DDoS attack detection with feature engineering and machine learning: the framework and performance evaluation

Distributed Denial of Service (DDoS) attacks have emerged as one of the most pervasive and damaging threats to network security, disrupting services and incurring substantial financial costs. Machine learning (ML) has been widely explored as a potential solution to enhance DDoS detection and mitigation. This systematic review evaluates the effectiveness of ML techniques in detecting DDoS attacks, synthesizing findings from studies published between 2004 and 2024. The review analyzes models such as Random Forest, Support Vector Machines (SVM), and K-Nearest Neighbors (K-NN) based on key performance metrics like accuracy, precision, recall, and F1-score. A comprehensive search of multiple databases, including Web of Science, IEEE, Scopus, ScienceDirect, and Google Scholar, resulted in 19 studies that met inclusion criteria. The findings show that ensemble methods, particularly Random Forest, consistently outperformed other models in terms of detection rates, mainly due to their ability to handle large feature sets and reduce overfitting. Support Vector Machines also performed well in specific scenarios. However, their effectiveness was sometimes limited by computational complexity and the dataset size. K-Nearest Neighbors showed mixed results, depending on the nature of the attack patterns. This review emphasizes the potential of ensemble learning approaches for DDoS detection, demonstrating their robustness in dynamic environments. The review identifies key gaps in the existing research, including the need for better feature selection and exploring deep learning techniques to enhance DDoS detection accuracy and adaptability further. This study contributes valuable insights into the strengths and limitations of ML-based DDoS detection models, offering a foundation for future advancements in the field. It underscores the importance of continued research into hybrid and deep learning models to address the evolving and increasingly sophisticated nature of DDoS attacks in real-world applications.

This paper explores the nature of threats posed by Distributed Denial of Service (DDoS) attacks on large networks, such as the Internet, emphasizing the need for effective detection and response mechanisms. These mechanisms must be implemented not only at the network edge but also within its core. The paper introduces methods to detect DDoS attacks by analyzing entropy and frequency-sorted distributions of specific packet attributes. Anomalies in these attributes' characteristics serve as indicators of potential DDoS attacks. The proposed methods are evaluated for detection accuracy and performance using live traffic traces collected from diverse network environments, including core Internet nodes and edge networks. Results demonstrate the effectiveness of these methods against current DDoS attacks and provide insights into improving detection capabilities for more sophisticated, stealthier threats. Additionally, the paper describes a detection-response prototype and discusses how the detection system can be extended to support effective response decision-making.

Cryptocurrency markets, particularly Bitcoin,are characterized by high volatility and complex non linear price movements, making trend prediction a significant challenge. The purpose of this research is to compare six different supervised machine learning models: Logistic Regression, Decision Tree, Random Forest, K-Nearest Neighbors (KNN), XGBoost, and Support Vector Machine (SVM), using a large dataset ofdaily changes in Bitcoin prices from September 2014 through January 2026 (24,863 records). The dataset is augmented by twelve different technical indicators (e.g. RSI, MACD, and multiple Simple Moving Averages (SMA)) that were created as input variables. As thefinancial data in this dataset is temporal in nature, time series cross-validation (Time Series Split) was used to evaluate the models in order to reduce the likelihood ofoverfitting due to random sample shuffling. Based on the experimental results, the Random Forest and XGBoost ensemble models are significantly better at predicting the price change for cryptocurrencies than the non-ensemble models, with the Random Forest model exhibiting an accuracy rate of 79.18% and AUC rate of 0.8675 for the validation folds, while the XGBoost model exhibited a 74.66% accuracy rate. This implies that advanced tree based ensemble models are capable of providing asignificant degree of prediction for cryptocurrency price trends if they are properly regularized and validated against financial market noise. Additionally, the predictive superiority of the ensemble models over the non-ensemble models was demonstrated statisticallythrough the use of McNemar's test and Point-Biserialcorrelation (p < 0.05). Keywords: Bitcoin, Machine Learning, Technical Analysis, Random Forest, XGBoost, Price Prediction, Financial Forecasting, Cryptocurrency, Supervised Machine Learning, Ensemble Learning, Time Series Cross-Validation, Feature Engineering.

