DDOS Attack Detection Using Lightweight Partial Decision Tree algorithm

Distributed Denial of service (DDoS) attacks are dangerous threats to networks that reduce the availability of Internet resources and services. The attacks are easily operated and challenging to detect. At the same time, there are various methods for detecting DDoS attacks, using machine learning techniques to identify and prevent them. This research proposes a new method to detect DDoS based on integrating vast amounts of data and machine learning algorithms to discover DDoS attacks patterns and apply them to new requests to classify them as malicious or benign. The research used the dataset CICIDS2017. The research focuses on eliminating the number of attributes used in machine learning to grant the short time detection and, at the same time, keep the detection precession The proposal used REP Tree, Random Tree, Random Forest, Decision Stump, and Partial Decision Tree (PART) techniques. It is found that the PART is a lightweight classifier that classifies DDoS network patterns from normal traffic, with a detection accuracy of above 99.77 %. The proposed classifier was trained with a small number of features in CICIDS2017, and it is validated using the CICDDoS2019 dataset.