Advanced DDoS Attack Classification using Ensemble Model with Meta-Learner

In response to the security threats posed by Distributed Denial of Service (DDoS) attacks, this paper presents an intrusion detection framework with a high-accuracy multi-class classification model. In addition to the detection of the existence of DDoS attacks, our framework aims to identify a type of attack (e.g., protocol or message type) so that the system can select the most appropriate countermeasure against the DDoS type. We leverage a meta-learner to build an ensemble model of multiple machine learning models such as LSTM, RF, and KNN to enhance detection and classification accuracy. Tested on the CIC-DDoS 2019 dataset, the proposed model archives 96% accuracy in the type identification task, while a simple combination of the existing detection classifiers only achieves 92% accuracy in the same type identification.