DDoS Detection Based on Hardware Performance Counters Selection

In recent years, machine learning models have used data from Hardware Performance Counters (HPCs) proposed to combat Distributed Denial of Service (DDoS). Several models use feature selection (FS) methods to deal with these datasets’ high dimensionality, seeking to develop efficient real-time detection systems. In this work, we propose a methodology to evaluate the behavior of 24 HPCs whose data is subjected to five different DDoS attacks. We adopt the FS methods Filter, Wrapper, Hybrid, and Embedded as a selection method. The results showed that three main HPCs are the most impacted and may be used to detect the attacks, keeping the results of the classification algorithms used in validation above 98%, which means an 87.5% reduction in the dimensionality of the dataset. The research results include that the Filter Approach demonstrated excellent stability in indicating the best HPCs for DDoS detection performance. In contrast, hybrid methods showed more unstable results, expanding the possibilities for future studies on the explainability of these methods. Finally, selecting essential features to detect various attack types can reduce the HPC data collection time or even discard multiplexing techniques, allowing the use of the proposed technique for real-time attack detection environments and contributing to the security of devices with fewer HPCs available, such as embedded and IoT devices.