DDoS ATTACK DETECTION SYSTEM

Abstract

The subject matter of this research is the comprehensive analysis and development of an automated network traffic classification system for Distributed Denial of Service (DDoS) attack detection. The study focuses on the transition from traditional signature-based protection paradigms, which are increasingly ineffective against modern, polymorphic, and high-intensity cyber threats –to anomaly-based detection systems powered by artificial intelligence (AI). The goal of the work is to identify effective artificial intelligence algorithms for network traffic analysis and to develop an applied software solution capable of detecting and automatically responding to DDoS attacks to ensure the security of modern information systems. The following tasks were solved in the article: an analysis of modern cyber threats and the limitations of traditional IDS/IPS systems was conducted, highlighting the necessity for adaptive AI-based solutions; a comparative study was performed based on quality metrics for machine learning and deep learning algorithms, specifically: Decision Trees, Random Forest, Support Vector Machines (SVM), and Multilayer Perceptrons (MLP); a program for DDoS attack detection was developed using Python libraries; practical recommendations were provided for the implementation, maintenance, and further improvement of the system within a real-world network infrastructure. The following methods used are: based on intelligent traffic analysis, including data preprocessing, feature engineering, and supervised learning. The methodology involves utilizing the modern CICIDS2017 dataset to establish behavioral baselines and evaluate model performance using key metrics such as Accuracy, Precision, Recall, and the F1-score. The following results were obtained: It was proven that despite the high accuracy of deep learning algorithms, particularly the MLP, their computational complexity and training time make them less suitable for responding to rapid and intense attacks. Instead, the Random Forest algorithm was identified as the optimal solution. The software developed based on this algorithm performs real-time binary traffic classification, visualizes and analyzes the obtained data, and allows for the integration of detection results into dynamic firewall rules. Conclusions: The results indicate that ensemble methods are promising for cybersecurity applications where high accuracy and response speed are critical; specifically, the Random Forest algorithm provides an ideal balance of speed and precision for DDoS detection. The integration of these results in the form of a methodology into the "F5 Cybersecurity and Information Protection" educational program at the Department of Information Security and Nanoelectronics of the National University "Zaporizhzhia Polytechnic" confirms the practical and academic relevance of the research.