Abstract
Distributed Denial-of-Service (DDoS) attacks remain a major cybersecurity challenge because of their ability to disrupt the availability of network resources by generating coordinated malicious traffic from multiple sources. The increasing dependence on cloud computing, Internet of Things (IoT), software-defined networking, and distributed digital services has further increased the potential impact of DDoS attacks. Machine learning (ML) has emerged as an important approach for identifying malicious traffic because it can learn statistical and behavioural patterns from network-flow data. However, different algorithms exhibit different strengths in terms of accuracy, computational complexity, interpretability, false-positive rates, and generalization.This study proposes a comparative analysis of three important machine-learning approaches for DDoS attack detection: Naïve Bayes, Logistic Regression, and ensemble learning. Naïve Bayes provides a computationally efficient probabilistic approach, Logistic Regression offers an interpretable linear classification model, while ensemble methods such as Random Forest, Gradient Boosting, and related approaches can capture complex nonlinear relationships among network features. The study proposes a rigorous experimental framework using publicly available intrusion-detection datasets, particularly CIC-DDoS2019 and UNSW-NB15. CIC-DDoS2019 contains benign traffic and multiple contemporary DDoS attack categories and provides more than 80 flow-based traffic features, while UNSW-NB15 contains 2,540,044 records representing normal activities and nine attack categories. The proposed comparison evaluates accuracy, precision, recall, F1-score, false-positive rate, ROC-AUC, detection latency, memory requirements, and model complexity. Particular emphasis is placed on the limitations of accuracy as a standalone metric in imbalanced cybersecurity datasets. Existing evidence suggests that ensemble models generally provide stronger predictive performance than simpler probabilistic and linear models, although this advantage may be accompanied by increased computational and implementation requirements. The study therefore argues that the most appropriate DDoS detector should not necessarily be the model with the highest accuracy, but the model that provides the best balance between detection effectiveness, computational efficiency, interpretability, and operational suitability.
Keywords: DDoS, Distributed Denial-of-Service, Naïve Bayes, Logistic Regression, Ensemble Learning, Random Forest, Machine Learning, Intrusion Detection, Cybersecurity, Network Security.
Introduction
The rapid expansion of Internet-based services has transformed modern organizations into highly interconnected digital environments. Businesses, universities, financial institutions, hospitals, government agencies, and technology companies increasingly rely on network infrastructure for communication, information processing, cloud applications, and service delivery. While this dependence provides significant benefits, it also creates opportunities for cybercriminals to disrupt network availability.Among the most persistent availability-based cyber threats are Distributed Denial-of-Service (DDoS) attacks. A DDoS attack involves coordinated traffic generation from multiple sources with the objective of exhausting network, server, application, or communication resources. Unlike a conventional Denial-of-Service attack originating from a single source, a DDoS attack distributes malicious activity across multiple systems, making source identification and traffic filtering substantially more difficult.The consequences of a successful DDoS attack can extend beyond temporary service interruption. Organizations may experience financial losses, reputational damage, loss of customer confidence, operational disruption, and increased recovery costs. In critical environments, prolonged unavailability may also have significant social and safety implications.Traditional DDoS detection mechanisms have relied heavily on signatures, predefined rules, traffic thresholds, and manually engineered statistical indicators. Although these approaches remain valuable, they face difficulties when attackers alter traffic characteristics or employ low-rate and application-layer techniques that resemble legitimate network activity.Machine learning provides an alternative because models can learn relationships between traffic characteristics and attack labels. Rather than relying exclusively on predetermined signatures, an ML-based detector can identify statistical patterns associated with malicious behaviour.However, the performance of an ML-based DDoS detector depends strongly on algorithm selection. A model may achieve high accuracy while generating excessive false positives. Another model may have excellent detection capability but require too much computational power for real-time deployment.
This study therefore focuses on a comparative examination of three algorithmic families: 1. Naïve Bayes2. Logistic Regression3. Ensemble Learning
The comparison is academically significant because these approaches represent three different modelling philosophies. Naïve Bayes uses probabilistic assumptions, Logistic Regression models a linear decision boundary, while ensemble algorithms combine multiple learners to capture more complex relationships.The central argument of this research is that algorithm selection for DDoS detection should be based on a multidimensional assessment rather than accuracy alone.
