FE-DADT: A FEATURE ENGINEERING DRIVEN DDOS ATTACK DETECTION TECHNIQUE AND EVALUATION FOR EFFECTIVE MITIGATION

Distributed denial-of-service (DDoS) attacks have been a persistent threat to the continuous operation of network services by depleting its essential resources and normal users cannot access the services. With the increasing evolution of these attacks, simple detection of differentiating malicious packets from innocent packets within traffic has become a complex task. Therefore, effective mitigation relies on accurate identification of discriminatory features of the network as opposed to similar (but non-redundant) sample-level analysis in higher dimensional space. In this paper, we present a filter-based feature selection method rooted in the statistical validity of the Student t-test that identifies the strongest predictors from traffic flow data. The task is to find a minimal but optimal set of features that improves classifier performance by noise and redundancy removal. On CICDDoS2019 benchmark dataset, the model was trained with 399,998 and tested on 112,611 samples. The results show that t-test is able to detect 58 features with statistical significace. With this optimized feature set, a eXtended Gradient Boosting (XGBoost) classifier reached a 99.82% detection rate and 97.40% classification accuracy. Our results show that a feature elimination approach based on statistical grounds, strengthens a significant increase in the performance of DDoS detection systems based on ML methods.