Random Forest Implementation for Suricata-Based Real-Time DDoS Attack Detection - Juhari; Nuralamsah Zulkarnaim; Muh Rafli Rasyid; Andi M. Yusuf (Journal of Embedded Systems, Security and Intelligent Systems, 2025)
The Random Forest classifier model trained on the CICDDoS2019 dataset achieved an accuracy of 99.94%, precision of 99.79%, recall of 99.94%, and F1-Score of 99.87%, demonstrating strong performance in detecting Distributed Denial of Service (DDoS) attacks. This study aims to develop a real-time DDoS detection system by integrating Suricata as an intrusion detection system (IDS) and Random Forest as a machine learning model. The Dataset used consisted of 431,371 samples and 31 selected features from the results of feature selection. The system works by monitoring log eve.json from Suricata, extracts relevant features directly, then performs classification using a trained model. Predictions are displayed via a Flask-based web interface for easy monitoring. In the live traffic test, the model gave a confidence score of 0.65 for attacks and 0.81 for normal traffic. These results prove that the built system is able to recognize DDoS attack patterns efficiently and can be applied to real network infrastructure as a real-time Threat Detection Solution.