Recursive Voting Fusion: An RFE-Based Ensemble Model for Categorizing IoT DDoS Attacks

Abstract

The rise of the Internet of Things (IoT) devices has led to an enormous vulnerability to multiple DDoS attacks, including low-rate traffic disruption and high-rate SYN Floods. This increasing menace underscores the importance of proper multi-classification methods that can detect various DDoS attack patterns. Nonetheless, most of the current machine learning models cannot provide a generalization between various DDoS types that include DDoS-ACK Fragmentation, DDoS-HTTP Flood, DoS-TCP Flood, and DDoS-SYN Flood. Non-linear Support Vector Machines (SVM) which are traditional classifiers tend to have poor performance when trying to differentiate subtle differences between these types of attacks. To overcome this drawback, this paper suggests a Recursive Voting Fusion model, which involves Recursive Feature Elimination (RFE) as the method of optimum feature selection and an ensemble approach to the robust classification. The framework is a hybrid of Decision Tree, Random Forest, and Extra tree classifiers where soft voting is used. It is experimentally demonstrated that the proposed approach has 99 per cent accuracy, precision, recall, and F1-score, and 99 per cent MCC and AUC-ROC, which is significantly higher than the baseline models. It implies that the model is highly robust and scalable to be used in real-time IoT intrusion detection and efficient mitigation of the developing DDoS threats.