Enhanced Multi-Class DDoS Attack Identification using a Meta-Learning Ensemble
Cryptography and Security
Summary
The authors developed a system to better recognize different types of DDoS attacks, which are cyberattacks that overwhelm networks. Instead of just saying if traffic is bad or not, their model can tell exactly what kind of attack is happening by combining three different machine learning methods and then using another model to decide the best answer. They tested this on a standard dataset and got higher accuracy than simpler methods. They also showed it works well in a simulated network environment, proving it could be useful in real-world defenses.
Authors
Ankith Indra Kumar, Genya Ishigaki, Amith Kamath Belman
Abstract
Distributed Denial of Service (DDoS) attacks continue to pose significant threats to network availability and security. While many detection systems focus on binary classification (attack vs. benign), effective mitigation often requires identifying the specific type of DDoS attack. This paper introduces a robust intrusion detection framework centered around a high-accuracy, multi-class classification model designed to precisely identify various DDoS attack types. We propose an ensemble architecture integrating Long Short-Term Memory (LSTM), K-Nearest Neighbors (KNN), and Random Forest (RF) models, whose outputs are synthesized by a Logistic Regression meta-learner. This approach explicitly addresses the ambiguity often encountered when combining predictions from multiple independent classifiers. Evaluated on the CIC-DDoS2019 dataset, our proposed ensemble meta-learning model achieves 96% accuracy in the multi-class identification task, significantly outperforming a baseline chain model (combining individual binary classifiers), which reached 92% accuracy and suffered from high ambiguity. Furthermore, integration and testing within a Software-Defined Networking (SDN) environment using Mininet and the Ryu controller demonstrated the practical applicability of our model, achieving 93% accuracy in identifying DDoS types in the emulated network traffic. Our work highlights the value of meta-learning ensembles for nuanced DDoS threat identification, paving the way for more adaptive and effective defense mechanisms.