DDoS attack detection from network traffic data using machine learning methods

This thesis aims to develop new DDoS attack prediction models by employing various machine learning and feature selection methods. Especially, Logistic Regression (LR), Multilayer Perceptron (MLP), Support Vector Machine (SVM), and Random Forest (RF) have been used to build different DDoS attack prediction models. Relief-F and minimum redundancy maximum relevance (mRMR) algorithms have been utilized as feature selectors. The dataset has been created with 10.000 rows of traffic data, considering an equal number of rows containing four different attack types and normal traffic. The dataset encompasses a diverse array of predictor variables, notably including packet size, transmission time, and indicators of attack occurrences, among numerous others. Accuracy, precision, recall, and F1-score metrics has been utilized to evaluate the performance of the models, whereas the generalization errors of the models have been assessed using 10-fold cross-validation. Results reveal that RF surpasses all other ML classifiers for predicting DDoS attack detection. Overall, mRMR performed better than Relief-F in predicting the DDoS attack detection. In both feature selection methods, it has been determined that packet size and temporal features are the most important predictors of DDoS attack prediction.