A Robust Ensemble Learning for DDoS Attack Classification on the Internet of Medical Things

Distributed Denial of Service (DDoS) attacks pose significant threats to the Internet of Medical Things (IoMT), potentially disrupting critical healthcare services. A significant challenge in detecting these attacks is the high imbalance in network traffic data, which can bias classification models. This study introduces a hybrid approach that integrates the XGBoost algorithm with Principal Component Analysis (PCA) and undersampling to address class imbalance and enhance detection performance. Three configurations were tested: (1) XGBoost + PCA + Undersampling, (2) XGBoost + PCA, and (3) XGBoost + Undersampling. The model was evaluated using a publicly available multiclass DDoS dataset under an 80:20 training-testing split. The XGBoost + Undersampling method achieved the highest performance, with accuracy, precision, recall, and F1-score of 99.98%. Despite these results, potential limitations—such as data loss due to undersampling and excluding cross-validation or external testing. Thus, the proposed ensemble learning technique has proven to robustly improve the performance of DDoS attack detection in unbalanced dataset conditions