A Machine Learning Based Approach for

Classifying and Predicting DDoS Attacks

Along with Botnet Prevention
1st Author Name
2nd Author Name 3rd
Department Name
Department Name Author
Institution Name City,
Institution Name City, Name
Country
Country Departm
email@[Link]
email@[Link] ent
Name
Institutio
n Name
City,
Country
email@i
nstitution
.edu

Abstract—A Distributed Denial-of-Service (DDoS) attack is a reputation damage.

malicious attempt to disrupt the normal traffic of a targeted
server, service, or network by overwhelming the target or its To counter DDoS attacks, advanced defense strategies
surrounding infrastructure with a flood of Internet traffic. are necessary. Machine learning (ML) and deep learning
DDoS attacks achieve effectiveness by utilizing multiple (DL) techniques are used to analyze network traffic and
compromised computer systems as sources of attack traffic. A detect malicious patterns associated with DDoS attacks.
collection of such exploited machines (bots), called a botnet, can
include computers and other networked resources such as Collabo- rative efforts among security professionals,
Internet of Things (IoT) devices. DDoS attacks block the access internet service providers, and organizations are crucial to
of genuine users to a service for a certain period. Attackers develop effective countermeasures.
induce malware to the healthy devices by sending malicious DDoS attacks exploit the normal workings of network
Uniform Resource Locators (URLs) to the users. A huge amount services, making them difficult to combat. They can cause
of traffic is generated by the bot Personal Computers (PCs)
being launched to the target system. With the help of these prolonged impacts on websites and businesses, leading to
botnets, the attackers send requests to the target servers. With financial and reputational losses. Implementing robust
the increase in the population of bots, the severity of DDoS defense mechanisms, investing in network infrastructure,
attacks also increases. This work employs Machine Learning and using ML and DL approaches can reduce the impact of
(Naive Bayes, Random Forest, XGBoost) and Deep Learning
DDoS at- tacks. Ongoing research and collaboration are
(DNN) to classify and predict DDoS attacks. Additionally, a
Botnet Prevention feature, implemented using Logistic essential to stay ahead of evolving attack techniques and
Regression, detects phishing URLs to safeguard devices from enhance preventative measures.
being part of botnets. These approaches aim to reduce the To help reduce the damage caused by DDoS attacks to
damage caused by DDoS attacks to various systems. var- ious systems, Machine Learning and Deep Learning
Index Terms—DDoS attacks, machine learning, deep approach for classifying and predicting DDoS attacks are
learning, XGBoost, botnet prevention, phishing detection,
network security being used in this work. For this purpose, implementation
of XGBoost classification algorithms as a part of Machine
Learning and Deep Neural Networks (DNN) as a part of
Deep Learning has been done. Additionally, a feature
I. INTRODUCTION
called Botnet Prevention has been included which detects
A distributed denial-of-service (DDoS) attack occurs when Phishing URLs to prevent a healthy device from being a
multiple systems flood the resources of a targeted system, part of the botnet. It is implemented by using the Machine
such as web servers. These attacks exploit networks of Learning technique of Logistic Regression.
infected computers and IoT devices, forming botnets
II. RELATED WORK
controlled re- motely by an attacker. Each bot in the botnet
sends requests to overwhelm the target’s IP address, causing This section presents a comprehensive review of
a denial-of-service to normal traffic. Different types of DDoS existing literature on DDoS attack detection and botnet
attacks include SYN floods, UDP floods, HTTP floods, Ping prevention using machine learning techniques.
of death, ICMP floods, Smurf attacks, Fraggle attacks, and Jiang et al. [1] introduced the PSO-XgBoost model to
NTP amplification attacks. DDoS attacks have evolved into optimize Network Intrusion Detection Systems (NIDS)
sophisticated activities, im- pacting organizations accu- racy. By combining PSO and XgBoost, the model
significantly. Notable attacks on GitHub and Google have performs well in multi-classification tasks. Evaluation
demonstrated the destructive potential of such attacks. DDoS using the NSL- KDD dataset demonstrates its superiority
attacks can result in revenue loss, erosion of consumer trust, in precision, recall, macro-average, and mean average
financial compensation, and long-term precision compared to other models.
 Su et al. [2] addressed low accuracy and feature engineering
challenges in intrusion detection. The BAT-MC model com-
bines BLSTM, attention mechanism, and multiple convolu-
tional layers for network traffic classification. It effectively
captures key and local features using attention and convo-
lutional layers, respectively. The softmax classifier improves
performance compared to traditional methods.
Gao et al. [3] proposed an ensemble learning model for
intrusion detection. It combines decision tree, random forest,
kNN, and DNN classifiers using an adaptive voting algorithm.
The MultiTree algorithm achieves 84.2% accuracy by adjust-
ing training data proportions and employing multiple decision
trees. The adaptive voting algorithm further improves accuracy
to 85.2%.
D’hooge et al. [4] evaluated supervised machine learning
classifiers in network security algorithms using established and
new intrusion detection datasets. It emphasizes the underuti-
lization of contemporary databases and provides insights into
performance evaluation for network security tasks.
Liu et al. [5] integrated deep learning into NIDS by propos-
ing a bidirectional GRU-based model with hierarchical atten-
tion mechanisms. It treats intrusion activity as a time-series
event, improving detection by identifying significant features
with feature-based and slice-based attention mechanisms.
Zhao et al. [6] presented a hybrid intrusion detection system
that combines the CFS-DE feature selection algorithm with a
weighted stacking classification algorithm. CFS-DE reduces
Fig. 1. System Block Diagram showing the overall architecture of the
dimensionality by selecting an optimal feature subset, while the proposed DDoS detection and botnet prevention system.
