Efficient Detection of IoT-Based DDoS Attacks Using Machine Learning Models

The exponential increase in the number of Internet-of-Things (IoT) devices connected to the Internet has significantly expanded the attack surface and increased their vulnerability to Distributed Denial of Service (DDoS) attacks. Traditional intrusion detection systems (IDS) often struggle to cope with the increasing scale and complexity of these threats. In this study, we evaluate the performance of various machine learning (ML) and deep learning (DL) models, including Random Forest (RF), K-Nearest Neighbors (KNN), XGBoost (XGB), Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM) for detecting IoT-based DDoS attacks using the recent ACI-IoT-2023 dataset. The dataset was filtered to include only benign and DDoS-related traffic, and dimensionality reduction was applied using Principal Component Analysis (PCA) in several experiments. Six different models were trained and tested on eight experimental setups, differing in feature sizes and number of instances. The results show that XGBoost achieves the highest test accuracy (up to 99.91 percent) and F1-score (up to 99.92 percent) while maintaining minimal training and inference times, followed by Random Forest and KNN. Among the DL models, MLP outperforms both CNN and LSTM. Overall, the study shows that tree-based ML models are more efficient than DL models for detecting DDoS attacks in structured IoT traffic data. Future research will investigate multi-class classification, real-time deployment, and hybrid MLDL frameworks for improved attack detection.