Core Traffic Feature Identification and Cross-Model Validation for Lightweight DDoS Detection

Abstract

DDoS attacks exhaust target resources through large numbers of concurrent connections, requests, or packets, and remain a major threat to service availability. Machine-learning studies on public benchmarks such as CSE-CIC-IDS2018 often report high classification performance, but high scores alone do not explain which traffic statistics are actually used by the models. They also do not indicate how many features should be collected in lightweight deployment to balance detection performance and computational cost. This paper uses DDoS-related traffic from CSE-CIC-IDS2018 and constructs Benign/DDoS binary detection and Benign/LOIC-HTTP/HOIC multiclass recognition tasks. RandomForest is first used to rank the features, and RandomForest, XGBoost, and LightGBM are then used for cross-model validation. The experiments combine top-k analysis, a Random-5 low-dimensional baseline, remove-top-5 ablation, and multi-seed stability analysis. The results show that top-5 is a near-saturated point for binary detection, while top-2 already forms a compact high-performance solution for multiclass recognition and fixed top-5 further adds packet-length information. After reducing 66 statistical features to 5, the absolute F1 changes of the three models in the binary task are all below 0.0003, and the multiclass Macro-F1 remains close to the full-feature setting. Overall, the selected features should not be interpreted as isolated variables; instead, they form a compact forward-traffic feature cluster. This cluster covers initial window behavior, forward packet volume, forward byte volume, and packet-length characteristics, providing discriminative information for lightweight DDoS detection and recognition of major attack subtypes.