An approach towards hybrid feature selection for detection of DDoS attack

Quantitative detection of azodicarbonamide in wheat flour by near-infrared spectroscopy based on two-step feature selection

Nowadays, the IoT is the most advanced technologies of the 21st century. As this technology advances, attacks are also growing in parallel. One of the most dangerous attacks IoT devices face is the DDoS attack. This paper addresses DDoS attack detection and other types of attacks to which IoT devices are vulnerable. We evaluated the CICIoT2023 dataset to analyze various DDoS attacks. In this work, we developed a novel hybrid feature selection algorithm combining SelectKBest and RFE. With a hybrid, algorithm, we selected the top 10 features and trained them with machine learning algorithms. We applied four models, RF, DT, XGB, and KNN to evaluate the CICIoT2023 dataset in two categories: 34 classes and 12 DDoS classes, using 5, 10, and 15 features. For the 34 classes, we achieved 99.15% accuracy, and for the 12 DDoS classes, we achieved 99.95% accuracy with the Decision tree model.

Artificial intelligence and deep learning are powerful tools for extracting knowledge from large datasets, particularly in healthcare. However, their black-box nature raises interpretability concerns, especially in high-stakes applications. Existing eXplainable Artificial Intelligence methods often focus solely on visualization or rule-based explanations, limiting interpretability's depth and clarity. This work proposes a novel explainable AI method specifically designed for medical image analysis, integrating statistical, visual, and rule-based explanations to improve transparency in deep learning models. Statistical features are derived from deep features extracted using a custom Mobilenetv2 model. A two-step feature selection method - zero-based filtering with mutual importance selection - ranks and refines these features. Decision tree and RuleFit models are employed to classify data and extract human-readable rules. Additionally, a novel statistical feature map overlay visualization generates heatmap-like representations of three key statistical measures (mean, skewness, and entropy), providing both localized and quantifiable visual explanations of model decisions. The proposed method has been validated on five medical imaging datasets - COVID-19 radiography, ultrasound breast cancer, brain tumor magnetic resonance imaging, lung and colon cancer histopathological, and glaucoma images - with results confirmed by medical experts, demonstrating its effectiveness in enhancing interpretability for medical image classification tasks.

Early and correct diagnosis of lung cancer is the only way to enhance survival rates, but due to the prevalence of small and imbalanced datasets, predictive models are highly limited. The current paper presents a new hybrid intelligent methodology that combines a two-step feature selection pipeline with an ensemble classification model that is confirmed on the Kaggle Lung Cancer Dataset. Filter-based mutual information ranking coupled with wrapper optimization via Genetic Algorithm and Elastic Net regularization was used to select features (reduced a 12-dimensional feature set to 5 key attributes (Age, Smoking, Coughing, Chest Pain, Shortness of Breath)) with a dimensionality reduction of 58.3%. Missing value imputation, normalization of data through one-hot encoding, and ADASYN balancing were performed to deal with class imbalance and maximize the generalization capabilities. The experimental findings show that the given method performs much better than baseline models. The hybrid prediction achieved 94.8% accuracy, 94.5% precision, 94.2% recall, and 94.37 F1-score, with a model AUC of 0.962. This outperforms the no-feature-selection benchmark by 6.2 in accuracy and 5.9 in recall, despite the unbalancing preprocessing options. The Confusion matrix reported 285 true positives and 290 true negatives, with minimal values of 10 and 15 false positives and false negatives, respectively, indicating strong reliability. Despite the pilot data set being small, survey-based, and using a test set with 95.9599 accuracy labeling, the proposed method achieves competitive and reliable performance, as noted through comparative analysis with the existing literature. These findings assure that the optimization of preprocessing, hybrid feature selection, and ensemble learning can be effective both in reducing overfitting and increasing diagnostic performance. As such, this technique may serve as a practical method in data-limited settings to screen patients to detect lung cancer at an early stage.

Adolescents in higher education are more prone to Avoidant Personality Disorder (AVPD), which strongly affects academic achievement. The goal of this study was to create models for accurate prediction of the likelihood of Avoidant Personality Disorder among students in higher education. Information Gain, Gain Ratio, and Wrapper Approach are used as feature selection methods combined with data resampling techniques and machine learning, including Multi-Layer Perceptron Neural Network, Naïve Bayes, Decision Tree, Random Forest, and Support Vector Machine. The findings revealed that the Wrapper approach gave higher accuracy than Information Gain and Gain Ratio approach. Further, using the Gain Ratio approach gives the model a slightly higher efficiency than the Information Gain. Furthermore, when comparing feature selection and data resampling, it was found that the model using feature selection had more higher model efficiency than data resampling alone. Additionally, combining the Synthetic Minority Over-sampling Technique with Edited Nearest Neighbor (SMOTE-ENN) considerably increased the model’s effectiveness. Finally, the model’s efficiency was at its maximum, with an accuracy of 95.52%, when the Wrapper approach was used in conjunction with the Synthetic Minority Over-sampling Technique, the Edited Nearest Neighbor algorithm, and the Multi-Layer Perceptron Neural Network.

