A Hybrid Feature Selection and Meta-Ensemble Framework for Distributed Denial-of-Service (DDoS) Detection
DOI:
https://doi.org/10.29284/g3np6723Keywords:
DDoS detection, Meta-ensemble learning, Random Forest, Hybrid feature selection (CA–MI–PCA), Real-time intrusion detection, SDN and IoT security, ROC–AUC & FPR optimization.Abstract
Distributed Denial-of-Service (DDoS) attacks remain a primary cause of service outages, overwhelming victims with coordinated traffic and challenging real-time defenses—especially in SDN, IoT, and heterogeneous enterprise settings where latency and false alarms carry operational costs. To address this, we present a deployable pipeline that combines hybrid feature selection with a Random-Forest–centric meta-ensemble (Proposed U-MERF).Our feature stage integrates Correlation Analysis, Mutual Information, and PCA to remove redundancy and retain discriminative signal from flow telemetry. Level-0 learners (e.g., Random Forest, Gradient-Boosted Trees, Logistic Regression) produce out-of-fold probabilities that a calibrated meta-learner fuses; operating thresholds are chosen under an explicit false-positive budget. We evaluate on six corpora CIC-DDoS2019, CSE–CIC–IDS2018, DDoS-SDN, APA-DDoS, DDoS-botnet, and CICIoT2023 using time/device-aware splits where appropriate. Compared with classical ML (LR, GNB, KNN, SVM, ANN) and standard ensembles (Bagging, AdaBoost, simple Stacking), our method consistently lifts Recall, F1, Balanced Accuracy, and AUC to ~100% with FPR ≈ 0% on dominant flood families; ROC curves cluster at the top-left frontier and confusion matrices collapse to perfect diagonals in DdoS-heavy settings. Importantly, inference latency is minimized: Proposed U-MERF matches/exceeds the accuracy of strong baselines while delivering the fastest test time (~0.0832 s). Ablations show that CA–MI–PCA selection, probability calibration, and meta-fusion each contribute to fewer false alarms and better stability on minority classes. We conclude with practical avenues drift detection, open-set rejection, and federated training to sustain accuracy, speed, and privacy in real deployments.
References
1. Aktar, S. and Nur, A.Y. Advancing Network Anomaly Detection: An Ensemble Approach Combining Optimized Contractive Autoencoders and K-Means Clustering. 2024 IEEE 3rd International Conference on Computing and Machine Intelligence (ICMI), 2024, pp. 1-5. IEEE.
2. Ahmad, Z. and Petrovski, A. Securing Cyber-Physical Systems with Two-level Anomaly Detection Strategy. 2024 IEEE 7th International Conference on Industrial Cyber-Physical Systems (ICPS), 2024, pp. 1-6. IEEE.
3. Alghushairy, O., Alsini, R., Alhassan, Z., Alshdadi, A.A., Banjar, A., Yafoz, A. and Ma, X. An Efficient Support Vector Machine Algorithm based Network Outlier Detection System. IEEE Access, 2024.
4. Gonaygunta, H., Nadella, G.S., Pawar, P.P. and Kumar, D. Enhancing Cybersecurity: The Development of a Flexible Deep Learning Model for Enhanced Anomaly Detection. 2024 Systems and Information Engineering Design Symposium (SIEDS), 2024, pp. 79-84. IEEE.
5. Harrou, F., Bouyeddou, B., Dairi, A. and Sun, Y. Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids. Future Internet, 16(6), 2024, p.184.
6. Hooshmand, M.K. and Hosahalli, D. Network anomaly detection using deep learning techniques. CAAI Transactions on Intelligence Technology, 7(2), 2022, pp. 228-243.
7. Lim, W., Chek, K.Y.S., Theng, L.B. and Lin, C.T.C. Future of generative adversarial networks (GAN) for anomaly detection in network security: A review. Computers & Security, 139, 2024, p.103570.
8. Rejito, J., Stiawan, D., Alshaflut, A. and Budiarto, R. Machine learning-based anomaly detection for smart home networks under adversarial attack. Computer Science and Information Technologies, 5(2), 2024, pp. 122-129.
9. Sana, L., Nazir, M.M., Yang, J., Hussain, L., Chen, Y.L., Ku, C.S., Alatiyyah, M. and Por, L.Y. Securing the IoT Cyber Environment: Enhancing Intrusion Anomaly Detection with Vision Transformers. IEEE Access, 2024.
10. Shamshari, A. and Najaf, H. Machine Learning Approaches for Anomaly Detection in Network Security. Eastern European Journal for Multidisciplinary Research, 1(1), 2024, pp. 22-29.
11. Söğüt, E. and Erdem, O.A. A multi-model proposal for classification and detection of DDoS attacks on SCADA systems. Applied Sciences, 13(10), 2023, p.5993.
12. Sun, H., Huang, Y., Han, L., Fu, C., Liu, H. and Long, X. MTS-DVGAN: Anomaly detection in cyber-physical systems using a dual variational generative adversarial network. Computers & Security, 139, 2024, p.103570.
13. Tahir, U., Abid, M.K., Fuzail, M. and Aslam, N. Enhancing IoT Security through Machine Learning-Driven Anomaly Detection. VFAST Transactions on Software Engineering, 12(2), 2024, pp. 01-13.
14. Usanova, K.I., Rani, G.S., Mishra, N., Kaur, S. and Sidhu, J. Machine Learning for Anomaly Detection in Electric Transportation Networks. E3S Web of Conferences, Vol. 511, 2024, p. 01039. EDP Sciences.
