{"id":"https://openalex.org/W7201862172","doi":"https://doi.org/10.3390/engproc2026150120","title":"Machine Learning Approaches to Detect Application Layer DDoS Attacks","display_name":"Machine Learning Approaches to Detect Application Layer DDoS Attacks","publication_year":2026,"publication_date":"2026-08-06","ids":{"openalex":"https://openalex.org/W7201862172","doi":"https://doi.org/10.3390/engproc2026150120"},"language":"en","primary_location":{"id":"doi:10.3390/engproc2026150120","doi":"https://doi.org/10.3390/engproc2026150120","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026150120","pdf_url":null,"source":{"id":"https://openalex.org/S7407105145","display_name":"International Scientific Conference TechSys \u2014 Engineering, Technology and Systems (TechSys)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The 15th International Scientific Conference TechSys 2025—Engineering, Technology and Systems","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.3390/engproc2026150120","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038317160","display_name":"Ali Sabra","orcid":"https://orcid.org/0000-0002-7144-8692","observed_orcids":["https://orcid.org/0000-0002-7144-8692","https://orcid.org/0009-0004-3151-0713"]},"institutions":[{"id":"https://openalex.org/I62709064","display_name":"Varna Free University","ror":"https://ror.org/00e97v486","country_code":"BG","type":"education","lineage":["https://openalex.org/I62709064"]}],"countries":["BG"],"is_corresponding":true,"raw_author_name":"Ali Sabra","raw_affiliation_strings":["Department of Computer Science, Varna Free University, 9007 Varna, Bulgaria"],"raw_orcid":"https://orcid.org/0009-0004-3151-0713","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Varna Free University, 9007 Varna, Bulgaria","institution_ids":["https://openalex.org/I62709064"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093274023","display_name":"Nehmeh Rmeiti","orcid":"https://orcid.org/0009-0000-0557-9291","observed_orcids":["https://orcid.org/0009-0000-0557-9291"]},"institutions":[{"id":"https://openalex.org/I62709064","display_name":"Varna Free University","ror":"https://ror.org/00e97v486","country_code":"BG","type":"education","lineage":["https://openalex.org/I62709064"]}],"countries":["BG"],"is_corresponding":false,"raw_author_name":"Nehmeh Rmeiti","raw_affiliation_strings":["Department of Computer Science, Varna Free University, 9007 Varna, Bulgaria"],"raw_orcid":"https://orcid.org/0009-0000-0557-9291","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Varna Free University, 9007 Varna, Bulgaria","institution_ids":["https://openalex.org/I62709064"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5066944548","display_name":"Zlatogor Borisov Minchev","orcid":"https://orcid.org/0000-0003-2479-5496","observed_orcids":["https://orcid.org/0000-0003-2479-5496"]},"institutions":[{"id":"https://openalex.org/I24768866","display_name":"Bulgarian Academy of Sciences","ror":"https://ror.org/01x8hew03","country_code":"BG","type":"government","lineage":["https://openalex.org/I24768866"]},{"id":"https://openalex.org/I4210163063","display_name":"Institute of Information and Communication Technologies","ror":"https://ror.org/05fpsjc82","country_code":"BG","type":"facility","lineage":["https://openalex.org/I24768866","https://openalex.org/I4210163063"]}],"countries":["BG"],"is_corresponding":false,"raw_author_name":"Zlatogor Minchev","raw_affiliation_strings":["IT for Security Department, Institute of ICT, Bulgarian Academy of Sciences, 1113 Sofia, Bulgaria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"IT for Security Department, Institute of ICT, Bulgarian Academy of Sciences, 1113 Sofia, Bulgaria","institution_ids":["https://openalex.org/I24768866","https://openalex.org/I4210163063"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5038317160"],"corresponding_institution_ids":["https://openalex.org/I62709064"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"120","last_page":"120"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/application-layer-ddos-attacks","display_name":"application layer DDoS attacks","score":0.9620000123977661},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.734000027179718},{"id":"https://openalex.org/keywords/web-server-access-logs","display_name":"web server access logs","score":0.9760000109672546},{"id":"https://openalex.org/keywords/attack-dataset-generation","display_name":"attack dataset generation","score":0.7799999713897705},{"id":"https://openalex.org/keywords/lstm","display_name":"LSTM","score":0.6869999766349792},{"id":"https://openalex.org/keywords/deep-learning","display_name":"deep learning","score":0.5429999828338623},{"id":"https://openalex.org/keywords/random-forest","display_name":"random forest","score":0.8349999785423279},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"support vector machine","score":0.9750000238418579},{"id":"https://openalex.org/keywords/k-nearest-neighbors","display_name":"k-nearest neighbors","score":0.9750000238418579},{"id":"https://openalex.org/keywords/neural-network","display_name":"artificial