In recent years, smart grid-based Electric Vehicle (EV) charging systems have increasingly faced vulnerabilities to Distributed Denial of Service (DDoS) attacks, especially through malicious authentication failures. These attacks typically involve monopolizing the Grid Server (GS), thereby hindering the authentication process for legitimate EVs. Despite the severity of this issue, no research (to the best of our knowledge) has focused on detecting DDoS attacks exploiting weaknesses in EV authentication. This study introduces a DDoS attack detection model specifically designed for EV authentication. The approach involves developing a machine learning model involving unique feature selection and combination. The proposed approach has been evaluated using a new DDOS attack dataset. The model is engineered to optimize feature combination, aiming for high sampling resolution, minimal information loss, and robust performance under 16 distinct attack scenarios. The feature combination used in this study shows improved accuracy over traditional DDoS detection methods based on access time variation while minimizing information loss.

Machine learning approach to predict susceptible growth regions of Moringa peregrina (Forssk)

Comparative study of different machine learning models in landslide susceptibility assessment: A case study of Conghua District, Guangzhou, China

Machine learning (ML) is a subdivision of artificial intelligence in which the machine learns from machine-readable data and information. It uses data, learns the pattern and predicts the new outcomes. Its popularity is growing because it helps to understand the trend and provides a solution that can be either a model or a product. Applications of ML algorithms have increased drastically in G.I.S. and remote sensing in recent years. It has a broad range of applications, from developing energy-based models to assessing soil liquefaction to creating a relation between air quality and mortality. Here, in this paper, we discuss the most popular supervised ML models (classification and regression) in G.I.S. and remote sensing. The motivation for writing this paper is that ML models produce higher accuracy than traditional parametric classifiers, especially for complex data with many predictor variables. This paper provides a general overview of some popular supervised non-parametric ML models that can be used in most of the G.I.S. and remote sensing based projects. We discuss classification (Naïve Bayes (NB), Support Vector Machine (SVM), Random Forest (RF), Decision Trees (DT)) and regression models (Random Forest (RF), Support Vector Machine (SVM), Linear and Non-Linear) here. Therefore, the article can be a guide to those interested in using ML models in their G.I.S. and remote sensing based projects.

Using AI to Predict Patient's Atypical Prescription Based on Individual's Feature-Set

The use of machine learning (ML) models in forensic anthropology (FA) has increased in the last half decade; however, there is a lack of a standardized protocol on how to curate, use, and assess ML models. We introduce PUMAA (A Protocol for Utilizing Machine Learning in Forensic Anthropological Analyses), which includes a flowchart and a checklist that forensic practitioners can follow when creating, using, or assessing ML models for forensic research. The five factors that must be assessed in determining an ML model's true performance are explored. The most common types of supervised ML models are also explained in lay terms and accompanied by visuals to increase accessibility of these complex concepts. Although not exhaustive, examples of information that should be reported have been discussed for seven types of ML models. In addition, their various strengths and limitations are evaluated in order to equip researchers with the necessary tools to make decisions regarding when and how to use ML models. This protocol provides an initial standard for the use of ML in FA.

Machine learning (ML) often provides applicable high-performance models to facilitate decision-makers in various fields. However, this high performance is achieved at the expense of the interpretability of these models, which has been criticized by practitioners and has become a significant hindrance in their application. Therefore, in highly sensitive decisions, black boxes of ML models are not recommended. We proposed a novel methodology that uses complex supervised ML models and transforms them into simple, interpretable, transparent statistical models. This methodology is like stacking ensemble ML in which the best ML models are used as a base learner to compute relative feature weights. The index of these weights is further used as a single covariate in the simple logistic regression model to estimate the likelihood of an event. We tested this methodology on the primary dataset related to cardiovascular diseases (CVDs), the leading cause of mortalities in recent times. Therefore, early risk assessment is an important dimension that can potentially reduce the burden of CVDs and their related mortality through accurate but interpretable risk prediction models. We developed an artificial neural network and support vector machines based on ML models and transformed them into a simple statistical model and heart risk scores. These simplified models were found transparent, reliable, valid, interpretable, and approximate in predictions. The findings of this study suggest that complex supervised ML models can be efficiently transformed into simple statistical models that can also be validated.