Landslide susceptibility analyses using Random Forest, C4.5, and C5.0 with balanced and unbalanced datasets

Nowadays, Internet of Things (IoT) applications are growing and gaining popularity.This accelerated development encounters several obstacles, including the sheer volume of data generated, network scalability, and security concerns. Distributed Denial of Service (DDoS) attacks are widespread in IoT systems because security is frequently overlooked in detection systems. Therefore, it is necessary to propose an efficient IDS to detect DDoS attacks from immense network traffic. The present study suggests a hybrid feature selection model by combining filter-based Pearson Correlation and wrapper-based Boruta with the Light gradient Boost Model (LGBM) as a base classifier (PCB-LGBM). In addition, the hyperparameters of the model are tuned by using the shap-hyper tune approach and retrieved more informative features. The proposed architecture was tested on the CICIDS-2017 dataset. The experimental results reveal that the suggested model PCB-LGBM has better results with the LGBM classifier when compared with other methods such as Decision Tree (DT), Multi-Layer Perceptron (MLP), and K-Nearest Neighbors (KNNs).

Android OS based applications offer services in various aspects of our daily lives such as banking, personal, professional, social, etc. Increased usage of Android applications makes them extremely vulnerable to various malware threats. A resilient and attack resistant machine learning based Android malware detector is desired to achieve a safe working environment. This work employs feature selection on static and dynamic features and proposes a hybrid feature selection method that can identify most informative features while eliminating the irrelevant ones. Information gain from filter and recursive feature elimination from wrapper feature selection methods outperform other evaluated feature selection techniques. Thereafter, different classification algorithms are trained on the features selected through hybrid feature selection technique and experimental results showed that XGBoost obtained maximum accuracy i.e., 98% and 89% for binary and multiclass classification respectively using only 50 features.

Schizophrenia (SZ) is a complex neuropsychiatric disorder that seriously affects the daily life of patients. Therefore, accurate diagnosis of SZ is essential for patient care. Several T1-weighted magnetic resonance imaging (MRI) and diffusion tensor imaging (DTI) markers (e.g., cortical thickness (CT), mean diffusivity (MD)) for SZ have been identified by using some existing brain atlases, and have been used successfully to discriminate patients with SZ from healthy controls (HCs). Currently, these markers have mainly been used separately. Thus, the full potential of T1-weighted MRI images and DTI images for SZ diagnosis might not yet have been used comprehensively. Furthermore, the extraction of these markers based on single brain atlas might not yet be able to use the full potential of these images. Therefore, in this study, we propose a multi-modality multi-atlas feature representation and a multi-kernel learning method (MMM) to perform SZ/HC classification. Firstly, we extract 8 feature sets from T1-weighted MRI images and DTI images via 4 existing brain atlases and 4 markers. Then, a two-step feature selection method is proposed to select the most discriminative features of each feature set for SZ/HC classification. Finally, a multiple feature sets based multi-kernel SVM learning method (MFMK-SVM) is proposed to combine all feature sets for SZ/HC classification. Experimental results show that our proposed method achieves an accuracy of 91.28%, a sensitivity of 90.85%, a specificity of 92.17% and an AUC of 0.9485 for SZ/HC classification. Experimental results illustrate that our proposed classification method is efficient and promising for clinical diagnosis of SZ.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

The increase in cybersecurity threats has made attack detection systems critically important. Traditional deep learning methods often require large amounts of data and struggle to understand relationships between features effectively. With their self-attention mechanism, Transformers excel in modeling complex relationships and long-term dependencies. They are also adaptable to various data types and sources, making them advantageous in large-scale attack detection scenarios. This paper introduces the FPE–Transformer framework, leveraging the strengths of the Transformer architecture. FPE–Transformer incorporates an innovative feature positional encoding mechanism that encodes the positional information of each feature separately, enabling a deeper understanding of feature relationships and more precise attack detection. Additionally, the model includes a ClassificationHead for enhanced accuracy and complex pattern recognition. The framework’s performance was validated using the NSL-KDD and CIC-IDS2017 datasets, demonstrating its superiority over traditional methods in detecting diverse attack types and improving overall performance. This study highlights FPE–Transformer’s innovative approach and ability to address key limitations of traditional deep learning methods, establishing it as a robust solution for modern attack detection challenges.