neural networks","score":0.9179999828338623},{"id":"https://openalex.org/keywords/network-security","display_name":"network security","score":0.37400001287460327}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7997000217437744},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7896999716758728},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7297000288963318},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7124999761581421},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5306000113487244},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.5037999749183655},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.48350000381469727},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.4043999910354614},{"id":"https://openalex.org/C11392498","wikidata":"https://www.wikidata.org/wiki/Q11288","display_name":"Web server","level":3,"score":0.38530001044273376},{"id":"https://openalex.org/C190793597","wikidata":"https://www.wikidata.org/wiki/Q189768","display_name":"Application layer","level":3,"score":0.3747999966144562},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3546999990940094},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3310999870300293},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.31290000677108765},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.29499998688697815},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2676999866962433}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/engproc2026150120","doi":"https://doi.org/10.3390/engproc2026150120","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026150120","pdf_url":null,"source":{"id":"https://openalex.org/S7407105145","display_name":"International Scientific Conference TechSys \u2014 Engineering, Technology and Systems (TechSys)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The 15th International Scientific Conference TechSys 2025—Engineering, Technology and Systems","raw_type":"proceedings-article"},{"id":"pmh:oai:doaj.org/article:d743928c962549ef997b0852a147932c","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/d743928c962549ef997b0852a147932c","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Engineering Proceedings, Vol 150, Iss 1, p 120 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/engproc2026150120","doi":"https://doi.org/10.3390/engproc2026150120","is_oa":true,"landing_page_url":"https://doi.org/10.3390/engproc2026150120","pdf_url":null,"source":{"id":"https://openalex.org/S7407105145","display_name":"International Scientific Conference TechSys \u2014 Engineering, Technology and Systems (TechSys)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"conference"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The 15th International Scientific Conference TechSys 2025—Engineering, Technology and Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W2132914092","https://openalex.org/W2162969618","https://openalex.org/W3134111902","https://openalex.org/W4281671322","https://openalex.org/W4318052012","https://openalex.org/W4320917128","https://openalex.org/W4322502180","https://openalex.org/W4323317130","https://openalex.org/W4377691173","https://openalex.org/W4381095014","https://openalex.org/W4383560204","https://openalex.org/W4385659971"],"related_works":["https://openalex.org/W7217594405","https://openalex.org/W4399621176","https://openalex.org/W4401720138","https://openalex.org/W4283321039","https://openalex.org/W3156415363","https://openalex.org/W7135057612","https://openalex.org/W4385625867","https://openalex.org/W2803834484","https://openalex.org/W4390742446","https://openalex.org/W4391877602"],"abstract_inverted_index":{"This":[0],"study":[1],"proposes":[2],"a":[3],"machine":[4],"learning":[5,8],"and":[6,41,51,69,98,106],"deep":[7],"framework":[9],"to":[10,66],"detect":[11],"application":[12],"layer":[13],"DDoS":[14,28],"attacks":[15,77],"using":[16,26],"web":[17],"server":[18],"access":[19],"logs.":[20],"A":[21],"realistic":[22],"dataset":[23],"was":[24],"generated":[25],"eight":[27],"tools,":[29],"along":[30],"with":[31,61],"benign":[32],"traffic.":[33],"Multiple":[34],"ML":[35,80],"models,":[36],"including":[37],"Random":[38],"Forest,":[39],"SVM,":[40],"KNN,":[42],"as":[43,45,49],"well":[44],"DL":[46],"models":[47,81],"such":[48],"ANN":[50],"LSTM,":[52],"were":[53],"evaluated.":[54],"The":[55,90],"results":[56],"show":[57],"high":[58],"detection":[59,111],"performance,":[60],"the":[62,93,99],"LSTM":[63,85,102],"achieving":[64],"up":[65],"99%":[67],"accuracy":[68],"outperforming":[70],"other":[71],"models.":[72],"Additional":[73],"validation":[74],"on":[75],"non-DDoS":[76],"revealed":[78],"that":[79],"performed":[82],"poorly,":[83],"while":[84],"maintained":[86],"strong":[87],"performance":[88],"(92.89%).":[89],"findings":[91],"highlight":[92],"effectiveness":[94],"of":[95,101],"log-based":[96],"datasets":[97],"superiority":[100],"for":[103],"handling":[104],"sequential":[105],"mixed-feature":[107],"data":[108],"in":[109],"cybersecurity":[110],"tasks.":[112]},"counts_by_year":[],"updated_date":"2026-10-27T15:51:10.671819","created_date":"2026-08-08T00:00:00"}