<![CDATA[Distributed Denial of Service (DDoS) attacks are a major cybersecurity threat, involving malicious traffic generated from numerous compromised sources to overwhelm and disable targeted services. Although machine learning (ML) has shown promise in detecting DDoS attacks through network traffic analysis, a key challenge remains: the class imbalance in datasets such as UNSW-NB15, where normal traffic significantly outweighs attack instances. This imbalance leads to biased predictions and degraded detection performance for minority attack classes. To address this issue, our study investigates the impact of Random Over Sampling (ROS), a simple yet effective balancing technique on improving detection accuracy in multi-class DDoS classification tasks. While prior works have primarily focused on ensemble algorithms or feature selection, our approach is distinct in emphasizing the effect of data balancing on macro evaluation metrics such as macro precision, macro recall, and macro F1-score. ROS was selected over more complex alternatives, such as SMOTE or ADASYN, due to its computational efficiency and ability to establish a performance baseline without introducing synthetic noise. We evaluate four machine learning algorithms: Decision Tree, Naïve Bayes, Random Forest, and XGBoost, using the UNSW-NB15 dataset. The results show that Decision Tree combined with ROS yields the highest improvement in macro F1-score, increasing by 36%. However, this improvement is accompanied by a moderate reduction in accuracy for certain algorithms. These findings highlight the critical role of class balancing in enhancing the reliability of DDoS detection models, especially in imbalanced multi-class scenarios.]]>
Copyrights © 2025