weighted stacking algorithm improves classification per-
formance by assigning higher weights to well-performing base
classifiers. better results than applying machine learning directly to the
Sahingoz et al. [7] introduced a Machine Learning-based raw data. The basic aims of feature engineering are to
Phishing URL detection system using the Random Forest provide an input dataset that is compatible with the criteria of
algorithm. It achieves high accuracy (97.98%), language in- machine learning and artificial intelligence models. As a
dependence, real-time execution, and feature-rich classifiers. result, we begin by converting all classified attributes into
However, custom dataset construction and additional training equivalent numerical labels. The second goal and objective is
time are required. to improve the performance of machine learning and
Long et al. [8] proposed a botnet detection method using artificial intelligence models.
flow summary and graph sampling with machine learning Algorithm for Data
algorithms. It effectively detects botnet traffic, including un- Preprocess- ing:
known botnets, by considering timing patterns and utilizing 1: Input: Dataset
graph sampling technology. Feature selection and parameter 2: Output: Processed Dataset
optimization are suggested for further improvements. 3: Start
III. METHODOLOGY 4: Take input as Dataset
5: Implement Label
A. System Architecture
Encoding 6: Perform Data
The proposed system consists of two main modules: DDoS Visualization 7: Carry out
Attack Classification and Prediction, and Botnet Prevention. Feature Scaling
Fig. 1 shows the overall block diagram of the system archi- 8: Get output as Processed Dataset
tecture. 2) Model Training: Initially, we train the model using
B. DDoS Attack Classification and Prediction some percentage of the dataset for each algorithm. Based on
the accuracy, we vary the training percentage of the model.
1) Data Preprocessing: The data preprocessing involves
XGBoost: XGBoost, which stands for Extreme Gradient
feature extraction which refers to the process of transforming
Boosting, is a scalable, distributed gradient-boosted decision
raw data into numerical features that can be processed while
tree (GBDT) machine learning library. It provides parallel
preserving the information in the original data set. It yields
tree boosting and is the leading machine learning library for
regression, classification, and ranking problems.
 Deep Neural Networks (DNN): A deep neural network Classifica- tion:
(DNN) is an ANN with multiple hidden layers between the 1: Input: URL input
input and output layers. Similar to shallow ANNs, DNNs can 2: Output: Class of URL
model complex non-linear relationships. The main purpose of a 3: Start
neural network is to receive a set of inputs, perform 4: Take input as URL
progressively complex calculations on them, and give output to 5: Perform Classification using Logistic Regression
solve real world problems like classification. We restrict 6: Get output as Class of URL
ourselves to feed forward neural networks. We have an input,
3) URL Prediction for Botnet Prevention: Once the model
an output, and a flow of sequential data in a deep network.
is trained, we test the model using the remaining percentage
Algorithm for Model Train-
of the dataset for each algorithm. Based on the accuracy, we
ing:
vary the testing percentage of the model. Various
1: Input: Processed Train Dataset performance metrics such as accuracy, precision, F1 score
2: Output: Trained Model and recall are calculated and plotted.
3: Start Algorithm for URL
4: Take input as Processed Training Dataset Predic- tion:
5: Implement Machine Learning and Deep Learning Algo-
1: Input: URL input
rithms
2: Output: Legitimacy of URL Predicted
6: Get output as Trained Model
3: Start
3) Model Testing: After training, we test the model using the 4: Take input as URL
remaining percentage of the dataset for each algorithm. Based 5: Perform Prediction using Logistic Regression
on the accuracy, we vary the testing percentage of the model. 6: Get output whether the URL is legitimate or not to perform
Various performance metrics such as accuracy, precision, F1 botnet prevention
score and recall are calculated and plotted. 7: Stop
Algorithm for Model Test-
ing: IV. RESULTS AND IMPLEMENTATION
1: Input: Processed Test Dataset
2: Output: DDoS Attack Predicted
A. DDoS Attack Classification Results
3: Start 1) Data Preprocessing Results: For the dataset that is
4: Take input as Processed Testing Dataset taken, data preprocessing steps like checking for null values,
5: Execute Machine Learning and Deep Learning Algorithms duplicated rows, were done. The categorical features were
6: Get output as result of DDoS Attack Prediction identified and converted to numerical data using one-hot
7: Stop encoding technique. Feature Scaling and Feature Selection
were carried out to select the best features.
C. Botnet Prevention •Standard deviation check for 1
1) Data Preprocessing for URL Analysis: The data prepro-
cessing involves tokenization which is the process where the
text gets split into words and an array of tokens/words are
formed. The system contains string input, so a text tokenizer is
used to split the entire input into smaller units called tokens and
form an array of tokens. Text vectorizer is used to convert text
data into numerical vectors. CountVectorizer converts a given
text into a vector based on the frequency (count) of each word
that appears throughout the text.
Algorithm for URL Tokeniza- Fig. 2.
tion:
1: Input: URL String • Feature Selection
2: Output: Array of Tokens Univariate Feature Selection using ANOVA F-test was
3: Start per- formed to identify the most relevant features for each
4: Take input as URL String attack category as shown in Fig. 3.
5: Tokenize the URL using RegEx ’[A-Za-z]+’ The attack types are classified under each of the four
6: Get output as Array of Tokens classes as follows:
2) URL Classification using Logistic Regression: The clas-
sification algorithm in the logistic regression model is to
predict the chance of a classification rule. The dependent
variable in logistic regression is a binary classification problem
that contains data that is coded as 1 or 0. We train the model
with some percentage of the dataset based on the accuracy
achieved.
Algorithm for URL
 Fig. 3.

