COMPARISON OF MACHINE LEARNING TECHNIQUES FOR CLASSIFICATION OF DISTRIBUTED DENIAL OF SERVICE ATTACKS BASED ON FEATURE ENGINEERING IN SDN-BASED NETWORKS

Abstract

Distributed Denial-of-Service (DDoS) attacks present a noteworthy cybersecurity hazard to software-defined networks (SDNs). This investigation presents an approach that depends on feature engineering and machine learning to discern DDoS attacks in SDNs. Initially, the dataset acquired from Kaggle goes through cleansing and normalization procedures, and the optimal subset of features is determined by employing the Correlation-based Feature Selection (CFS) algorithm. Subsequently, the optimal subset of features is trained and evaluated utilizing diverse Machine Learning algorithms, specifically Random Forest (RF), Decision Tree, Adaptive Boosting (AdaBoost), K-Nearest Neighbor (k-NN), Gradient Boosting, Extreme Gradient Boosting (XGBoost), Light Gradient Boosting Machine (LightGBM), and Categorical Boosting (CatBoost). The outcomes demonstrate that XGBoost outperforms the other algorithms in various performance metrics (e.g., accuracy, precision, recall, F1, and AUC values). Furthermore, a comparative analysis was carried out among various models and algorithms, revealing that the technique proposed by the researchers yielded the most favourable outcomes and effectively detected and identified DDoS attacks in SDN. Consequently, this investigation provides a novel perspective and resolution for SDN security.