Impact of Feature Selection Methods on the Classification of DDoS Attacks using XGBoost

Abstract

Distributed Denial of Service (DDoS) attacks impose a major challenge for today's security systems, given the variety of its implementations and the scale that the attacks can achieve. One approach for their early detection is the use of Machine Learning (ML) techniques, which create rules for classifying traffic from historical data. However, different types of data contribute unequally to the assertiveness of the trained model. The use of Feature Selection (FS) techniques as a pre-processing step allows identification of the most relevant features for the problem in question. This action reduces training time and can even improve performance when noisy variables are eliminated. The current work is based on a public dataset and the XGBoost algorithm to measure the impact of FS techniques on the DDoS attack classification problem. We consider both techniques independent of the sample labels, as well as methods that use this information to rank the variables in order of importance. We analyzed the problem from the point of view of Binary and Multiclass classification. We also created a benchmark of classification metrics and execution times. Our comparisons involved the Accuracy, Precision, Recall, and F1 Score metrics for different FS methods, in addition to training and execution time. In the results it is possible to verify for both the Binary (78% reduction of the features) and Multiclass classifiers (60% reduction of the features), that the ANOVA method proved to be the most beneficial.

Distributed denial of service attacks classification system using features selection and ensemble techniques

“…In terms of performance, the accuracy of our models exceeds by more than 9% the accuracy of models not using any metadata. Specifically, ou accuracy surpasses those models obtained by [1], [6], which did not use metadata. Furthermore, by categorizing the attacks exhibiting commonalities, as described previously, into 7 distinct subgroups, our model accomplished heightened performance with classification accuracy exceeding 97% across the aggregated evaluation set.…”

“…XGBoost is a decision tree-oriented method using regularization techniques to minimize overfitting [6]. It employs a gradient-boosting algorithm to construct a collection of weak models.…”

“…The study demonstrates that machine learning techniques can provide efficient DDoS attack detection when applied to recent benchmark datasets. Araujo et al [6] explored using feature selection to improve DDoS attack classification with XGBoost, comparing filter methods like variance filtering and wrapper techniques. Experiments on the CICDDoS2019 benchmark showed analysis of variance (ANOVA) provided the best performance enhancements.…”

Performance evaluation of multiclass classification models for ToN-IoT network device datasets

“…Subsequently, these outcomes will be utilized to compute accuracy, precision, RC, and F1-score values [26]. Multiple evaluation metrics hold significance in this context [27], [28]. Recognizing the prevailing agreement that relying solely on accuracy is inadequate for comprehensive performance assessment, we provide values for a majority of these metrics, especially in scenarios where datasets exhibit an abundance of positive examples compared to negative ones.…”

Strengthening Network Security: Evaluation of Intrusion Detection and Prevention Systems Tools in Networking Systems

“…However, one of the challenges IDPS faces is the ability to effectively detect and defend against evolving and unprecedented attacks [12], [13]. IDPS have traditionally employed two approaches for attack detection: signature-based and anomaly-based [14].…”