Eksplorasi Teknik Pre-Processing Berbasis eXtreme Gradient Boosting (XGBoost) pada Serangan DDoS - Muhammad Nur Faiz; Laura Sari; Imam Riadi; Arif Wirawan Muhammad; Sukma Aji (Universitas Budi Darma, 2025)
Distributed Denial of Service (DDoS) attacks represent a critical threat to modern network security, particularly within Internet of Things (IoT) environments characterized by large-scale and heterogeneous traffic patterns. The primary challenges in detecting such attacks involve class imbalance, irrelevant features, and noise within the data, all of which can degrade the performance of machine learning-based detection models. This study evaluates the impact of a pre-processing pipeline—comprising the Synthetic Minority Over-sampling Technique (SMOTE), correlation-based feature selection, and advanced feature selection methods—on the performance of the XGBoost algorithm in detecting DDoS attacks using the CIC-IoT2023 dataset. Experimental results indicate that the XGBoost model trained on RAW data achieves exceptionally high performance, with an accuracy of 0.999983, precision of 0.985531, recall of 0.961390, and an F1-score of 0.999983. However, after applying the pre-processing techniques, all metrics experienced a decline, with accuracy decreasing to 0.958899, precision to 0.865729, recall to 0.748332, and the F1-score to 0.959158. The reduction in recall suggests a higher number of undetected attacks, whereas the drop in precision indicates an increase in false alarms. Nevertheless, the F1-score remaining above 0.95 demonstrates that the model continues to perform effectively overall. These findings reveal that pre-processing does not always lead to performance improvements, especially when the raw dataset is already relatively clean and balanced. This study provides deeper insights into how SMOTE, feature selection, and noise injection influence the generalization of XGBoost on IoT traffic, and emphasizes that the effectiveness of pre-processing is highly dependent on dataset characteristics and the intended application context of intrusion detection systems.