Scholarlink

In today’s increasingly connected digital landscape, Intrusion Detection Systems (IDS) play a critical role in safeguarding networks against evolving cyber threats. Among these, Distributed Denial of Service (DDoS) attacks remain particularly challenging due to their scale and complexity. This study proposes a host-based IDS framework that dynamically detects DDoS attacks by adapting to malicious behavior patterns in local and neighboring nodes. Using the CICIDS2017 dataset—a well-established benchmark containing realistic network traffic—we evaluate the performance of various machine learning classifiers and introduce two hybrid models that combine their strengths. The analysis involves feature selection using information gain to enhance model accuracy and efficiency. Results demonstrate that the proposed hybrid models, particularly the combination of Random Forest and Decision Tree (Hybrid 2), significantly outperform individual classifiers in terms of accuracy, F1-score, and detection rate, while maintaining low false alarm rates and fast execution times. These findings highlight the potential of hybrid machine learning models in enhancing DDoS detection for real-time, resource-constrained environments such as IoT networks.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Hybrid Machine Learning Models for DDoS Detection: A Performance Evaluation on the CICIDS2017 Dataset

  • 会议论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年

查看全文
  • Varkha K. Jewani,
  • Pragati V. Thawani,
  • Prafulla E. Ajmire,
  • Mohammad Atique,
  • Imed Ben Dhaou

摘要

In today’s increasingly connected digital landscape, Intrusion Detection Systems (IDS) play a critical role in safeguarding networks against evolving cyber threats. Among these, Distributed Denial of Service (DDoS) attacks remain particularly challenging due to their scale and complexity. This study proposes a host-based IDS framework that dynamically detects DDoS attacks by adapting to malicious behavior patterns in local and neighboring nodes. Using the CICIDS2017 dataset—a well-established benchmark containing realistic network traffic—we evaluate the performance of various machine learning classifiers and introduce two hybrid models that combine their strengths. The analysis involves feature selection using information gain to enhance model accuracy and efficiency. Results demonstrate that the proposed hybrid models, particularly the combination of Random Forest and Decision Tree (Hybrid 2), significantly outperform individual classifiers in terms of accuracy, F1-score, and detection rate, while maintaining low false alarm rates and fast execution times. These findings highlight the potential of hybrid machine learning models in enhancing DDoS detection for real-time, resource-constrained environments such as IoT networks.