A Distributed Denial of Service (DDoS) attack occurs when an attacker tries to disrupt a network, service or website by flooding huge numbers of packets on the internet traffic. Detecting DDoS attacks serves the goal of spotting and addressing them promptly to reduce their effects on the network, system or service being targeted. Detecting Distributed Denial of Service (DDoS) attacks is crucial, for people, companies and network managers. The detection of DDoS attacks has ranging uses in industries such as network security safeguarding websites, managing cloud services ensuring the security of online systems and services. Detecting DDoS attacks is essential for safeguarding infrastructure upholding service availability and guaranteeing the security of online systems and services. To achieve this objective, we proposed a framework to detect DDoS attacks including six steps. In step one, we start by gathering information, which includes network activity and system records, for operations as well as instances of DDoS attacks. Step two, we identify characteristics of the data collected such as patterns in network traffic, packet details, IP addresses, types of protocols used and more. Step three, we utilize algorithms for feature selection such as Salp Swarm Algorithm (SSA), Gray Wolf Algorithm (GWA), Particle Swarm Algorithm (PSO) to pinpoint the features that can distinguish between normal activities and DDoS attack patterns. After that in step four, we divide the processed dataset into sections for training and testing purposes to develop and assess the machine learning models such as SVM (support vector machine), and KNN (K-nearest neighbor). Step five we develop a classification model using machine learning techniques like decision trees, forests, support vector machines (SVM) logistic regression models or neural networks. Finally, we assess the effectiveness of models through metrics such as accuracy rates, precision levels, recall rates, and F1 scores. The results show that the proposed models achieve high results (99.9%). In summary detecting DDoS attacks is crucial for protecting networks, systems and online services against disruptions.

Road traffic crash severity is shaped by a complex interplay of human, vehicular, environmental, and infrastructural factors. While machine learning (ML) has shown promise in analyzing crash data, gaps remain in model interpretability and region-specific insights, particularly for the UK context. This study addresses these gaps by evaluating supervised ML models – Decision Tree, Support Vector Machine (SVM), and LightGBM – to predict crash severity using 2022 UK accident data. The research emphasizes interpretability through SHapley Additive exPlanations (SHAP) to identify critical factors influencing severity outcomes. Results demonstrate that LightGBM outperforms other models in predictive performance, with police officer attendance at the scene, speed limits, and the number of vehicles involved emerging as pivotal determinants of severity. The analysis reveals that higher speed limits and single-vehicle collisions correlate with severe outcomes, while police presence may mitigate accident severity. However, the study acknowledges limitations, including dataset constraints. By integrating ML with post-hoc interpretability techniques, this work advances actionable insights for policymakers to prioritize road safety interventions, such as optimizing enforcement strategies and revising speed regulations. The findings underscore the potential of interpretable ML frameworks to enhance understanding of crash dynamics and inform targeted safety measures, contributing to global efforts to reduce traffic-related fatalities and injuries.

This study examines the influence of two data preprocessing techniques, Robust Scaler (RS) and Principal Component Analysis (PCA), on the predictive behaviour of Machine Learning (ML) models used for triage assessment in Internet of Medical Things (IoMT)-based telemedicine environments to enhance the decision support for healthcare, where heterogeneous and high-dimensional clinical data often introduce challenges related to variability and analytical stability. The objective is to evaluate how RS and PCA contribute to the consistency and reliability of triage predictions when integrated with established ML algorithms. A dataset of 55,680 outpatient records was used to assess the integration of RS and PCA with five supervised ML models: Support Vector Machine (SVM), Random Forest (RF), Decision Tree (DT), Logistic Regression (LR), and Naïve Bayes (NB). Performance was evaluated using accuracy, precision, recall, and F-score metrics. The evaluation reveals that each preprocessing technique affects model behaviour in distinct ways, and the RS Decision Tree combination exhibits stable performance in generating triage outcomes. PCA-based models exhibit characteristic patterns associated with dimensionality reduction, affecting interpretability and model response. The findings emphasize the role of preprocessing techniques in shaping ML-driven telemedicine workflows. Applying RS within ML pipelines supports consistent triage prediction, contributing to timely identification of patient conditions and strengthening data-driven remote healthcare services.