DDoS (Distributed Denial of Service): The attack types

neptune, back, land, pod, smurf, teardrop, mailbomb, apache2,
processtable, udpstorm, and worm fall under the category of
DDoS. These attacks aim to disrupt or deny access to a targeted
system or network by overwhelming it with a high volume of
traffic or resource-intensive activities. Fig. 4.
Probe: The attack types ipsweep, nmap, portsweep, satan,
mscan, and saint are classified as Probe. These attacks involve
scanning or probing a target system or network to gather ourselves to feed forward neural networks. We have an input,
information about its vulnerabilities, open ports, or available an output, and a flow of sequential data in a deep network.
services.
R2L (Remote to Local): The attack types ftp write, guess
passwd, imap, multihop, phf, spy, warezclient, warez- master,
sendmail, named, snmpgetattack, snmpguess, xlock, xsnoop,
and httptunnel are categorized as R2L. These attacks involve
unauthorized attempts to gain access to a target system from a
remote location.
U2R (User to Root): The attack types buffer overflow,
loadmodule, perl, rootkit, ps, sqlattack, and xterm are classified
as U2R. These attacks involve attempts to escalate privileges
and gain administrative or root-level access on a target system.

B. Training the models

Initially, we train the model using some percentage of the
dataset for each algorithm. Based on the accuracy, we vary the Fig. 5. .
training percentage of the model.
1) XGBOOST: XGBoost, which stands for Extreme Gra-
dient Boosting, is a scalable, distributed gradient-boosted C. Testing the Models
decision tree (GBDT) machine learning library. It provides After training, we test the model using the remaining
parallel tree boosting and is the leading machine learning percentage of the dataset for each algorithm. Based on the
library for regression, classification, and ranking problems. accuracy, we vary the testing percentage of the model (fig-
2) Deep Neural Networks(DNN): A deep neural network ure:6,7)
(DNN) is an ANN with multiple hidden layers between the
D. Result Visualization
input and output layers. Similar to shallow ANNs, DNNs can
model complex non-linear relationships. The main purpose of a Results are shown in figure:8,9,10,11.
neural network is to receive a set of inputs, perform E. Performance Metrics
progressively complex calculations on them, and give output to
solve real world problems like classification. We restrict From the table it is inferred that XGBoost gives better
accuracy than DNN across most attack categories.
 Fig. 9. Accuracies vs Algorithms-U2R .
Fig. 6. Confusion Matrix-Dos-XGBoost

Fig. 10. Accuracies vs Algorithms-R2L .

