High-Performance TCP SYN Flood Ddos Detection Using Lightgbm: Performance and Multicore Scalability Analysis

Resumen

Distributed Denial-of-Service (DDoS) flooding attacks remain a major threat to network availability by overwhelming target systems with malicious traffic. Among them, TCP SYN flooding is particularly harmful because it exploits the TCP connection establishment process to exhaust server resources. Gradient boosting-based intrusion detection systems (IDS) have proven to be successful measures in detecting DDoS flood attacks. However, gradient boosting-based IDS have received very limited attention regarding their overall computational performance and multicore scalability. Therefore, the following experimental work utilizes the Light Gradient Boosting Machine (LightGBM) to determine both its detection performance as well as its multicore utilization when detecting TCP SYN flood DDoS attacks using a corresponding benchmark dataset (i.e., CICDDoS2019) and time-series dataset (i.e., Time-Series DDoS (TSD-DDoS)) datasets. Based on the experimental work conducted, LightGBM was evaluated throughout various central processing unit (CPU) thread configurations, and measurement criteria for this experimental work include but are not limited to classification performance, execution time, CPU utilization, speedup, and parallel efficiency. The results from LightGBM indicated a high degree of successful detection performance in both the benchmarking dataset and time-series dataset as measured by both test accuracies (i.e., 99.94% and 99.90%, respectively) and F1-scores (i.e., 99.95% and 99.90%, respectively). In addition, performing a multicore execution of LightGBM provided increased multicore execution parallel efficiency (i.e., training > 60% and testing > 77%) while decreasing the execution times when using four-threaded CPU configurations exhibiting training speedups of 2.59× and 2.41× and testing speedups of 3.12× and 3.20× for the benchmarking and time-series datasets, respectively. Therefore, there exists a proven combination of high detection performance along with multicore execution scalability for LightGBM that could ultimately provide an efficient and effective means of real-time DDoS flood detection via TCP SYN flood DDoS attacks.