The transformation of network management through the introduction of Software Defined Networking has advanced the field of networking, and one of its benefits is the separation of the control balance from the data plane. This enables better handling of traffic, provides opportunities for scalability, and improves overall efficiency. Despite these benefits, the centralized nature of Software Defined Networking renders it vulnerable to Distributed Denial of Service (DDoS) attacks. Situations of such attacks require utmost attention as the attacker floods the controller with malicious traffic, with potential targets being the disruption of network operations and the availability of online services. Conventional security approaches often fall short of the growing sophistication of DDoS threats, which highlights the requirement for advanced techniques such as machine learning (ML), which could be an effective solution for detection and mitigation. ML algorithms analyze network traffic patterns to classify malicious behavior; however, their performance depends on the quality of the input features. High-dimensional network traffic datasets contain redundant, noisy, and irrelevant information, necessitating feature selection and engineering to create meaningful features from raw data, such as packet headers, flow durations, and traffic volumes, ultimately improving the accuracy and generalization of models for DDoS attack detection.^1,2 Efficient management of the control plane is performed by the controller, and that of the data plane is performed by switches.³ When attackers send requests with a high bandwidth to fill in the offered bandwidth of the target server, the server becomes inaccessible to authentic users.⁴

Traditional defense mechanisms include firewalls and general Intrusion Detection Systems (IDS), which struggle to detect some DDoS attacks that have recently become increasingly sophisticated. However, the efficiency of ML depends on the quality of features in the input data.^3,5 The high dimensionality seen in network traffic datasets has many features that indicate packet headers, flow durations, traffic volumes, and other features that describe the nature and volume of traffic passing through networks. Although these features provide vital information related to the network, redundancy, noise, and irrelevant information hinder the detection process. The process of selecting appropriate features and engineering new meaningful features from available features is vital in such models.^6–8 Raw features include the data obtained from the traffic from the basis for the input features used in ML models.^9–11 Such features play a key role in improving the capacity of a model to detect attacks against systems and networks, and they are also good at generalization.^6,7,12

Machine learning is capable of quickly classifying attack traffic from benign traffic (binary), but the complicated forms of DDoS attacks owing to advanced evasive techniques with multiple types of traffic combined in a single attack can be challenging.¹³ To combat such complicated attacks, researchers have used Computational Neural Networks (CNN), a deep learning model, and have considered Recurrent Neural Networks (RNN) that are efficient in traffic classification.^14–16 Effective principles such as Principal Component Analysis (PCA) have proven to be very effective in addressing many issues, particularly the curse of dimensionality, by transforming higher-dimensional data into lower-dimensional data.

The model created in this study was evaluated using the CICDDoS2019 dataset, which is publicly available and used by many DDoS detection studies. Data preprocessing was performed according to the proposed methodology and used to train ML models, such as Gradient Boosting Machines, Random Forest, and Neural Networks. The performance was compared against globally transformed features using PCA, with results demonstrating significant improvements in the accuracy and robustness of the simple ML model.

The work done with the proposed innovative technique for feature engineering and classification using a simple ML model is presented in the following sections. Section 2 focuses on the literature related to DDoS detection and dimensionality reduction along with the techniques used for the same. Section 3 outlines the proposed methodology, which includes categorization of features and PCA-based dimensionality reduction. Section 4 explains the setup and results of the experiments, along with a discussion of the results. Section 5 summarizes the output of the experiment to conclude and extends the research directions for future work.

Abdulhammed et al.¹⁷ explored the improvement of IDS using ML. The focus was primarily on reducing the dimensionality of the CICDDoS2017 dataset using autoencoders and PCA to enhance the performance of the classifier. Classifiers, such as Random Forest, Linear Discriminant Analysis, and Quadratic Discriminant Analysis, were tested. This was followed by a new performance metric, CombinedMc, to evaluate the classification of multiple classes better. This study achieved an accuracy of 99.6%, along with other key metrics, by significantly reducing the feature dimensions. Distribution-based balancing was used in this study to address the imbalance between classes.

A proactive feature selection model with nature-inspired optimization algorithm was used by Riydh et al.¹⁸ for the selection of relevant features in the CICDDoS2019 dataset. Algorithms such as Random Forest (RF), K-Nearest Neighbour (KNN), and Support Vector Machine (SVM) were implemented for the classification of normal traffic from malicious traffic.^19,20 This model is shown to outperform existing methods in terms of the detection rate, overall accuracy, and reduction in false positives. This shows the importance of the feature engineering step for machine learning processing and its contribution to the performance of ML algorithms.

