Analyzing Class-Level Performance Variability in Multi-Class DDoS Detection: A Diagnostic Framework Based on XGBoost and Per-Attack Difficulty Scoring

The DDoS attacks continue to be one of the most widespread menace to the modern network infrastructure, since they flood systems with harmful traffic and disabling of the valid services. Considering the continuously changing nature of the attack pattern, detection through a machine-learning method has been a mandatory requirement to observe the slight differences that are present between the different kinds of DDoS attacks. The paper trains and tests a multi-class XGBoost detection model on a mixed dataset with eleven different categories of DDoS attacks. Precision, Recall, F1 -score, ROC -like interpretations, Precision -Recall curves, confusion matrices, and computational efficiency metrics were used to evaluate the model. The results indicate that there is a high level of detectability variation among classes. High-performance attacks, including DrDoS NTP, TFTP, and DrDoS MSSQL, had almost perfect F1 -scores, which means that they were very separable and displayed consistent patterns of features. NetBIOS, SNMP, and Syn were moderate in their performance, with some overlap in the distributions of features. Classes with the worst performance of LDAP, SSDP, DrDoS UDP, DrDoS DNS, and UDPLag had more misclassification rates and difficulty scores, indicating complex or noisy traffic characteristics that do not help with accurate classification. The model was also found to be very computationally efficient, and inference times were fast enough to allow the model to be used in a real or near-real-time setting. These findings highlight the importance of using hybrid datasets and diagnostics of class-level performance to reveal variability of attack detection. The study concludes that XGBoost has strong flexibility in the accuracy, stability, and working efficiency in multi-class DDoS detection. The next improvements can include the addition of deep-learning frameworks, adversarial training, and real-time threat feeds, which can be used to enhance detection and other network defense against the most difficult types of attacks.