{"id":"https://openalex.org/W7155599139","doi":"https://doi.org/10.1145/3789418.3789445","title":"Machine Learning-Driven DDoS Defense: Feature Engineering, Algorithm Selection, and End-to-End System Validation","display_name":"Machine Learning-Driven DDoS Defense: Feature Engineering, Algorithm Selection, and End-to-End System Validation","publication_year":2025,"publication_date":"2025-12-12","ids":{"openalex":"https://openalex.org/W7155599139","doi":"https://doi.org/10.1145/3789418.3789445"},"language":null,"primary_location":{"id":"doi:10.1145/3789418.3789445","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3789418.3789445","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th International Conference on Algorithms, Computing and Systems","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3789418.3789445","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134573959","display_name":"Xintong Li","orcid":"https://orcid.org/0009-0003-6596-3633"},"institutions":[{"id":"https://openalex.org/I31595395","display_name":"Chengdu University of Technology","ror":"https://ror.org/05pejbw21","country_code":"CN","type":"education","lineage":["https://openalex.org/I31595395"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xintong Li","raw_affiliation_strings":["Chengdu University of Technology, Chengdu University of Technology, Chengdu, Sichuan, China,"],"raw_orcid":"https://orcid.org/0009-0003-6596-3633","affiliations":[{"raw_affiliation_string":"Chengdu University of Technology, Chengdu University of Technology, Chengdu, Sichuan, China,","institution_ids":["https://openalex.org/I31595395"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134596563","display_name":"Changyu Lu","orcid":"https://orcid.org/0009-0006-0241-7346"},"institutions":[{"id":"https://openalex.org/I198091727","display_name":"Tiangong University","ror":"https://ror.org/00xsr9m91","country_code":"CN","type":"education","lineage":["https://openalex.org/I198091727"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changyu Lu","raw_affiliation_strings":["Tiangong University, Tianjing, China,"],"raw_orcid":"https://orcid.org/0009-0006-0241-7346","affiliations":[{"raw_affiliation_string":"Tiangong University, Tianjing, China,","institution_ids":["https://openalex.org/I198091727"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5134606569","display_name":"Keyun Li","orcid":"https://orcid.org/0009-0001-8365-4573"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Keyun Li","raw_affiliation_strings":["Syracuse University, Syracuse University, Syracuse, New York, USA,"],"raw_orcid":"https://orcid.org/0009-0001-8365-4573","affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse University, Syracuse, New York, USA,","institution_ids":["https://openalex.org/I70983195"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"217","last_page":"224"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9427000284194946,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9427000284194946,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.008100000210106373,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.002300000051036477,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6873999834060669},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6389999985694885},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.5814999938011169},{"id":"https://openalex.org/keywords/preprocessor","display_name":"Preprocessor","score":0.5271000266075134},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.44769999384880066},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.4368000030517578},{"id":"https://openalex.org/keywords/modular-design","display_name":"Modular design","score":0.3725000023841858},{"id":"https://openalex.org/keywords/data-pre-processing","display_name":"Data pre-processing","score":0.36579999327659607},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.35089999437332153}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.758899986743927},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6873999834060669},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6588000059127808},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6389999985694885},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.5814999938011169},{"id":"https://openalex.org/C34736171","wikidata":"https://www.wikidata.org/wiki/Q918333","display_name":"Preprocessor","level":2,"score":0.5271000266075134},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46720001101493835},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.44769999384880066},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.4368000030517578},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.4075999855995178},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40310001373291016},{"id":"https://openalex.org/C101468663","wikidata":"https://www.wikidata.org/wiki/Q1620158","display_name":"Modular design","level":2,"score":0.3725000023841858},{"id":"https://openalex.org/C10551718","wikidata":"https://www.wikidata.org/wiki/Q5227332","display_name":"Data pre-processing","level":2,"score":0.36579999327659607},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.35089999437332153},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3476000130176544},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3294000029563904},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.31290000677108765},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.310699999332428},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2921999990940094},{"id":"https://openalex.org/C106516650","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm