PUBLICATION 1

INTRODUCTION

The Internet has become an essential component of contemporary economic, social, educational, governmental, and industrial activities. Organizations increasingly depend on networked infrastructures to deliver cloud applications, financial services, e-commerce platforms, communication systems, healthcare applications, online education, and critical infrastructure services. This dependence has consequently increased the consequences of network disruption. Among the attacks capable of producing widespread disruption, Distributed Denial-of-Service (DDoS) attacks represent a particularly significant challenge.A DDoS attack occurs when an attacker coordinates traffic or service requests from multiple sources to exhaust the computational, memory, bandwidth, or application resources of a target. The objective is generally not to steal information directly but to prevent legitimate users from accessing a service. Modern DDoS campaigns can operate at different layers of the network stack, ranging from volumetric attacks that saturate bandwidth to protocol and application-layer attacks that exploit weaknesses in network services. Application-layer attacks are particularly difficult because malicious requests can resemble legitimate traffic, making simple threshold-based detection less effective. Recent research similarly identifies the diversity of DDoS attacks, heterogeneous network environments, and evolving communication protocols as major challenges for conventional defence mechanisms. (Wiley Online Library 1)Traditional DDoS detection mechanisms commonly rely on predefined signatures, traffic thresholds, access-control rules, rate limiting, and manually engineered indicators. Although these techniques remain useful, they can struggle against attacks that change their characteristics over time. A detector designed around a fixed traffic threshold, for example, may incorrectly classify legitimate traffic surges as attacks or fail to recognize a low-rate application-layer attack.Machine learning offers a fundamentally different approach. Rather than depending entirely on manually defined rules, an ML system can learn relationships among network-flow characteristics and identify patterns associated with malicious behaviour. Depending on the learning paradigm, the system may be trained using labelled attack data, discover previously unknown anomalies, or combine both approaches.Existing research has demonstrated the potential of machine learning for DDoS detection. Surveys have reported the use of supervised, unsupervised, hybrid, and deep-learning approaches across different network environments. (Wiley Online Library2) However, a major research problem remains: very high classification accuracy on a benchmark dataset does not necessarily translate into reliable real-world protection.This distinction is important for doctoral research. A useful DDoS defence system must not only identify malicious traffic but also operate within realistic time constraints, maintain low false-positive rates, generalize across network environments, cope with previously unseen attacks, and support appropriate mitigation decisions.Accordingly, this paper examines how machine learning can be integrated into a broader DDoS detection and prevention architecture. The emphasis is placed on both detection and prevention, because identifying an attack without an effective response mechanism does not fully solve the availability problem.

CONCEPTUAL BACKGROUND

Distributed Denial-of-Service Attacks

DDoS attacks can be broadly classified according to the resources they attempt to exhaust. Volumetric attacks consume network bandwidth through large quantities of traffic. Protocol attacks exploit weaknesses in network or transport protocols and may exhaust resources on routers, firewalls, load balancers, or servers. Application-layer attacks target specific services and attempt to consume server-side processing capacity.Common examples include UDP floods, SYN floods, DNS amplification, NTP amplification, SSDP attacks, HTTP floods, and other forms of coordinated traffic generation. The CIC-DDoS2019 dataset, for example, contains multiple DDoS families, including NTP, DNS, LDAP, MSSQL, NetBIOS, SNMP, SSDP, UDP, UDP-Lag, WebDDoS, SYN, and TFTP attacks. The distributed nature of DDoS attacks creates an important detection problem. A single malicious source may not generate enough traffic to appear suspicious. However, thousands of sources acting together can create a coordinated pattern. Therefore, effective detection should examine not only individual packets but also flow-level and aggregate behavioural characteristics.

Limitations of Conventional DDoS Detection

Traditional intrusion detection systems generally employ signatures, rules, statistical thresholds, or manually defined heuristics. These approaches offer several advantages, including simplicity, interpretability, and relatively low computational requirements.However, they have important limitations.First, signature-based systems are dependent on knowledge of previously observed attack patterns. A novel attack may therefore escape detection until a corresponding signature is developed.Second, static thresholds may be inappropriate in dynamic environments. A traffic level considered abnormal during ordinary operations may be completely legitimate during an online sale, major event, software release, or other traffic surge.Third, modern application-layer attacks can imitate legitimate requests. Consequently, characteristics such as packet volume alone may be insufficient.These limitations have motivated researchers to explore adaptive approaches based on machine learning and artificial intelligence.

Machine Learning for DDoS Detection

Machine-learning approaches to DDoS detection can broadly be categorized into supervised, unsupervised, semi-supervised, ensemble, and deep-learning methods.

Supervised Learning

Supervised learning requires labelled observations representing legitimate and malicious traffic. Algorithms such as Logistic Regression, Decision Trees, Random Forest, Support Vector Machines (SVM), k-Nearest Neighbours, Naïve Bayes, and gradient-boosting models can be trained to distinguish between traffic classes.Random Forest is particularly attractive for network-security applications because it can model nonlinear relationships, accommodate different feature types, and provide estimates of feature importance. Decision trees are similarly useful because their classification logic can be relatively easy to interpret.

The general classification problem can be expressed as: f(X)=Y

where (X) represents network traffic features and (Y) represents the predicted traffic class, such as benign or DDoS.

For binary classification: Y \in \{0,1\}

where 0 represents legitimate traffic and 1 represents malicious traffic.

The principal weakness of supervised learning is its dependence on the quality and representativeness of training data. A model trained on one network environment may perform poorly when deployed in another environment with different traffic characteristics.

Unsupervised Learning

Unsupervised learning attempts to identify patterns without requiring every observation to have a predefined label. Algorithms such as K-Means, DBSCAN, Isolation Forest, and autoencoders can be used to identify unusual traffic behaviour.This approach is particularly valuable for detecting previously unknown attacks. Instead of asking whether traffic matches a known DDoS signature, the model asks whether the observed behaviour deviates significantly from established normal patterns.However, anomaly detection introduces a fundamental challenge: not every anomaly is malicious. Legitimate but unusual traffic can produce false alarms.

Deep Learning

Deep-learning approaches use multilayer neural architectures to learn complex representations from traffic data. Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, autoencoders, and transformer-based models have increasingly attracted attention in network-security research.LSTM models are particularly suitable when temporal relationships between network observations are important. For example, a DDoS attack may initially produce subtle changes in connection frequency that become obvious only when traffic behaviour is examined over a sequence of time intervals.

Deep learning can therefore be represented conceptually as: X_t, X_{t-1},...,X_{t-n} \rightarrow F_{\theta}(X) \rightarrow Y

where \(X_t\) represents network observations over time, \(F_{\theta}\) represents the learned model, and \(Y\) represents the predicted class.

The disadvantage is computational complexity. Deep models may require considerable training resources and may be difficult to deploy on resource-constrained network devices.