AN INTELLIGENT FEATURE-OPTIMIZED FRAMEWORK FOR DDoSATTACK DETECTION USING SVM and XGBOOST

Abstract

Distributed Denial of Service (DDoS) attacks remain a serious issue for network security, especially within cloud systems that rely on shared and scalable resources. In such settings, attackers can easily use large groups of compromised devices to flood targets with traffic, making genuine access almost impossible. Traditional intrusion detection systems (IDS) that rely on fixed signatures or manually defined rules often fail to keep up, since new and fast-changing attacks rarely fit known patterns. To improve detection, this research applied a machine learning–based approach that combines Support Vector Machine (SVM) and Extreme Gradient Boosting (XGBoost) models, supported by the Fisher Score Algorithm (FSA) for feature selection. The well-known CIC-DDoS2019 dataset from Kaggle was used because it includes both modern DDoS attacks and regular network traffic, giving a practical base for testing the models. Our workflow followed three stages: first, cleaning and preparing the data; second, selecting key features using FSA; and finally, training and evaluating the classifiers. We measured performance with accuracy, precision, recall, F1-score, and the Area Under the Curve (AUC). XGBoost achieved the highest results of 97 % accuracy and an AUC of 0.99, while SVM‟s accuracy fell to 65 % after feature reduction, despite a small AUC gain to 0.65. The results of this study demonstrate that combining machine learning models of XGBoost with FSA significantly improves the detection of DDoS attacks in cloud environments. This highlights its potential for superior performance over traditional IDS methods.