Problem Statement
The increasing sophistication of DDoS attacks presents a challenge to conventional intrusion-detection systems. Network environments generate enormous volumes of traffic, and legitimate traffic can vary considerably according to time, location, application, user behaviour, and organizational activity.A detection system that interprets every unusual increase in traffic as malicious may generate large numbers of false alarms. Conversely, a system with an excessively conservative threshold may fail to detect attacks until substantial damage has already occurred.Machine-learning approaches attempt to address this problem by learning patterns from network data. Nevertheless, different ML algorithms make different assumptions about the structure of the data.Naïve Bayes assumes conditional independence between features given the class. Network-flow variables, however, are often strongly correlated. Logistic Regression provides a relatively simple and interpretable model but may not adequately represent highly nonlinear relationships between network features. Ensemble algorithms can overcome some of these limitations by combining multiple decision structures, but their computational complexity and reduced interpretability can become important considerations.Existing research demonstrates that the performance gap among algorithms can be substantial. For example, a comparative evaluation reported on CIC-DDoS2019 showed Random Forest outperforming Logistic Regression and Naïve Bayes in accuracy, precision, recall, and F1-score under that experimental configuration. ([ResearchGate][1]) Another study comparing models on CIC-DDoS2019 reported Naïve Bayes with 51% precision and 49% recall, Logistic Regression with 86% precision but only 11% recall, and Random Forest with 78% precision and 70% recall in one referenced comparison. ([PubMed Central (PMC)][2])These findings demonstrate why accuracy alone can be misleading. A Logistic Regression model with 95% accuracy but very low recall would be unsuitable if the objective is to detect as many DDoS attacks as possible.Consequently, there is a need for a systematic comparison that evaluates the three algorithmic approaches according to multiple performance dimensions.
Aim and Objectives of the Study
Aim
he primary aim of this study is to comparatively evaluate the effectiveness of Naïve Bayes, Logistic Regression, and ensemble learning algorithms for detecting DDoS attacks in modern computer networks.
Specific Objectives
The study seeks to: 1. identify network-flow features that are useful for DDoS detection;2. develop a Naïve Bayes-based DDoS detection model;3. develop a Logistic Regression-based DDoS detection model;4. develop ensemble-learning models for DDoS detection;5. compare the algorithms using standardized performance metrics;6. investigate the effect of feature selection and data balancing on detection performance;7. examine the computational cost of each approach;8. evaluate the generalization capability of the algorithms across datasets; and9. determine the most appropriate algorithm for practical DDoS detection environments.
Research Questions
The investigation is guided by the following research questions: RQ1: How effectively can Naïve Bayes detect DDoS attacks using network-flow features?RQ2: How effectively can Logistic Regression detect DDoS attacks compared with Naïve Bayes?RQ3: Do ensemble learning algorithms provide significantly better DDoS detection performance than Naïve Bayes and Logistic Regression?RQ4: How does feature selection affect the performance of the three algorithmic approaches?RQ5: How does class imbalance affect DDoS detection performance?RQ6: Which algorithm provides the best balance between predictive performance and computational efficiency?RQ7: How well do the models generalize when evaluated on data from a different network environment?
Literature Review
DDoS Detection and Machine Learning
Machine learning has become an important component of modern intrusion-detection research because network traffic contains behavioural patterns that can be represented mathematically. A typical network-flow observation can be represented as: X=(x_1,x_2,x_3,\ldots,x_n)
where \(x_1,\ldots,x_n\) represent characteristics such as packet count, byte count, flow duration, packet rate, protocol, port information, and inter-arrival times. The learning algorithm attempts to determine: f(X)\rightarrow Y
where \(Y\) represents the traffic class. For binary DDoS detection: Y \in \{Benign,DDoS\} he quality of this classification depends on both the features and the learning algorithm.
Naïve Bayes
Naïve Bayes is a probabilistic classifier based on Bayes' theorem: P(C|X)=\frac{P(X|C)P(C)}{P(X)}
The algorithm assumes that the predictor variables are conditionally independent given the class. For a DDoS detection problem: P(DDoS|X)
represents the probability that observed network traffic belongs to the DDoS class given its feature values.
Advantages
Naïve Bayes has several characteristics that make it attractive for network-security applications: low computational cost; fast training; fast prediction; relatively low memory requirements; simple implementation; suitability for high-dimensional datasets.
Its simplicity is particularly valuable where detection must occur rapidly.
Limitations
The principal weakness is the conditional-independence assumption.Network traffic variables are rarely completely independent. For example, packet count, byte count, packet rate, and flow duration may be strongly related.Consequently, the probabilistic assumptions of Naïve Bayes may reduce classification performance in complex traffic environments.Recent comparative research has similarly shown that Naïve Bayes can produce substantially weaker DDoS detection performance than stronger ensemble approaches under some experimental conditions. ([Springer][3])
Logistic Regression
Logistic Regression is a supervised classification algorithm that estimates the probability of a class using a logistic function: P(Y=1|X)=\frac{1}{1+e^{-(\beta_0+\beta_1X_1+\cdots+\beta_nX_n)}}
The model classifies an observation according to a decision threshold. For example: P(DDoS|X)\geq0.5 \Rightarrow DDoS. while: P(DDoS|X)<0.5 \Rightarrow Benign.
