## 5 Results and Analytical Discussion
### Discussion and Methodological Considerations
#### 5.4.3 Attack Variants and Feature Representations  
This research makes use of the Edge-IIoTset dataset comprising four main DDoS attack variants: DDoS_HTTP, DDoS_ICMP, DDoS_TCP, and DDoS_UDP. Each variant includes distinct network traffic patterns and exploitation techniques that significantly affect detection performance among the evaluated models. Typically reflecting real-world traffic behavior, DDoS_HTTP attacks overwhelm web servers with HTTP requests. The tendency of KNN variants to misclassify a significant fraction of DDoS_HTTP events as XSS attacks suggests that the similarity to normal web traffic presented particular challenges for distance-based algorithms. The uncertainty between these two web-based attack types highlights inherent traffic signature similarities that complicate ML classification.  
Typically employing ping floods, DDoS_ICMP attacks overwhelm target systems through Internet Control Message Protocol (ICMP) packets. These attacks exhibited different traffic patterns, and most models achieved good detection accuracy. The slight confusion between DDoS_ICMP and DDoS_UDP observed in CNN and LSTM models (approximately 0.4% misclassification rate) suggests that minor temporal similarities can influence even advanced DL methods. DDoS_TCP attacks frequently employ Transmission Control Protocol (TCP) mechanisms to exhaust connection resources through SYN flooding attacks. Consistent misclassification patterns between DDoS_TCP and Port_Scanning attacks (ranging from 19.5% to 41.2% across KNN variants and SVM) reveal comparable network behavior traits. This confusion appears to result from both attack types involving systematic TCP port probing, though for distinct purposes while utilizing similar tech niques. DDoS_UDP attacks, which saturate target bandwidth through the User Datagram Protocol (UDP), displayed nearly flawless detection rates across all models in both base and enhanced configurations. Their uniquely identifiable traffic patterns, likely a result of UDP's connectionless nature, produce behaviors markedly different from other attack types. Feature space analysis provided important new insights into the identification of DDoS attack variants. For distinguishing DDoS attacks from normal traffic, network characteristics such as packet size distribution, inter-arrival time, protocol distribution, and flow duration demonstrated considerable discriminative potential. However, greater challenges arose in separating different DDoS variants from other attack categories.  
Analysis of the principal components (PCA) of the feature space exposed some interesting trends in the distribution of attack types. DDoS_UDP attacks formed a distinct cluster, a separation that likely contributed to their consistently high detection rates across the tested models. DDoS_HTTP attacks, on the other hand, showed significant overlap with XSS traffic, particularly along components associated with HTTP header attributes and request patterns. Notably, this overlap persisted even after feature selection was applied, helping to explain the recurrent misclassification trends observed in the KNN variants. Furthermore, temporal features played a very important role in enhancing detection accuracy. Flow duration, packet rate, and burst patterns recorded the highest relevance scores within the RF model, emphasizing their value in distinguishing between legitimate and attack traffic. These sequential properties help to explain the remarkable early performance of LSTM networks, whose recurrent structure naturally captures temporal dependencies without requiring careful feature engineering. Figure 4 shows a comparison of training and detection times over all assessed models, therefore providing more understanding of the trade-offs between predictive performance and computational efficiency.