Background and aimsThe birth weight of a newborn is a crucial factor that affects their overall health and future well-being. Low birth weight (LBW) is a widespread global issue, which the World Health Organization defines as weighing less than 2,500 g. LBW can have severe negative consequences on an individual’s health, including neonatal mortality and various health concerns throughout their life. To address this problem, this study has been conducted using BDHS 2017–2018 data to uncover important aspects of LBW using a variety of machine learning (ML) approaches and to determine the best feature selection technique and best predictive ML model.MethodsTo pick out the key features, the Boruta algorithm and wrapper method were used. Logistic Regression (LR) used as traditional method and several machine learning classifiers were then used, including, DT (Decision Tree), SVM (Support Vector Machine), NB (Naïve Bayes), RF (Random Forest), XGBoost (eXtreme Gradient Boosting), and AdaBoost (Adaptive Boosting), to determine the best model for predicting LBW. The model’s performance was evaluated based on the specificity, sensitivity, accuracy, F1 score and AUC value.ResultsResult shows, Boruta algorithm identifies eleven significant features including respondent’s age, highest education level, educational attainment, wealth index, age at first birth, weight, height, BMI, age at first sexual intercourse, birth order number, and whether the child is a twin. Incorporating Boruta algorithm’s significant features, the performance of traditional LR and ML methods including DT, SVM, NB, RF, XGBoost, and AB were evaluated where LR, had a specificity, sensitivity, accuracy and F1 score of 0.85, 0.5, 85.15% and 0.915. While the ML methods DT, SVM, NB, RF, XGBoost, and AB model’s respective accuracy values were 85.35%, 85.15%, 84.54%, 81.18%, and 84.41%. Based on the specificity, sensitivity, accuracy, F1 score and AUC, RF (specificity = 0.99, sensitivity = 0.58, accuracy = 85.86%, F1 score = 0.9243, AUC = 0.549) outperformed the other methods. Both the classical (LR) and machine learning (ML) models’ performance has improved dramatically when important characteristics are extracted using the wrapper method. The LR method identified five significant features with a specificity, sensitivity, accuracy and F1 score of 0.87, 0.33, 87.12% and 0.9309. The region, whether the infant is a twin, and cesarean delivery were the three key features discovered by the DT and RF models, which were implemented using the wrapper technique. All three models had the identical F1 score of 0.9318. However, “child is twin” was recognized as a significant feature by the SVM, NB, and AB models, with an F1 score of 0.9315. Ultimately, with an F1 score of 0.9315, the XGBoost model recognized “child is twin” and “age at first sex” as relevant features. Random Forest again beat the other approaches in this instance.ConclusionsThe study reveals Wrapper method as the optimal feature selection technique. The ML method outperforms traditional methods, with Random Forest (RF) being the most effective predictive model for Low-Birth-Weight prediction. The study suggests that policymakers in Bangladesh can mitigate low birth weight newborns by considering identified risk factors.

Sales data analysis is an important aspect of modern businesses, as it enables them to gain insights into customer preferences and behavior, optimize marketing strategies, and improve revenue. With the rise of big data and machine learning, businesses can now leverage these tools to analyze sales data and gain even deeper insights. This paperfocuses on analyzing sales data using machine learning algorithms, with a specific emphasis on the K-Nearest Neighbors (KNN) algorithm. KNN is a popular machine learning algorithm used in classification and regression problems, and it works by identifying the K closest data points to a new observation and predicting its class or value based on the majority class or average value of its nearest neighbors. The dataset used in this paperis from a retail store and includes information on product type, sales channel, customer demographics, and sales volume over a period of several years. The paper will use Python and various machine learning libraries to perform data preprocessing, exploratory data analysis, feature engineering, and modeling. Specifically, KNN will be used to develop a predictive model for sales forecasting, which can help businesses optimize their inventory and production planning. The paper will also use clustering techniques, such as K-Means, to identify customer segments based on their purchasing behavior and demographics, and association rule mining to identify product affinities and recommend complementary products. The results of this analysis can help businesses gain a deeper understanding of their sales data and make data-driven decisions to improve their bottom line. By leveraging the power of KNN and other machine learning algorithms, businesses can gain insights into customer behavior and preferences, optimize their marketing strategies, and improve their overall revenue. Keywords: KNN Algorithm, Data Analytics, Machine Learning, Support Vector Machine.