Impact of feature selection on the performance of machine learning models for distributed denial of service detection

Abstract

Distributed denial-of-service (DDoS) attacks significantly compromise network availability. Distributed reflection denial-of-service (DrDoS) is a variant of DDoS that exploits intermediary servers to reflect and amplify traffic toward the victim. In software-defined networking (SDN) contexts, machine learning (ML)-based detection has proven to be an efficient countermeasure; nevertheless, high-dimensional traffic features frequently diminish detection performance. This study examines the influence of sequential feature selection on the efficacy of ML models for DDoS detection utilizing the CIC-DDoS2019 dataset. A two-stage feature selection method integrating mutual information (MI) score and joint entropy analysis is suggested to diminish feature dimensionality while maintaining discriminative efficacy. The diminished feature sets are assessed utilizing random forest (RF), support vector machine (SVM), k-nearest neighbors (KNN), gradient boosting algorithm (GBA), and neural network classifiers. Experimental findings indicate that the suggested strategy markedly enhances computational efficiency and detection accuracy, with RF attaining over 97% accuracy and F1-score across several DDoS attack types. The results affirm that efficient feature selection is essential for scalable and precise DDoS detection in SDN systems.