Rule-Based With Machine Learning IDS for DDoS Attack Detection in Cyber-Physical Production Systems (CPPS)

Aim: To enhance DDoS attack detection by implementing a machine learning system with hyperparameter optimization and advanced prediction techniques, utilizing the CICIDS dataset to achieve high classification accuracy and improve network security.

Abstract: Data privacy is crucial in the financial sector to safeguard clients’ sensitive information, prevent financial fraud, ensure regulatory compliance, and protect intellectual property. With the rise of internet usage and digital transactions, maintaining privacy has become increasingly challenging. Distributed Denial of Service (DDoS) attacks pose a significant threat to client privacy, necessitating effective detection and prevention measures. Machine Learning (ML) offers a promising approach for enhancing cyber-attack detection systems. This paper proposes a hierarchical ML-based hyperparameter optimization technique for classifying network intrusions. Utilizing the CICIDS dataset, which includes logs of various attacks, the proposed method involves preprocessing the data with min-max scaling and SMOTE. Feature selection is carried out to identify the most significant features. Classification is then performed using XGBoost, LGBM, CatBoost, Random Forest (RF), and Decision Tree (DT) algorithms. The models’ performance is evaluated using recall, precision, accuracy, and F1-score metrics.

Introduction: The increasing threat of DDoS attacks demands efficient and scalable detection systems to ensure network security. Existing methods, while effective to some extent, face challenges related to accuracy, scalability, and real-time performance. This research aims to overcome these limitations by proposing a hierarchical machine learning approach with hyperparameter optimization, ensuring high performance and adaptability in detecting and classifying DDoS attacks.

Proposed System: The proposed system aims to enhance DDoS attack multi classification using the CICIDS 2017 dataset. Key components include:

1. Data Preprocessing: Min-max scaling for normalization and SMOTE for class balancing.
2. Feature Selection: Identification of significant features to optimize model performance.
3. Classification Algorithms: XGBoost, LGBM, CatBoost, RF, and DT, coupled with hyperparameter optimization.
4. Real-Time Processing: Real-time classification of incoming data.
5. User Interface: A Flask-based web application for data upload and result display.
6. Database Connectivity: MySQL for managing user accounts and session data.

Advantages:

• High classification accuracy with optimized ML models.
• Effective handling of class imbalance using SMOTE.
• Real-time DDoS detection and classification.
• User-friendly web interface for data uploads and results display.
• Scalable and efficient system design.