test splitting in conjunction with label encoding to encode categorical characteristics. Packet Length (≈ -0.92) and Destination Port (≈ -0.45) were identified by correlation analysis as the critical characteristics for identifying attack traffic. XGBoost, Random Forest, and Logistic Regression were the three classifiers that we evaluated. The accuracy of Random Forest and XGBoost was 0.999947 and 0.999953, respectively, while Logistic Regression achieved 0.993432. The findings demonstrate that when combined with appropriate preprocessing and feature analysis, ensemble models provide incredibly precise and dependable DDoS detection.