Cross-Framework Evaluation of DDoS Attack Detection: Assessing Machine Learning Classifiers and Feature Selection in Weka and Orange3

Abstract

                Predicting distributed denial of service (DDoS) attacks is a complex task due to the similarity between the attack patterns and normal traffic. The challenge lies in finding the best algorithm out of 10 common machine learning algorithms. Many previous studies exhibit a notable limitation: they often rely on a single dataset and a single experimental tool (e.g., Weka), without conducting a comprehensive comparison under unified settings. This restricts the ability to identify the most efficient algorithms in terms of accuracy and resource utilization. This study compares ten machine learning algorithms implemented in Weka and Orange3, including both shared and platform-specific ones, with and without enhancement techniques. The goal is to identify the most effective algorithm overall and to determine which platform performs better for algorithms available in both. The improved versions of the CICDDoS2019 and CICDoS2017 datasets were used for evaluation. The datasets were split into 70% & 30% and 80% & 20% ratios for training and testing, respectively. The results indicated that the J48 algorithm on CICDDoS2019, achieved the highest accuracy without using any features selection algorithm: 99.95% and took 258.14 seconds for training and 0.37 seconds for testing, while same algorithm with Information gain ratio on CICDoS2017, achieved highest accuracy: 99.3% and took 20.58 seconds for training and   0.12 seconds for testing. The contribution of this research lies in increasing the comprehensiveness of the targeted algorithms and techniques and use 2 tools within a single study, which provided a more objective comparison than previous research.