Detection and classification of DDoS flooding attacks by machine learning method
Abstract
This study focuses on a method for detecting and classifying distributed denial of service (DDoS) attacks, such as SYN Flooding, ACK Flooding, HTTP Flooding, and UDP Flooding, using neural networks. Machine learning, particularly neural networks, is highly effective in detecting malicious traffic. A dataset containing normal traffic and various DDoS attacks was used to train a neural network model with a 24-106-5 architecture. The model achieved high Accuracy (99.35%), Precision (99.32%), Recall (99.54%), and F-score (0.99) in the classification task. All major attack types were correctly identified. The model was also further tested in the lab using virtual infrastructures to generate normal and DDoS traffic. The results showed that the model can accurately classify attacks under near-real-world conditions, demonstrating 95.05% accuracy and balanced F-score scores for all attack types. This confirms that neural networks are an effective tool for detecting DDoS attacks in modern information security systems.
Cite
@article{arxiv.2412.18990,
title = {Detection and classification of DDoS flooding attacks by machine learning method},
author = {Dmytro Tymoshchuk and Oleh Yasniy and Mykola Mytnyk and Nataliya Zagorodna and Vitaliy Tymoshchuk},
journal= {arXiv preprint arXiv:2412.18990},
year = {2025}
}
Comments
Paper Submitted to BAIT 2024 CEUR-WS, see https://ceur-ws.org/Vol-3842/paper11.pdf