Predictive Analysis of Network based Attacks by Hybrid Machine Learning Algorithms

Aim:

       To enhance DDoS attack detection by implementing a machine learning system with hyper-parameter optimization and advanced prediction techniques, utilizing the CICIDSdataset to achieve high classification accuracy and improve network security.

Abstract:

       Data privacy is crucial in the financial sector to safeguard clients’ sensitive information, prevent financial fraud, ensure regulatory compliance, and protect intellectual property. With the rise of internet usage and digital transactions, maintaining privacy has become increasingly challenging. Distributed Denial of Service (DDoS) attacks pose a significant threat to client privacy, necessitating effective detection and prevention measures. Machine Learning (ML) offers a promising approach for enhancing cyber-attack detection systems. This paper proposes a hierarchical ML-based hyperparameter optimization technique for classifying network intrusions. Utilizing the CICIDS dataset, which includes logs of various attacks, the proposed method involves preprocessing the data with min-max scaling and SMOTE. Feature selection is carried out to identify the most significant features. Classification is then performed using XGBoost, LGBM, CatBoost, Random Forest (RF), and Decision Tree (DT) algorithms. The models’ performance is evaluated using recall, precision, accuracy, and F1-score metrics.

Introduction:

      The increasing threat of DDoS attacks demands efficient and scalable detection systems to ensure network security. Existing methods, while effective to some extent, face challenges related to accuracy, scalability, and real-time performance. This research aims to overcome these limitations by proposing a hierarchical machine learning approach with hyperparameter optimization, ensuring high performance and adaptability in detecting and classifying DDoS attacks.

Existing System:

      The existing system uses the outdated KDD99 and NSL-KDD datasets for network intrusion detection, which limits its effectiveness in modern scenarios. While traditional machine learning models, hybrid methods, and feature selection techniques achieve reasonable accuracy, they face several challenges. These include class imbalance, where attack samples are underrepresented, scalability issues with large-scale data, and real-time adaptability to evolving attack strategies. Additionally, the system struggles with outdated attack representations, as the datasets do not cover modern, sophisticated intrusion methods. To improve, the system needs to adopt newer datasets with current attack patterns and implement real-time learning methods for adaptive, scalable, and accurate detection of emerging threats.

Disadvantages of Existing System:

• Accuracy limitations, particularly with imbalanced datasets.
• Inadequate scalability for real-time environments.
• Higher false positive rates in certain cases.

Proposed System:

     The proposed system aims to enhance DDoS attack classification using the CICIDS 2017 dataset. Key components include:

1. Data Preprocessing: Min-max scaling for normalization and SMOTE for class balancing.
2. Feature Selection: Identification of significant features to optimize model performance.
3. Classification Algorithms: XGBoost, LGBM, CatBoost, RF, and DT, coupled with hyperparameter optimization.
4. Real-Time Processing: Real-time classification of incoming data.
5. User Interface: A Flask-based web application for data upload and result display.
6. Database Connectivity: MySQL for managing user accounts and session data.

Advantages:

• High classification accuracy with optimized ML models.
• Effective handling of class imbalance using SMOTE.
• Real-time DDoS detection and classification.
• User-friendly web interface for data uploads and results display.
• Scalable and efficient system design.