Applying Principal Component Analysis for Categorized Dimensionality Reduction in DDoS Detection for Software-Defined Networks.

BACKGROUND: The explosive growth of Software-Defined Networks (SDN) has introduced unmatched scalability with increased flexibility, an essential component of this modern, complicated network infrastructure. While machine learning models promise to be a viable approach for detecting Distributed Denial of Service (DDoS) attacks, their efficiency relies on the quality of the engineered features. METHODS: In this study, an innovative approach for categorizing newly generated features based on domain-specific relevance is applied, followed by Principal Component Analysis (PCA) on each of the categories for dimensionality reduction. These new engineered features represent the originality of the features within the original dataset without losing their integrity by dropping multiple features from the original dataset. These PCA-transformed features, along with other individual features that were not used in the previous step, were merged into a single dataset for further processing using Machine Learning classifiers. This unique methodology not only addresses the curse of dimensionality but also ensures that the meaningful variance within the categories of features is retained. The CICDDoS2019 dataset was used to evaluate the developed model against features engineered from this dataset. Performance was evaluated using accuracy, precision, recall, F1-score, ROC-AUC, log loss, ECE, and cross-validation. The primary dataset comprised of 499,998 total samples consisting of nine attack and one benign classes, split into training, validation, and test sets. Each category group retained ≥95% variance, compressing 45 to 27 PCA components. The proposed grouped PCA pipeline, with all transformers fitted on the training partition, achieved a weighted F1-score of 0.9991, AUROC of 1.0000, and mean ECE of 0.000276 on the primary dataset, improving further to 0.9994, 1.0000, and 0.000202, respectively on a doubled dataset, with five and ten-fold cross-validation confirming strong generalisability and scalability across both scales. CONCLUSION: This planned and logically structured approach underscores the importance of domain-driven feature generation and categorization.