Classification of DDoS Attacks based on Network Traffic Patterns Using the k-Nearest Neighbor (k-NN) Algorithm - Faiz, Muhammad Nur; Maharrani, Ratih Hafsarah; Sari, Laura; Muhammad, Arif Wirawan; Supriyono, Abdul Rohman (Journal of INISTA, 2025)
Many server attacks disrupt industrial or business operations. Attacks that flood bandwidth with simultaneous requests can overwhelm a system, leading to significant downtime and financial losses. Additionally, breaches that compromise sensitive data can damage a company's reputation and erode customer trust. DDoS attacks, or Distributed Denial of Service attacks, are among the most common types of server attacks. DDoS has been proven to cause server downtime, and one effective way to mitigate this attack is to detect and classify it using a machine learning approach. The K-Nearest Neighbor (KNN) algorithm, a simple yet effective classification method based on similarity measures, is known for its high accuracy. The current research builds upon two stages: the feature extraction stage and the classification stage, with the ultimate goal of improving the accuracy of DDoS identification using the CICDDoS2019 dataset. Based on this premise, the detection accuracy can be improved by enhancing these two stages. At a value of k equal to 3, this study produces an accuracy of 99.73%.