Year: 2026
Type: article
Abstract: With the increasing complexity of network environments, Distributed Denial of Service (DDoS) reflection and exploitation attacks have become more diverse, necessitating not only detection but also accurate classification. We aim to find novel findings with universally, less complexity and better efficiency to detect and mitigate these attacks. Hence, this study proposes a lightweight and universal machine learning-based approach for multiclass DDoS detection and subcategory classification. The framework employs several models, including Complement Naïve Bayes, k-Nearest Neighbors (kNN), Random Forest (RF), and Logistic Regression—trained on universal and some minimal universal feature subsets. To address class imbalance and reduce data volume, the NearMiss under-sampling method is applied. Evaluations conducted on the CIC-DDoS2019 dataset demonstrate that the Random Forest classifier offers superior performance in terms of memory usage, while kNN with NearMiss yields faster inference times. The findings support the use of kNN in time-constrained environments and RF in memory-constrained scenarios.
Source: Scientific Reports
Authors: Osama Ebrahem, Salah Dowaji, Suhel Alhammoud
Institution: Damascus University
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,690
OpenAlex ID: W4411913689