The threshold can be adjusted depending on the security objective.
Advantages
Logistic Regression provides: relatively low computational requirements; simple implementation; probabilistic outputs; high interpretability; straightforward feature-weight analysis; suitability for large datasets.
Its interpretability is particularly important in cybersecurity because administrators may need to understand why a flow has been classified as suspicious.
Limitations
The principal limitation is that conventional Logistic Regression models linear relationships between predictors and the log-odds of the outcome.DDoS behaviour, however, can involve nonlinear interactions between traffic variables.For example, packet rate alone may not indicate an attack. A combination of packet rate, connection duration, destination concentration, protocol behaviour, and source diversity may be much more informative.A linear model may therefore struggle to capture these complex relationships without feature engineering or nonlinear extensions.
Ensemble Learning
Ensemble learning combines multiple predictive models to produce a stronger overall classifier. Common ensemble approaches include: Random Forest; AdaBoost; Gradient Boosting; XGBoost; Extra Trees; and stacking and voting classifiers.
Random Forest is particularly relevant because it combines multiple decision trees and aggregates their predictions.Conceptually: \hat{Y} = mode(h_1(X),h_2(X),...,h_T(X)). where \(h_1,\ldots,h_T\) represent individual decision trees.
The fundamental advantage of ensemble learning is that multiple models can capture different aspects of the data.This makes ensemble methods particularly attractive for DDoS detection, where traffic patterns can be nonlinear and highly heterogeneous.A recent study specifically investigating ensemble approaches reported that an ensemble-based Gradient Boosting Classifier reduced misclassification compared with simpler models and used external CIC-DDoS2019 validation to assess robustness. ([Springer][3])Recent work has also explored stacking ensembles that combine Random Forest, AdaBoost, and XGBoost as base learners with Logistic Regression as a meta-learner for CIC-DDoS2019. ([MDPI][4])
Comparative Framework
Criterion
Model complexity
Training speed
Prediction speed
Interpretability
Nonlinear relationships
Feature interactions
Memory requirements
Scalability
Zero-day potential
Expected predictive power
Deployment complexity
Naïve Bayes
Low
Very high
Very high
High
Limited
Weak
Low
High
Moderate
Moderate
Low
Logistic Regression
Low–moderate
High
High
Very High
Limited
Limited
Low
High
Moderate
Ensemble Learning
Moderate–high
Moderate
High–moderate
Moderate
Strong
Strong
Higher
Higher
High
The table illustrates an important point: there is no universally superior algorithm.If the primary objective is extremely rapid classification on constrained hardware, Naïve Bayes may be attractive.If interpretability and simplicity are priorities, Logistic Regression may be preferable.If the primary objective is maximizing detection performance and modelling complex patterns, ensemble learning may be more appropriate.
Proposed Research Methodology
Research Design
The study adopts a quantitative experimental design.Three groups of machine-learning models will be trained, tested, and compared using standardized network-security datasets.The independent variable is the machine-learning algorithm, while dependent variables include: accuracy; precision; recall; F1-score; false-positive rate; ROC-AUC; training time; inference time; and memory consumption.
Dataset Selection
CIC-DDoS2019
CIC-DDoS2019 is proposed as the principal dataset because it was specifically developed for DDoS research. It includes benign traffic and multiple contemporary DDoS categories, including NTP, DNS, LDAP, MSSQL, NetBIOS, SNMP, SSDP, UDP, UDP-Lag, WebDDoS, SYN, TFTP, and other traffic categories. The dataset contains more than 80 traffic features extracted using CICFlowMeter-V3. Its structure makes it particularly suitable for comparing classification algorithms under a realistic flow-based setting.
UNSW-NB15
UNSW-NB15 can be used for external validation. The dataset contains 2,540,044 records and nine attack categories, including DoS, with 49 generated features. UNSW also provides predefined training and testing partitions containing 175,341 and 82,332 observations respectively. ([UNSW Sites][5])Using a second dataset strengthens the research because it reduces the possibility that conclusions are specific to a single benchmark.
Data Pre-processing
Before model development, the data should undergo:1. removal of duplicated records;2. treatment of missing values;3. removal of irrelevant identifiers;4. categorical-variable encoding;5. feature scaling where appropriate;6. outlier assessment;7. class-distribution analysis; and8. feature-selection procedures.