Now days use of internet for the getting and sharing of knowledge is very common. The end users those are accessing internet or system are vulnerable to malicious user attacks which results into legitimate user prevented from accessing the websites. Recently there are several of methods presented for application layer DDoS attacks by considering the different properties of attacks. However most of methods are suffered from the poor accuracy performance of DDoS attack detection at application layer. Hence DDoS attacks has been low volume & act own as a legitimate transaction on layer seven means application layer hence such attacks are not detected easily by IDS (Intrusion Detection Systems) or firewall systems. We believe that, the accuracy and efficiency of attacks detection is based on correctness of capture data traffic. In state-of-art methods, there is no provision to remove the noisy data from the capture logs and hence leads to incorrect detection results. In this paper we presented the real time computer networks data capturing for normal as well as attack infected traffics, then design the preprocessing algorithm to remove irrelevant data to optimize the attack detection performance which helps to naive bayes algorithm to classification. In this architecture, we use LOIC doss attack generator tool to create attack at packet capturing time of communication network. The experimental results show that proposed data pre-processing method with naive bayes multinomial is easy and efficient as compared to state-of-art solutions. To classify normal packets and DDoS attack we use naive bayes multinomial classifier

This paper presents a systematic method for DDoS attack detection. DDoS attack can be considered a system anomaly or misuse from which abnormal behavior is imposed on network traffic. Attack detection can be performed via abnormal behavior identification. Network traffic characterization with behavior modeling could be a good indication of attack detection. Aggregated traffic has been found to be strong bursty across a wide range of time scales. Wavelet analysis is able to capture complex temporal correlation across multiple time scales with very low computational complexity. We utilize energy distribution based on wavelet analysis to detect DDoS attack traffic. Energy distribution over time will have limited variation if the traffic keeps its behavior over time (i.e. attack-free situation) while an introduction of attack traffic in the network will elicit significant energy distribution deviation in a short time period. Our experimental results with typical Internet traffic trace show that energy distribution variance markedly changes, causing a "spike" when traffic behaviors are affected by DDoS attack. In contrast, normal traffic exhibits a remarkably stationary energy distribution. In addition, this spike in energy distribution variance can be captured in the early stages of an attack, far ahead of congestion build-up, making it an effective detection of the attack.

Nowdays, use of the Internet for transaction of knowledge is very common. The end users who are accessing Internet or system are vulnerable to malicious user attacks which results in legitimate user being prevented from accessing the websites. Recently, there are several methods presented for application layer DDoS attacks by considering the different properties of attacks. However, most of the methods suffered from the poor accuracy performance of DDoS attack detection at the application layer. Hence, DDoS attacks have been low volume and act on its own as a legitimate transaction on layer seven means application layer hence such attacks are not detected easily by IDS (Intrusion Detection Systems) or firewall systems. We believe that the accuracy and efficiency of attacks detection are based on correctness of capture data traffic. In state-of-the-art methods, there is no provision to remove the noisy data from the capture logs and hence leads to incorrect detection results. In this paper, we presented the real-time computer networks data capturing for normal as well as attack infected traffics, then designed the preprocessing algorithm to remove irrelevant data to optimize the attack detection performance. In this architecture, we use LOIC DDoS attack generator tool to create attack at packet capturing time and also use KDD cup data set for other attacks trace such as DoS, R2L, L2R, Probe, etc., of the communication network. The experimental results show that proposed data preprocessing method is easy and efficient as compared to state-of-the-art solutions.

Random Forest algorithm eliminates the confines of a decision tree algorithm by reducing the over-fitting of datasets. It can handle the missing values in an effective manner and is more accurate than the decision trees. This research study presents a comparison of five different supervised machine learning algorithms namely Naive Bayes, Decision Tree, Multilayer Perceptron, Support Vector Machine and Random Forest for the classification of the disease dataset collected from an online repository. The Random Forest algorithm emerges to be the most efficient algorithm in classifying the diseases. Also, the research study applies different attribute selection measures to evaluate the impact of accuracy on the Random Forest classifier empirically. Among the different node splitting criteria, we conclude that the GINI index performed better on average than the Information Gain and Gain Ratio. The work is implemented using the Python 3.7 programming language.