15. Vibhute, A.D. and Nakum, V. Deep learning-based network anomaly detection and classification in an imbalanced cloud environment. Procedia Computer Science, 232, 2024, pp. 1636-1645.
16. Wang, S., Jiang, R., Wang, Z. and Zhou, Y. Deep Learning-based Anomaly Detection and Log Analysis for Computer Networks. arXiv preprint arXiv:2407.05639, 2024.
17. Yao, Y. Neural Network-Driven Smart City Security Monitoring in Beijing Multimodal Data Integration and Real-Time Anomaly Detection. International Journal of Computer Science and Information Technology, 3(3), 2024, pp. 91-102.
18. Jagtap, Smruti, Vikrant Kavitkar, Mahek Jain, Anup Ingle, Jayashree P. Tamkhade, and Ketki Kshirsagar. "Enhancing Cyber Security Against DDoS Attacks: A Comprehensive Review and Future Directions." In 2025 1st International Conference on AIML-Applications for Engineering & Technology (ICAET), pp. 1-6. IEEE, 2025.
19. Adaramola, Ojo Jayeola, and Olaniyi Habib Aliu. "Evaluating the Impact of Denial-of-Service (DoS) Attacks on Enterprise Networks Using Optimized Network Engineering Tools (OPNET 14.5) and Machine Learning." International Journal of Scientific Research in Network Security and Communication 13, no. 2 (2025): 1-11.
20. Hirsi, Abdinasir, Mohammed A. Alhartomi, Lukman Audah, Adeb Salh, Nan bin Mad Sahar, Salman Ahmed, Godwin Okon Ansa, and Abdullahi Farah. "Comprehensive analysis of ddos anomaly detection in software-defined networks." IEEE Access (2025).
21. Pasupathi, Subbulakshmi, Raushan Kumar, and L. K. Pavithra. "Proactive DDoS detection: integrating packet marking, traffic analysis, and machine learning for enhanced network security." Cluster Computing 28, no. 3 (2025): 210.
22. Akhi, Mirza, Ciarán Eising, and Lubna Luxmi Dhirani. "TCN-Based DDoS detection and mitigation in 5G Healthcare-IoT: A frequency monitoring and dynamic threshold approach." IEEE Access (2025).
23. Akhtar, Md Mobin, Sultan Ali Alasmari, Sk Wasim Haidar, and Ali Abdulaziz Alzubaidi. "Distributed denial of service attack detection and mitigation strategy in 5G-enabled internet of things networks with adaptive cascaded gated recurrent unit." Peer-to-Peer Networking and Applications 18, no. 2 (2025): 81.
24. Afraji, Doaa Mohsin Abd Ali, Jaime Lloret, and Lourdes Peñalver. "Deep learning-driven defense strategies for mitigating DDoS attacks in cloud computing environments." Cyber Security and Applications (2025): 100085.
25. Redekar, Ramesh, and Rajesh Bharati. "DDoS Attacks: Detection Techniques, Challenges, and Modern Practices." In 2025 IEEE International Students' Conference on Electrical, Electronics and Computer Science (SCEECS), pp. 1-7. IEEE, 2025.
26. Ahmad, Iftikhar. "A Federated Learning Approach to Strengthen IoT-Based Intrusion Detection Against Low-Rate DDoS Attacks." In 2025 2nd International Conference on Advanced Innovations in Smart Cities (ICAISC), pp. 1-6. IEEE, 2025.
27. Mehmood, Sajid, Rashid Amin, Jamal Mustafa, Mudassar Hussain, Faisal S. Alsubaei, and Muhammad D. Zakaria. "Distributed denial of services (DDoS) attack detection in SDN using Optimizer-equipped CNN-MLP." PloS one 20, no. 1 (2025): e0312425.
28. Kumari, Pooja, Ankit Kumar Jain, Arpit Seth, and Raghav. "Leveraging blockchain and machine learning to counter DDoS attacks over IoT network." Multimedia Tools and Applications 84, no. 1 (2025): 317-341.
29. Ain, Noor Ul, Muhammad Sardaraz, Muhammad Tahir, Mohamed W. Abo Elsoud, and Abdullah Alourani. "Securing IoT networks against DDoS attacks: a hybrid deep learning approach." Sensors 25, no. 5 (2025): 1346.
30. Habib, AKM Ahasan, Ahmed Imtiaz, Dhonita Tripura, Md Omar Faruk, Md Anwar Hossain, Iffat Ara, Sohag Sarker, and AFM Zainul Abadin. "Distributed denial-of-service attack detection short review: issues, challenges, and recommendations." Bulletin of Electrical Engineering and Informatics 14, no. 1 (2025): 438-446.
31. Bhambhani, Shirin, and Esparsh Raj Gaur. "Prevention Techniques for DDoS Attacks in Cloud Computing." In 2025 International Conference on Next Generation Communication & Information Processing (INCIP), pp. 397-401. IEEE, 2025.
32. Parthiban, N., S. Vijay, and S. N. Sheela. "Comparison of mitigating DDoS attacks in software defined networking and IoT platforms." Cyber Security and Applications 3 (2025): 100080.
33. Haddadi, Mohamed, Abdelhamid Khiat, Hadil Bouaoud, and Hadjer Djehiche. "SPGDAD: Slow HTTP-Get denial of service attack detection using ontology." Information Security Journal: A Global Perspective 34, no. 1 (2025): 79-87.
34. Hossain, M. A., & Islam, M. S. (2024). Enhancing DDoS attack detection with hybrid feature selection and ensemble-based classifier: A promising solution for robust cybersecurity. Measurement: Sensors, 32, 101037.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License.
This work is licensed under a Creative Commons Attribution 4.0 International License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