Another study highlighting the importance of feature engineering was conducted by Pegah et al.,²¹ wherein the proposed model worked on an Ensemble Feature Selection method with a multi-aspect perspective. The relevant features are selected based on each type of attack, along with a combination of statistical filtering techniques and machine learning algorithms. Prediction times can be reduced by focusing on key features in the dataset, which increases the performance of the ML algorithm. This, in turn, improves the mitigation capabilities of the algorithm. A more informative and precise representation of the traffic data adds to the overall performance of the algorithms.

In a review by Muhammed et al.,²² the importance of ML power for the detection of DDoS attacks was summarized based on references from numerous studies. This summary highlights the significant impact of the appropriately chosen dataset and the features selected from the dataset. This step helps researchers and practitioners develop robust solutions for handling DDoS attacks.

A deep learning-based approach that leverages the advantages of RNN and LSTM ML models was developed by Jiyeon et al.²³ The N-BaIoT dataset was used in this study, which simulates botnet attacks on multiple IoT devices. Approximately 115 features presented within the dataset were categorized into five groups, and the primary key was based on the time window, which provided the best performance.

In another study by Muhammad et al.²⁴ conducted as a systematic review, the detection of DDoS attacks was focused on backward elimination, chi-squared tests, and information gain scores for the creation of datasets with significant features. This optimization was shown to increase the efficiency of the tested machine learning models, which were fine-tuned and tested. A feature reduction of up to 68% was achieved, with a minimal accuracy loss of 003%. This strategic combination of feature and machine learning was validated using cross-validation and AUC analyses to mitigate overfitting and collinearity. Among the various algorithms, K-nearest neighbors (KNN) performed the best overall, followed by SVM. Random Forest (RF) performs well on low-dimensional datasets with discrete features, although it is simple and quicker than the others.

Various studies have chosen the best features to improve the performance of the chosen ML model. The important works related to feature engineering used in DDoS attack detection is summarized in Table 1. Most of them have binary classification of attacks and benign traffic. Some studies in the literature have proposed models that perform better with both binary and multi-class classification, but their performance is less than that of binary classification. Based on the literature and data compilation from multiple studies, the following research gaps were identified:

Here, the details of the dataset used, the new features engineered, the features dropped, and the detection algorithm used are described. In Figure 1, the steps used in this study, including feature selection, feature engineering, splitting the dataset, and the rest of the steps, are summarized.

In this study, the CCIDDoS2019 dataset was used after processing it for feature engineering, where the important features were retained and new features were generated. The final dataset comprises 499,998 samples across 10 attack classes, where eight of the classes contributed 50,000 samples each and rest two classes (DrDoS_MSSQL and DrDoS_UDP) contributed 49,999 each. The terms “50k” and “100k” used in different sections of this paper refer to the per-class sampling size applied during dataset construction, not the total count. The dataset is partitioned into training (n = 297,498), validation (n = 52,500), and test (n = 150,000) sets using stratified sampling to maintain appropriate distribution of classes. The per-class counts for all three partitions are provided in Table 2 (primary dataset) and Table 3 (doubled dataset). The pipeline was applied, with all transformers fitted on the training partition, and the results are presented from the test set (Table 4). The values from PCA on the features generated, and using these PCA values as part of the dataset considerably reduced the dimensions but retained the interaction and contributions of the features within the dataset. This step reduces the running time of the model with reduced dimensions resulting in less processing time for the model, while retaining the importances of the features. The new features generated considerably improved the classification performance of the model and showed consistency of the model through the evaluation metrics (Table 5).

Observations from this study include feature engineering as a key component and critical component in the enrichment of the dataset. The features derived, such as total packets, Flow IAT aggregate, Subflow Total Packets, and Flag aggregate, encapsulate domain-specific knowledge. This concept increases the representational power of the dataset and the ranking of these features from both the datasets used is presented as a Table ( Table 6). The importance of feature engineering, which can retain the representation of the original dataset, has been given considerable importance in previous studies on machine learning for DDoS attacks.^26–28 Additional aggregated metrics, such as Active Time Aggregate, Idle Time Aggregate, enabled the model to effectively capture temporal and flow-based behavioral patterns within network traffic.