Scaling is particularly important for Logistic Regression, whereas tree-based ensemble methods are generally less sensitive to feature magnitude.
Feature Selection
The study should investigate whether reducing the feature set improves model efficiency without significantly reducing detection performance.Possible techniques include:correlation analysis;mutual information;recursive feature elimination;chi-square selection;model-based importance;principal component analysis.The goal can be expressed as:F^* = \arg\max_F Performance(F)-\lambda Complexity(F)where \(F^*\) is the optimal feature subset and \(\lambda\) represents the penalty associated with unnecessary complexity.This approach is important because a practical real-time DDoS detector should ideally use a compact set of highly informative features
Evaluation Metrics and Comparative Analysis
Accuracy is defined as:Accuracy=\frac{TP+TN}{TP+TN+FP+FN}However, accuracy can be misleading in imbalanced datasets.Precision is:Precision=\frac{TP}{TP+FP}It measures the proportion of traffic identified as attacks that is actually malicious.Recall is:Recall=\frac{TP}{TP+FN}For DDoS detection, recall is particularly important because false negatives represent attacks that the system fails to detect.The F1-score is:F1=2\left(\frac{Precision\times Recall}{Precision+Recall}\right)The F1-score provides a balanced assessment of precision and recall.False-positive rate should also be evaluated:FPR=\frac{FP}{FP+TN}A high FPR means that legitimate users are frequently classified as attackers.This is operationally dangerous because aggressive false-positive behaviour can itself create service-access problems.
Expected Comparative Findings
The proposed study should not assume that one algorithm will automatically outperform all others. Nevertheless, previous empirical evidence provides a basis for several hypotheses.
Hypothesis 1: Ensemble learning will achieve a higher overall F1-score than Naïve Bayes and Logistic Regression. This expectation follows from the ability of ensemble algorithms to model nonlinear interactions and complex feature relationships. Hypothesis 2Naïve Bayes will demonstrate lower computational requirements than ensemble methods. Its probabilistic structure is relatively simple, making it suitable for rapid classification. Hypothesis 3: Logistic Regression will provide superior interpretability compared with ensemble methods. The model coefficients provide direct information about the contribution of predictors. Hypothesis 4: Feature selection will improve the computational efficiency of all three approaches while maintaining or improving detection performance.Hypothesis 5: Performance differences will become more pronounced when the models are evaluated on an external dataset. This hypothesis is particularly important because a model that performs exceptionally well on one benchmark may not generalize effectively to another network environment.
Discussion
The central research issue is not simply determining which algorithm has the highest accuracy. Rather, the comparison should answer the more practical question:Which algorithm provides the most appropriate balance between detection capability, computational efficiency, reliability, and deployment suitability?Naïve Bayes represents the efficiency-oriented solution. Its principal value lies in simplicity. In environments where network traffic must be classified rapidly and computing resources are limited, its low complexity may be advantageous.However, the independence assumption can be problematic. Network traffic variables often exhibit strong dependencies, meaning that the model may fail to capture complex attack structures.Logistic Regression provides an intermediate solution. It retains computational efficiency while offering highly interpretable probability estimates. It can also serve as a useful baseline against which more sophisticated models are compared.Its limitation is its linear decision structure. Although nonlinearities can be introduced through feature transformations, this increases engineering complexity.Ensemble learning represents the performance-oriented solution. Random Forest and boosting algorithms can capture nonlinear relationships, interactions, and heterogeneous traffic characteristics. Existing research has provided evidence that ensemble methods can substantially reduce classification errors compared with simpler models. ([Springer][3])Nevertheless, ensemble learning should not automatically be considered the final solution.A large ensemble may require more memory and computational resources than Naïve Bayes or Logistic Regression. Moreover, greater model complexity may make incident investigation more difficult.A particularly important consideration is generalization.A DDoS detection model trained and evaluated using random splits from the same dataset may produce highly optimistic results. Traffic records that are statistically similar may appear in both training and testing partitions. Consequently, a high test score does not necessarily demonstrate that the model can identify attacks in an entirely different network environment.For doctoral-level research, cross-dataset evaluation should therefore be treated as a central methodological requirement rather than an optional experiment.The study should also distinguish between binary classification and multiclass classification.
Binary classification answers: Benign \quad vs. \quad DDoS
Multiclass classification attempts to determine the specific attack family. Multiclass classification is more difficult because different DDoS attack types may share overlapping characteristics. The CIC-DDoS2019 dataset is particularly suitable for such an investigation because it contains multiple DDoS categories.
