Benchmarking ML-Based DDoS Detection Algorithms: Efficiency, Effectiveness, and Generalization

Abstract

Distributed Denial of Service (DDoS) attacks are among the most significant cybersecurity threats today. Traditional DDoS detection systems struggle to cope with emerging attack vectors, while Deep Learning (DL)-based approaches are limited by their high computational complexity. Shallow Machine Learning (ML) techniques have been widely explored, either as standalone solutions or to complement DL approaches. However, the existing literature remains ambiguous regarding the trade-offs among classification accuracy, computational complexity, generalization, and the consistency of ML-based methods across different network environments. In this work, we compared six representative models spanning supervised, semi-supervised, and unsupervised ML. We used five datasets to assess their DDoS identification capability, computational efficiency, generalization, and cross-domain performance. XGBoost demonstrated the best balance between DDoS identification capability (F1 = 0.984) and computational efficiency. Isolation Forest (IF) showed solid discriminative performance (F1 = 0.673) at a very low computational cost, making it suitable for resource-constrained devices. Other examined methods excel in certain aspects while remaining limited in other metrics. All models exhibited strong generalization performance. Apart from Stochastic Gradient Descent One Class Support Vector Machine (SGD-OCSVM), all other models showed high consistency in DDoS identification across different network setups.