Design and Implementation of a New Machine Learning Framework for Distributed Denial of Service (DDoS) Attack Detection in the Cloud Environment

Abstract

Distributed denial of service (DDoS) attacks presents a great danger to the availability of cloud services which they do to by overrunning the elastic, shared and heterogeneous infrastructures that host cloud services. We put forth a novel layer based machine learning architecture, a very effective supervised classifier method, and an Improved Gaussian Naive Bayes (EGNB) model for the detection of DDoS attacks in cloud settings. The framework we present is of a traffic capture and preprocessing, choice of which features are the most discriminative, parallel classification, mitigation, and feedback retraining. Also, we use mutual info for feature weighting which we in turn apply adaptive variance regularization, soft class priors and log domain computation of posteriors. The evaluation protocol uses the UNSW-NB15 dataset with comparisons against Decision Tree, Support Vector Machine, Random Forest, XGBoost, and Gaussian Naive Bayes classifiers and reports accuracy, precision, recall, F1-score, false-positive rate, specificity, and prediction latency. The design philosophy is focused on low-latency inference, transparent validation, and cloud-native deployment. Since UNSW-NB15 contains a Denial-of-Service (DoS) category rather than a dedicated distributed-source DDoS class, DDoS-specific external validation is treated separately from the primary pipeline evaluation.