Proposed Conceptual Model
The proposed research framework can be summarized as:Network Traffic↓Data Acquisition↓Data Cleaning↓Feature Engineering↓Feature Selection↓Class Balancing↓Three ML Approaches→ Naïve Bayes→ Logistic Regression→ Ensemble Learning↓Performance Evaluation↓Statistical Comparison↓Cross-Dataset Validation↓Best Algorithm / Hybrid RecommendationThe framework therefore moves beyond simply training three models. It evaluates the complete machine-learning pipeline.
Research Contribution
The proposed study can contribute in several ways to the DDoS detection literature.1 Algorithmic Contribution: It provides a direct comparison of probabilistic, linear, and ensemble approaches using consistent experimental conditions. 2 Methodological Contribution: It emphasizes multiple evaluation metrics rather than relying exclusively on accuracy.3 Practical Contribution: It considers computational cost and detection latency, which are important for real-time deployment.4 Generalization Contribution: Cross-dataset validation can provide stronger evidence of model robustness.5 Security Contribution: The study can identify whether simpler algorithms provide sufficient protection or whether the additional complexity of ensemble learning is justified.6 Academic Contribution: The findings can establish an empirical foundation for future research into hybrid DDoS detection systems combining lightweight baseline classifiers with more sophisticated ensemble models.
Conclusion
DDoS attacks remain a major threat to modern network availability, particularly as organizations increasingly depend on cloud services, IoT devices, distributed applications, and interconnected infrastructure. Machine learning provides a promising approach for identifying malicious traffic by learning behavioural patterns from network-flow data.This paper proposed a comparative analysis of Naïve Bayes, Logistic Regression, and ensemble learning algorithms for DDoS attack detection. The three approaches represent different trade-offs between simplicity, interpretability, computational efficiency, and predictive power.Naïve Bayes offers simplicity and speed but is constrained by its conditional-independence assumption. Logistic Regression provides an interpretable and computationally efficient baseline but may struggle with complex nonlinear relationships. Ensemble learning methods, including Random Forest and boosting approaches, offer greater capacity for modelling complex network behaviour but introduce additional computational and interpretability considerations.Evidence from existing research suggests that ensemble approaches can outperform simpler classifiers on DDoS datasets, although results depend strongly on dataset composition, preprocessing, feature selection, class balancing, and evaluation methodology. ([PubMed Central (PMC)][2])Consequently, the proposed research should not define the "best" model exclusively in terms of accuracy. A more meaningful assessment should consider precision, recall, F1-score, false-positive rate, ROC-AUC, training time, inference latency, memory requirements, and cross-dataset generalization.CIC-DDoS2019 provides an appropriate primary benchmark because it contains contemporary DDoS traffic and extensive flow-based features, while UNSW-NB15 provides a valuable independent environment for assessing generalization. Ultimately, the expected contribution of this research is to determine whether the increased complexity of ensemble learning produces sufficient security benefits to justify its deployment costs, or whether simpler approaches such as Naïve Bayes or Logistic Regression can provide an acceptable balance for particular network environments. Such a comparison is valuable not only from an academic perspective but also for organizations seeking practical, scalable, and cost-effective DDoS detection solutions.
References
Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems. Military Communications and Information Systems Conference (MilCIS). ([UNSW Sites][5])Sharafaldin, I., Lashkari, A. H., Hakak, S., & Ghorbani, A. A. (2019). Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. IEEE 53rd International Carnahan Conference on Security Technology.Canadian Institute for Cybersecurity. (2019). DDoS evaluation dataset (CIC-DDoS2019). University of New Brunswick. Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm. (2023). Sensors, 23 (20), 8642. The study provides comparative results involving Naïve Bayes, Random Forest, Logistic Regression, and deep-learning approaches on CIC-DDoS2019. ([MDPI][6])A lightweight machine learning approach for DDoS detection and classification. (2026). Scientific Reports. The study compares Complement Naïve Bayes, kNN, Random Forest, and Logistic Regression using CIC-DDoS2019 and examines data balancing and computational efficiency. ([PubMed][7])A PSO-Optimized gradient boosting framework for flow-based DDoS detection in software-defined networks. (2026). Peer-to-Peer Networking and Applications. The study compares multiple classifiers and investigates optimized ensemble learning with external CIC-DDoS2019 validation. ([Springer][3])Constructing an Ensemble Stacking Model for Detecting DDoS Attacks. (2026). The study investigates stacking using Random Forest, AdaBoost, XGBoost, and Logistic Regression on CIC-DDoS2019. ([MDPI][4])Distributed Denial of Service Attack Detection in Network Traffic Using Deep Learning Algorithm. (2023). Comparative evaluation of machine-learning and deep-learning approaches using CIC-DDoS2019. ([PubMed Central (PMC)][2])