Feature-Selected Machine Learning and Deep Learning Framework for Cloud-Based DDoS Attack Detection

Cloud infrastructures face persistent distributed denial-of-service (DDoS) attacks that exhaust network and server resources and reduce service availability. This study presents MI-LDDoSNet, a feature-selected machine learning and lightweight deep learning framework for binary cloud-DDoS detection using the BCCC-cPacket-Cloud-DDoS-2024 dataset. The original labels were mapped into benign and DDoS-related classes, followed by duplicate removal, identifier removal, leakage-safe preprocessing, stratified train-validation-test splitting, class-weighted learning, and mutual information-based top-40 feature selection. Logistic regression, decision tree, random forest, XGBoost, RBF-SVM, multilayer perceptron, and one-dimensional convolutional neural network models were trained under a common evaluation pipeline. On the held-out test set, XGBoost achieved the highest F1-score of 0.8369, accuracy of 0.8740, precision of 0.8930, recall of 0.7873, specificity of 0.9343, and ROC-AUC of 0.9259. SHAP analysis showed that TCP header-byte and forward SYN flag features contributed most to the final detection decision. The results show that a compact feature-selected pipeline can provide reproducible cloud-DDoS detection with interpretable traffic indicators.