DDoS Attack Classification Leveraging Data Balancing and Hyperparameter Tuning Approach Using Ensemble Machine Learning with XAI

A distributed denial-of-service (DDoS) attack is a cyber-attack that aims to disrupt the regular traffic of a targeted server, service, or network by inundating the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks can cause significant harm to the security of the network environment. There are several works on the classification of DDoS attacks using Machine Learning (ML) and Deep Learning (DL). However, some improvement is needed, and in-depth research is necessary with the rapidly changing DDoS attack types. This study presents a novel ensemble model that can identify DDoS attacks. The approach leverages ML algorithms such as Logistic Regression (LR), Random Forest (RF), Decision Tree (DT), and Extreme Gradient Boosting (XGBoost) classifiers to detect and classify these malicious attacks effectively. The hyper-tuning process plays a significant role in increasing the performance of our proposed model and reducing overfitting. In our research, we use the potent eXplainable Artificial Intelligence (XAI) models SHAP (Shapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations). By utilizing SHAP and LIME's capabilities, we improve our ML models' readability and transparency, giving us a better understanding of difficult predictions and model behavior. The evaluation results demonstrate that the XGBoost ensemble model outperforms other classifiers, achieving an impressive accuracy rate of 97 %, with an outstanding F -score of 97%. The precision and recall are accordingly 98% and 96%.