Running PCA to each of the categories separately ensured the high-dimensional space within the features was transformed into a compact representation while retaining the most meaningful variance in each category group. Each category retained ≥95% of its variance: traffic_metrics retained 96.06% (12 features = 6 components), iat_features 97.71% (7 features = 4 components), packet_characteristics 95.82% (10 features = 4 components), header_flags 98.99% (7 features = 6 components), traffic_rates 100% (3 features = 3 components), and time_features 100% (6 features = 4 components) among all the features used in this categorization (Table 7). Overall, 45 features were compressed to 27 PCA components resulting in a 1.67× (overall) reduction, while retaining the dominant variance structure of each semantic group. The variance breakdown of each component and compression ratios for each category are reported in Table 7. This efficient categorization of features and combining them in their individual grouped PCA components resulted in a feature set proving to be highly discriminative that are evident in the results from evaluation (Table 4). Retaining the importance of features and reducing noise are essential components of ML algorithms. These algorithms are sensitive to noise and reducing them to the maximum possible extent is an important step in these models.^29–32

In machine learning models, performance against multi-class target sets is an essential feature, depending on the field of interest.^33,34 In areas such as DDoS detection, the capability of the model plays a major role in real-world scenarios. Our model achieved the highest possible accuracy in classifying the various classes within the target column, and this could primarily be a result of the retention of importance within the dataset, although the dimensions were reduced categorically using PCA. This capability is evident from the distribution observed within the confusion matrix, where the false positives are minimal compared to the large size of the datasets used in this study. The confusion matrix for both the datasets (50k and 100k) is shown in Figure 5. This novel concept of categorized PCA successfully retained the importance of the dataset values. The stratified train-test split handled the bias in the evaluation and ensured the class proportions within the training and testing datasets, mirroring the distribution in the original dataset.

The learning curves against the running of the model with the two datasets show that the training phase has a linear plateau, indicating the efficiency of the training of the model. During the testing phase, the curve begins at the minimum and gradually reaches the level of the training phase. This indicates that the learning curve was gradual, and the final accuracy was achieved, which is in line with the testing data. If the testing curve had ended at a lower or higher level than the training curve, it would be a case of underfitting or overfitting, respectively ( Figure 6). Even with the increase in the dataset, there was no underfitting or overfitting seen with the model, and the engineered features and the application of PCA have well balanced the importance of the features represented within the original CICDDoS2019 dataset.

This model showed a consistent performance when used against both the 50k and 100k datasets. To test this method of creating an efficient feature engineered dataset, other algorithms, such as Gradient Boost, Logistic Regression, SVM, and basic deep learning models, such as neural networks, were tested (Table 8). The dataset showed consistent performance in all these models with minimal possible configuration changes, which kept them simple and less burdensome on the computational power required for their execution. All these models were also tested against both the 50k and 100k datasets. The performance was consistent against all these models, and this was observed using the learning curves run for each of these models ( Figure 6). All the models showed a consistent learning curve against both datasets and finally reached a peak near the training curve. This demonstrates the efficiency of the model under varying circumstances, which is expected in large networks with multiple IoT devices communicating with each other. Another major concern is the dynamic nature of these communications, which is addressed by the feature engineering step, and PCA, which efficiently handles the variability in the dataset by reducing the dimensionality of the varying features. With precision, recall, and F1-score of 1.00 across all ten attack classes at both dataset scales, the model demonstrates robust and consistent classification performance, confirming its ability to handle the dynamic nature of multi-class traffic in SDN environments. This component serves as an important feature when designing intrusion-detection systems for dynamic environments, and this model addresses these requirements.

The scalability and adaptability of this approach are proven by the performance of the model against the increased dataset and multiple algorithms that were tested (Tables 8 and 9). This shows the importance of feature engineering and feature categorization along with dimensionality reduction in the effectiveness of the chosen ML or DL model in the classification of DDoS attacks using the chosen dataset.

The uncalibrated Random Forest demonstrated exceptional probability calibration (mean ECE = 0.000276, mean Brier score = 0.000143 across ten OvR binary problems), substantially lower than typical values reported in network intrusion detection literature (0.02–0.10). Post-hoc Platt scaling reduced mean ECE to 0.000113, however visual inspection of the reliability diagram confirmed that the uncalibrated model provides more stable probability estimates across the prediction range. This behavior is consistent with known limitations of sigmoid calibration when applied to already well-calibrated models.³⁵ Accordingly, uncalibrated RF probabilities are reported as the primary result, with calibration diagnostics provided in Table 10 and Figure 2 for completeness.