Fig. 7. Confusion Matrix-Dos-DNN .

F. Botnet Prevention
1) Data Preprocessing for URL Analysis: The data
prepro- cessing steps involve checking for null
values,duplicate values etc.
• Removal of duplicates
• Visualizing Target
columns Shown in figure:11.
• Tokenization
Tokenization is the process where the text gets split
into words and an array of tokens/words are formed.
The system contains string input, so a text tokenizer is
used to split the entire input into smaller units called
tokens and form an array

Fig. 8. Accuracies vs Algorithms-Dos

TABLE I
PERFORMANCE METRICS COMPARISON

Attack Types XGBoost DNN

DoS 99.51% 88.71%
Probe 99.301% 93.7%
U2R 99.68% 99.31%
R2L 97.21% 78.9%

Fig. 11. Accuracies vs Algorithms-Probe .

 TABLE II
SAMPLE URL DATASET AFTER DUPLICATE REMOVAL TABLE IV

URL
Label
on
0 the accuracy, we vary the testing percentage of the model.
•[Link]/70ffb52d079109dca5664cce6f317373782/...
Accuracy
bad
1
TABLE V
[Link]/[Link]/cycgi-bin/webscrc... X
bad
2
[Link]/[Link]....
bad
3

Fig. 12. Graph in comparison of count of good URLs and bad URLs

of tokens. Text vectorizer is used to convert text data into

numerical vectors. Fig. 13. Confusion Matrix for Botnet Prevention .
TABLE III
SAMPLE URL TOKENIZATION RESULTS
URL Label Clean URL Text Tokenized V. CONCLUSION
Carolinarailhaw good carolinarailhaw [carolinarailhaw
ks ks. ks,
.com/ com [Link]? com, index, Threats to cyber security are changing, becoming much
[Link]? id=111 php, id] more undetected and complicated. Detecting harmful
id=111 security risks and attacks is becoming a significant challenge
Huffingtonpost. good huffingtonpost.c [huffingtonpost,
com om com, in cy- berspace. Machine learning is a powerful tool to
/alex- /alex-
remington/ranki remington/
overcome these challenges.
alex,
ng- base... ranking... remington, The implementation of all the modules has been achieved
ranking...] successfully. The first part of the work involving ’Classifica-
tion and Prediction of DDoS attacks’ included
comprehensive data preprocessing using encoding
techniques to convert cat- egorical data to numerical data.
G. URL Classification using Logistic Regression
Normalization of the dataset using Feature Scaling and
The classification algorithm in the logistic regression model Feature Selection was performed and optimized for the best
is to predict the chance of a classification rule. The dependent features.
variable in logistic regression is a binary classification problem After the preprocessing of the dataset was completed, the
that contains data that is coded as 1 or 0. We train the model model was trained using training dataset for XGBoost and
with some percentage of the dataset based on the accuracy Deep Neural Network. Once the model was trained, it was
achieved. For binary classification, this method is used. The tested using the test data set and achieved good accuracies.
connection between the predicting variable and at least one The classification report was generated to analyze the perfor-
independent variable is evaluated using logistic regression. To mances of the models created using different algorithms. By
transform chances to binary values, the sigmoid function is comparing the performances, it was found that XGBoost
applied. The Sigmoid-Function is a curve that acknowledges a gave 98.925% accuracy and Deep Neural Network gave
real-valued input and restores values between 0 and 1, but 90.17% ac- curacy. Therefore, it can be concluded that
never precisely at those limits. The values between 0 and 1 are XGBoost algorithm classifies the taken dataset more
again re-transformed to either 0 or 1 using a transformers accurately.
classifier. The second part of the work involving ’Botnet Prevention’
majorly consisted of tokenization. As a result of
H. Prediction of URL based on logistic regression
tokenization, the array of tokens was used to train the model
Once the model is trained, we test the model using the using Logistic Regression algorithm. An accuracy of 97%
remaining percentage of the dataset for each algorithm. Based was achieved for training set and 96% for testing set.
 In order to achieve better results with less computational defense mechanism against evolving cyber threats.
time for functional applications, it will be critical to offer a
more user-friendly, faster alternative to deep learning cal- ACKNOWLEDGMENT
culations. For unlabeled and labeled datasets, it is crucial to
The authors would like to thank their institution for provid-
concentrate on unsupervised learning. Additionally, future
ing the necessary resources and support for conducting this
work will explore how unsupervised learning algorithms can
research work.
impact the detection of DDoS attacks, especially when non-
labeled datasets are taken into account. [14] F. Nazarudeen and S. Sundar, “Efficient DDoS Attack Detection using
Machine Learning Techniques,” in 2022 IEEE International Power
The proposed system demonstrates the effectiveness of and Renewable Energy Conference (IPRECON), pp. 1-6, IEEE, 2022.
machine learning approaches in cybersecurity applications, [15] D. Myridakis, P. Myridakis, and A. Kakarountas, “Intrusion Detection
particularly in DDoS attack detection and botnet prevention. and Botnet Prevention Circuit for IoT Devices,” in 2020 5th South-
East Europe Design Automation, Computer Engineering, Computer
The combination of multiple algorithms provides a robust Networks and Social Media Conference (SEEDA-CECNSM), pp. 1-4,
IEEE, 2020.