design","level":2,"score":0.29159998893737793},{"id":"https://openalex.org/C2775973920","wikidata":"https://www.wikidata.org/wiki/Q3252726","display_name":"Selection algorithm","level":3,"score":0.2888000011444092},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2777000069618225},{"id":"https://openalex.org/C138827492","wikidata":"https://www.wikidata.org/wiki/Q6661985","display_name":"Data processing","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.27160000801086426},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.26930001378059387},{"id":"https://openalex.org/C179799912","wikidata":"https://www.wikidata.org/wiki/Q205084","display_name":"Computational complexity theory","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C92446256","wikidata":"https://www.wikidata.org/wiki/Q3306762","display_name":"Data validation","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.25619998574256897},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.25459998846054077},{"id":"https://openalex.org/C52001869","wikidata":"https://www.wikidata.org/wiki/Q812530","display_name":"Naive Bayes classifier","level":3,"score":0.2526000142097473},{"id":"https://openalex.org/C70153297","wikidata":"https://www.wikidata.org/wiki/Q5591907","display_name":"Gradient boosting","level":3,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3789418.3789445","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3789418.3789445","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th International Conference on Algorithms, Computing and Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3789418.3789445","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3789418.3789445","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 9th International Conference on Algorithms, Computing and Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","score":0.49989524483680725,"display_name":"Reduced inequalities"},{"id":"https://metadata.un.org/sdg/16","score":0.4076181650161743,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":8,"referenced_works":["https://openalex.org/W433644524","https://openalex.org/W2122646361","https://openalex.org/W2143426320","https://openalex.org/W4364857653","https://openalex.org/W4393986136","https://openalex.org/W4399855217","https://openalex.org/W4403721765","https://openalex.org/W4404681342"],"related_works":[],"abstract_inverted_index":{"Distributed":[0],"Denial":[1],"of":[2,111],"Service":[3],"(DDoS)":[4],"attacks":[5],"are":[6,114],"a":[7,38,162,201],"major":[8],"threat":[9],"to":[10,56,152,178,218],"network":[11,221],"security.":[12],"Traditional":[13],"defenses":[14],"like":[15],"firewalls":[16],"and":[17,53,60,82,96,145,156,175,213],"IDS":[18],"rely":[19],"on":[20,43,47],"static":[21],"rules.":[22],"They":[23],"cannot":[24],"keep":[25],"up":[26],"with":[27,105,200],"new":[28],"attack":[29],"methods.":[30],"To":[31],"address":[32],"this":[33,35,112],"challenge,":[34],"study":[36,113],"proposes":[37],"DDoS":[39],"detection":[40,58,198],"system":[41,88,199],"based":[42],"machine":[44],"learning,":[45],"focusing":[46],"optimizing":[48],"dataset":[49,122],"processing,":[50],"feature":[51,164,170],"selection,":[52],"algorithm":[54,71],"adaptation":[55],"enhance":[57],"accuracy":[59],"real-time":[61],"performance.":[62],"Experiments":[63],"show":[64],"that":[65,125,167,205],"the":[66,146],"Histogram-based":[67],"Gradient":[68],"Boosting":[69],"(HGB)":[70],"outperforms":[72],"other":[73],"models,":[74],"achieving":[75],"98.47%":[76],"accuracy,":[77,93],"99.20%":[78],"precision,":[79],"97.69%":[80],"recall,":[81,91],"99.85%":[83],"ROC-AUC.":[84],"The":[85,108],"end-to-end":[86],"HGB-based":[87,196],"maintains":[89],"100%":[90],"98.08%":[92],"95.37%":[94],"F1-score,":[95],"under":[97],"100":[98],"ms":[99],"latency.":[100],"It":[101],"is":[102],"also":[103],"compatible":[104],"SIEM":[106],"platforms.":[107],"core":[109],"contributions":[110],"as":[115],"follows:":[116],"1)":[117],"proposing":[118],"an":[119,195],"optimized":[120],"CIC-DDoS2019":[121],"processing":[123],"pipeline":[124],"integrates":[126,206],"stratified":[127],"sampling":[128],"(1:1":[129],"benign/attack":[130],"ratio),":[131],"differentiated":[132],"cleaning":[133],"(3\u03c3":[134],"principle":[135,151],"for":[136,142],"normal":[137],"features,":[138,186],"99th":[139],"percentile":[140],"truncation":[141],"skewed":[143],"features),":[144],"\"partition":[147],"first,":[148],"preprocessing":[149],"later\"":[150],"avoid":[153],"data":[154,158,208],"leakage":[155],"ensure":[157],"reliability;":[159],"2)":[160],"designing":[161],"hierarchical":[163],"selection":[165],"strategy":[166],"combines":[168],"XGBoost":[169],"importance,":[171],"Fisher-score,":[172],"chi-square":[173],"test,":[174],"single-feature":[176],"F1-score":[177],"select":[179],"20":[180],"key":[181],"features":[182],"from":[183],"82":[184],"original":[185],"reducing":[187],"model":[188],"complexity":[189],"while":[190],"enhancing":[191],"discriminability;":[192],"3)":[193],"constructing":[194],"intrusion":[197],"layered":[202],"modular":[203],"architecture":[204],"multi-source":[207],"adaptation,":[209],"dynamic":[210],"threshold":[211],"adjustment,":[212],"multi-level":[214],"false":[215],"positive":[216],"filtering":[217],"meet":[219],"real-world":[220],"defense":[222],"requirements.":[223]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-26T00:00:00"}