A notable structural finding emerged from comparing results across dataset scales. The grouped PCA pipeline showed an identical component structure at both the 50k and 100k scales; 27 components across six category groups with variance retention varying by no more than 0.60% across any category between the two scales. In contrast, global PCA changed from 22 components at 50k to 21 at 100k, reflecting sensitivity to sampling variation in the overall covariance structure when all 45 features are treated as a single undifferentiated pool (Table 5). This structural invariance of the grouped approach is a practically important property for operational deployment: retraining on larger datasets does not alter the dimensionality of the feature space passed to downstream classifiers, removing a potential source of pipeline incompatibility in production systems. Furthermore, classification performance improved consistently with scale across all metrics moving weighted F1 from 0.9991 to 0.9994, log loss halving from 0.0047 to 0.0026, and mean ECE improving from 0.000276 to 0.000202, that confirms that both accuracy and probability calibration quality scale favourably with data volume. The grouped PCA configuration also maintained the fastest inference time at both scales (789 ms at 50k, 1,575 ms at 100k), with the inference advantage over raw features growing from 20% to 22% as dataset size doubled, demonstrating that the dimensionality reduction benefit increases with scale (Table 8).

Of the multiple features involved in the efficiency of the model, a list of the important features responsible for this was analyzed. It was observed that most of the newly generated features were included within the top 10 features based on their importance ( Figure 7 and Table 6), which were observed in both the 50k and 100k datasets. The PCA values that represent the newly generated features, which in turn represent the multiple features categorized under them, have been shown to contribute to the success of the model’s performance.

By combining feature engineering, dimensionality reduction using PCA, and machine learning for the classification of benign from attack traffic in the CICDDoS2019 dataset, the following conclusions can be drawn from this study. The pivotal concept of feature engineering, capable of capturing the domain-specific nuances of the features within the network traffic, has been a key feature in this efficient classification. In addition to this engineering and processing step, the application of PCA to these derived dataset categories and adding them to form the new dataset led to a significant reduction in the computational burden. A pipeline in which all transformers are fitted exclusively on the training partition was implemented and validated. This pipeline achieved a weighted F1-score of 0.9991 (50k) and 0.9994 (100k), a weighted AUROC of 1.0000 at both scales, log loss of 0.0047 (50k) and 0.0026 (100k), and a mean ECE of 0.000276 (50k) and 0.000202 (100k) on the test sets.

A notable structural finding emerged from comparing the two dataset scales: the grouped PCA pipeline produced an identical component structure at both scales, specifically 27 components across six category groups, while global PCA changed from 22 to 21 components, reflecting sensitivity to sampling variation in the overall covariance structure. This structural invariance is a practically important property for operational deployment, where retraining on larger datasets should not alter the dimensionality of the feature space passed to downstream classifiers. Grouped PCA reduced features from 45 to 27 while lowering inference time and maintaining accuracy. Statistical analysis confirmed the strong performance of Random Forest compared to other classifiers. Random Forest was selected as the primary classifier due to its high accuracy and significantly lower training time. The model also demonstrated near-perfect probability calibration across both dataset scales. Overall, the proposed framework provides a reliable, scalable, and computationally efficient approach for DDoS detection in SDN environments.

This work could be enhanced by combining advanced models using ensemble techniques, which is an upcoming and promising field that can exploit the advantages of multiple models. Class imbalance has been a major concern in datasets, such as this case, when considering real-world scenarios. This could be improved and addressed to increase the performance of the selected models. Finally, the use of time-series models or a combination of approaches using hybrid approaches could help capture the temporal dependencies present within the network flows, which could in turn improve the accuracy of classification. Several other limitations of the current work should be acknowledged. The CICDDoS2019 dataset is a controlled laboratory capture, and the feature distributions are cleaner and more separable than those typically encountered in production networks; the near-perfect AUROC values reflect this characteristic of the benchmark rather than a universal property of the method. Conducting a cross-dataset validation study by training on CICDDoS2019 and evaluating on a separate dataset such as UNSW-NB15 or CICIDS2017 was not conducted, and remains a priority for future work to establish broader generalisability. Additionally, two attack classes (DrDoS_SSDP and DrDoS_DNS) were excluded from the final model which paves way for future work to investigate the impact of their inclusion and assess whether the model generalises when these traffic types are included. The temporal dimension of network traffic is not covered or modelled in the current approach by incorporating sliding-window flow features or graph-based representations of inter-flow relationships which remain to be considerable future directions that could improve detection of multi-point coordinated attacks.

Ethical approval and consent were not required.