TY  - JOUR
AU  - Ahmed, Nisar
AU  - Saleem, Gulshan
AU  - Naveed, Asim
AU  - Zaman, Muhammad Imran
PY  - 2026
DA  - 2026/02/11
TI  - A Resource-Efficient Machine Learning Pipeline for DDoS Attack Detection: A Comparative Study on CIC-IDS2018 and CIC-DDoS2019
JO  - ICCK Transactions on Information Security and Cryptography
T2  - ICCK Transactions on Information Security and Cryptography
JF  - ICCK Transactions on Information Security and Cryptography
VL  - 2
IS  - 1
SP  - 55
EP  - 69
DO  - 10.62762/TISC.2025.438083
UR  - https://www.icck.org/article/abs/TISC.2025.438083
KW  - distributed denial of service
KW  - DDoS detection
KW  - network intrusion detection
KW  - machine learning
KW  - deep learning
KW  - feature selection
KW  - class imbalance
KW  - CIC-IDS2018
KW  - CIC-DDoS2019
AB  - Distributed Denial of Service attacks remain a critical threat to modern networked systems due to their scale, diversity and evolving attack strategies. Although machine learning and deep learning techniques have been widely explored for DDoS detection, many existing studies rely on inconsistent preprocessing pipelines, single-dataset evaluations and limited reproducibility. This work proposes a unified and resource efficient detection framework that addresses these challenges through systematic data handling and transparent model evaluation. The proposed pipeline integrates data cleaning, memory optimization, class balancing and hybrid feature engineering that combines linear, tree-based, statistical and information-theoretic selection methods. Classical machine learning models and a one-dimensional convolutional neural network (CNN) are evaluated on two widely used benchmark datasets, CIC-IDS2018 and CIC-DDoS2019, under a leakage-free experimental protocol. Principal Component Analysis is further examined as an optional dimensionality reduction technique. Experimental results show that Random Forest and the CNN achieve strong and consistent performance across both datasets, with hybrid feature selection improving accuracy while reducing dimensionality. The findings demonstrate that careful preprocessing and feature engineering enable classical models to perform competitively with deep learning approaches while maintaining lower computational cost. The study emphasizes reproducibility, efficiency and practical deployability, providing a robust baseline for future DDoS detection research and real-world intrusion detection systems.
SN  - 3070-2429
PB  - Institute of Central Computation and Knowledge
LA  - English
ER  - 

@article{Ahmed2026A,
  author = {Nisar Ahmed and Gulshan Saleem and Asim Naveed and Muhammad Imran Zaman},
  title = {A Resource-Efficient Machine Learning Pipeline for DDoS Attack Detection: A Comparative Study on CIC-IDS2018 and CIC-DDoS2019},
  journal = {ICCK Transactions on Information Security and Cryptography},
  year = {2026},
  volume = {2},
  number = {1},
  pages = {55-69},
  doi = {10.62762/TISC.2025.438083},
  url = {https://www.icck.org/article/abs/TISC.2025.438083},
  abstract = {Distributed Denial of Service attacks remain a critical threat to modern networked systems due to their scale, diversity and evolving attack strategies. Although machine learning and deep learning techniques have been widely explored for DDoS detection, many existing studies rely on inconsistent preprocessing pipelines, single-dataset evaluations and limited reproducibility. This work proposes a unified and resource efficient detection framework that addresses these challenges through systematic data handling and transparent model evaluation. The proposed pipeline integrates data cleaning, memory optimization, class balancing and hybrid feature engineering that combines linear, tree-based, statistical and information-theoretic selection methods. Classical machine learning models and a one-dimensional convolutional neural network (CNN) are evaluated on two widely used benchmark datasets, CIC-IDS2018 and CIC-DDoS2019, under a leakage-free experimental protocol. Principal Component Analysis is further examined as an optional dimensionality reduction technique. Experimental results show that Random Forest and the CNN achieve strong and consistent performance across both datasets, with hybrid feature selection improving accuracy while reducing dimensionality. The findings demonstrate that careful preprocessing and feature engineering enable classical models to perform competitively with deep learning approaches while maintaining lower computational cost. The study emphasizes reproducibility, efficiency and practical deployability, providing a robust baseline for future DDoS detection research and real-world intrusion detection systems.},
  keywords = {distributed denial of service, DDoS detection, network intrusion detection, machine learning, deep learning, feature selection, class imbalance, CIC-IDS2018, CIC-DDoS2019},
  issn = {3070-2429},
  publisher = {Institute of Central Computation and Knowledge}
}