Comparative Analysis of Feature Selection Methods in Clustering-Based Detection Methods

Abstract

Feature selection plays a crucial role in the effectiveness of distributed denial of service (DDoS) attack detection methods, particularly as network traffic data becomes increasingly complex. This study conducts a categorical investigation of feature selection methods in clustering-based DDoS attack detection, comparing wrapper and hybrid approaches. Through two experiments using one-way ANOVA analyses, the research evaluated the effectiveness of different clustering approaches and supervised learning algorithms. The findings reveal that clustering-based wrapper methods performed more effectively than supervised learning approaches in feature selection for clustering-based DDoS attack detection methods. The results show strong statistical significance for clustering-based methods, with p-values of less than 0.05 and η2 values indicating robust relationships between methods. Our clustering-based wrapper approach achieved a 57.7% reduction in false positive rates compared to supervised learning methods (mean FPR of 0.17 versus 0.40) on the CICIDS2017 dataset, with certain configurations reaching a false positive rate of 0.000. A similar pattern was observed with the NSL-KD dataset, where clustering-based methods reduced false positive rates by 63.1% compared to supervised approaches (0.048 versus 0.128). This study provides empirical evidence for effective combinations in which organizations and agencies can implement DDoS attack detection methods that have high performance.