DDoS Attack Detection using Supervised Learning

Software-defined networks concentrate control logic, which makes them efficient and a high-value DDoS target. A detector that is accurate but raises too many false alarms is operationally unusable.

System design

The lab above is new work built for this portfolio, not the internship code. Synthetic network-flow records are scored by six scikit-learn models, and the page replays them through a simplified service with a fixed capacity. Pick a scenario (normal, sudden spike, high-intensity, low-and-slow, noisy), a model, a classification threshold and a mitigation mode (monitor, alert, or simulated mitigation) and watch detections, false alarms, queue load and availability change. Detecting an attack and stopping it are shown as separate outcomes, and legitimate flows that get blocked by mistake are counted. Nothing is sent over any network: “block” and “rate-limit” only change numbers in memory.

Method

Network-traffic features were extracted and fed through multiple candidate classifiers, with a feature-selection stage used to compare which signals carry detection value versus noise. Because attack traffic is rare, accuracy alone was not trusted as a metric.

In the original internship work, feature-selection strategies improved the accuracy and false-positive trade-off over an unfiltered feature set, and the classifier comparison was framed around real-world mitigation constraints. In the synthetic lab above, feature selection did not help most models, which is a reminder that such gains depend on the data.

What it does not show

Results describe the synthetic generator, not real traffic. On this synthetic test set the best model (HistGradientBoosting) reaches PR-AUC 0.890, and at the illustrative 0.62 threshold about 95% precision and 64% recall; those figures say nothing about real attacks. The service model is a single queue, and thresholds shown are illustrative settings, not recommendations. The figures 194 caught, 106 missed, 295 false alarms and 9,405 normal passed (precision about 39.7%, recall about 64.7%) are an illustrative worked example, not output of this lab.

Lessons

Raw traffic features are noisy and correlated, so feature selection mattered as much as model choice. Optimising for accuracy alone would have produced an unusable false-positive rate.