Unsupervised Feature Engineering Approach to Predict DDoS Attacks

Predicting Distributed Denial of Service (DDoS) attacks is crucial given the large volume of generated attack traffic, particularly that generated by infected Internet of Things (IoT) devices. Attackers conceal their actions to delay detection as much as possible, increasing their damage when effectively launched. Hence, predicting signals of the attack plays a vital role in anticipating DDoS attacks and enhancing service protection. This work presents SEE, an unsupervised feature engineering approach to assist in predicting DDoS attacks. SEE evaluations encompass four experiments employing multiple datasets (CTU- 13, CIC-DDoS2019, and IoT-23) and DDoS attacks. The approach predicts a DDoS attack 30 minutes before it effectively starts, reaching up to 100% accuracy.