Explainable Machine Learning for DDoS Attack Detection and Confidence-Tiered Mitigation in Cloud Network Environments

Abstract

Due to its shared, virtualized and multi-tenant architecture, cloud computing technology appears to be quite vulnerable to a potentially unlimited variety of network-layer assaults. Among these, the Distributed Denial-of-Service (DDoS) type remains the most disruptive. A machine learning based framework against Ddos attacks in Cloud Network Environment in this paper. A stratified subset of the CICDDoS2019 dataset (that consists of Portmap, LDAP, and NetBIOS reflection attacks along with benign traffic) is performed. Four classifiers - Random Forest, XGBoost, SVM (Support Vector Machine), and one-dimensional CNN (1D-CNN) - are trained and compared on the 81-flow level feature set after class balancing through SMOTE. XGBoost is overall the best model with an accuracy of 77.6%, macro F1 of 0.815 and macro-AUC of 0.925. XGBoost also has the lowest inference latency at 0.0054 ms/sample. Thus, XGBoost is ideal for cloud-gateway application. NetBIOS and Portmap traffic are confused by the models in a systematic way which is not dependent on architecture. SHAP analysis attributes this to the top-15 most influential flow features between the two classes overlapping in 86.7%. This means that there is something that is structural as opposed to model-specific. In addition to classification, we have a confidence-based mitigation layer that translates the model predictions into actual gateway actions (ALLOW / RATE_LIMIT_AND_FLAG / BLOCK). A recall on 99.995% for attack intervention with a false-block rate of just 0.11% on legitimate traffic. The conclusions arrived at from the above experiments showcase that detection accuracy alone is not adequate for evaluating a cloud-deployed countermeasure. Nevertheless, enforcement of a mitigation policy, which is both deployment-aware and explainable, can create a whole and robust mechanism.