REFERENCES
[1] H. Jiang, Z. He, G. Ye, and H. Zhang, “Network intrusion detection
based on PSO-XGBoost model,” IEEE Access, vol. 8, pp. 58392-58401,
2020.
[2] T. Su, H. Sun, J. Zhu, S. Wang, and Y. Li, “BAT: Deep learning
methods on network intrusion detection using NSL-KDD dataset,”
IEEE Access, vol. 8, pp. 29575-29585, 2020.
[3] X. Gao, C. Shan, C. Hu, Z. Niu, and Z. Liu, “An adaptive ensemble
machine learning model for intrusion detection,” IEEE Access, vol. 7,
pp. 82512-82521, 2019.
[4] L. D’hooge, T. Wauters, B. Volckaert, and F. De Turck, “Classification
hardness for supervised learners on 20 years of intrusion detection
data,” IEEE Access, vol. 7, pp. 167455-167469, 2019.
[5] C. Liu, Y. Liu, Y. Yan, and J. Wang, “An intrusion detection model
with hierarchical attention mechanism,” IEEE Access, vol. 8, pp. 67542-
67554, 2020.
[6] R. Zhao, Y. Mu, L. Zou, and X. Wen, “A hybrid intrusion detection
system based on feature selection and weighted stacking classifier,”
IEEE Access, vol. 10, pp. 71414-71426, 2022.
[7] O. K. Sahingoz, E. Buber, O. Demir, and B. Diri, “Machine learning
based phishing detection from URLs,” Expert Systems with
Applications, vol. 117, pp. 345-357, 2019.
[8] C. Long, X. Xiao, W. Wan, J. Zhao, J. Wei, and G. Du, “Botnet
Detection Based on Flow Summary and Graph Sampling with Machine
Learning,” in 2021 International Conference on Computer Engineering
and Application (ICCEA), pp. 309-317, IEEE, 2021.
[9] M. I. Mohmand, H. Hussain, A. A. Khan, U. Ullah, M. Zakarya, A.
Ahmed, et al., “A machine learning-based classification and prediction
technique for DDoS attacks,” IEEE Access, vol. 10, pp. 21443-21454,
2022.
[10] N. Chavan, M. Kukreja, G. Jagwani, N. Nishad, and N. Deb, “DDoS
Attack Detection and Botnet Prevention using Machine Learning,” in
2022 8th International Conference on Advanced Computing and
Communication Systems (ICACCS), vol. 1, pp. 1159-1163, IEEE, 2022.
[11] M. I. Sayed, I. M. Sayem, S. Saha, and A. Haque, “A Multi-Classifier
for DDoS Attacks Using Stacking Ensemble Deep Neural Network,” in
2022 International Wireless Communications and Mobile Computing
(IWCMC), pp. 1125-1130, IEEE, 2022.
[12] U. Mbasuva and G. A. L. Zodi, “Designing Ensemble Deep Learning
Intrusion Detection System for DDoS attacks in Software Defined
Networks,” in 2022 16th International Conference on Ubiquitous In-
formation Management and Communication (IMCOM), pp. 1-8, IEEE,
2022.
[13] Z. Chen, F. Jiang, Y. Cheng, X. Gu, W. Liu, and J. Peng, “XGBoost
classifier for DDoS attack detection and analysis in SDN-based cloud,”
in 2018 IEEE international conference on big data and smart
computing (bigcomp), pp. 251-256, IEEE, 2018.