# A Lightweight Model for DDoS Attack Detection Using Machine Learning Techniques
## 4 Results and Discussion  
This paper has implemented its experiment with the help of Google Colab for working on the TON-IOT dataset and Jupyter Notebook for working on the BOT-IOT dataset. Two Python programming tools were used for this experiment as Google Colab gives limited data usage capacity to run the experiment, which is not sufficient to run the BOT-IOT dataset as well. Hence, the Jupyter Notebook was used. This experiment is run on Intel(R) Core (TM) i7-9750H CPU @ 2.60 GHz, 2592 Mhz, six core(s), twelve logical processor(s) with 16 GB RAM, and NVIDIA GeForce GTX 1660 Ti with Max-Q Design 4 GB graphic card. It was very easy to import the network dataset of TON-IOT as it had limited records (461,043 records) compared to the BOT-IOT dataset, which had four parts and had to be concatenated together to create a 3-million-record dataset. Initially, both of the datasets were experimented on with only 20 features and still gave excellent results compared to the state-of-the-art models, but it was observed that even with 15 features the model was able to compute excellent results that prove how efficient the proposed model is, with the help of feature selection and resampling methods. The TON-IOT and BOT-IOT datasets were used to model the dataset using five machine learning algorithms for DDoS attacks and regular traffic examples. When compared to attack traffic flow, normal instances are seen to occur less frequently in the TON-IOT dataset than in BOT-IOT. Therefore, it is necessary to balance the data frame's attack class and normal traffic class. Hence, the SMOTE technique was implemented, which was discussed in the previous section. Initially, in TON-IOT, Class 0 had 239,945 records and Class 1 had 16,055 records, but after resampling Class 0 and Class 1 both had 239,945 records. Similarly, in BOT-IOT, Class 0 had 1,541,298 records and Class 1 had only 382 records, but after resampling Class 0 and Class 1 had 1,541,298 records. The proposed model is compared with other existing models (Table 2). Each time, a collection of five algorithms is employed to decide how to classify and predict the data frames. The following machine algorithms are applied in each situation: logistic regression, naive bayes, artificial neural network, random forest, and k nearest neighbor (Table 3). The research's objective is to evaluate and contrast the performance of various categorization and prediction algorithms. The results of all the tests mentioned above are shown in a table that also includes an area under the curve score, a receiver operating characteristic (ROC) curve, and a confusion matrix with Class 0 (normal) and Class 1 (attack), along with the time taken to train and predict the data, categorizing two cases each for both BOT-IOT and TON-IOT datasets. * Case 1: multiple-class classification using 15 features of TON-IOT with SMOTE;
* Case 2: binary classification using 15 features of TON-IOT with SMOTE;
* Case 3: multiple-class classification using 15 features of BOT-IOT with SMOTE;
* Case 4: binary classification using 15 features of BOT-IOT with SMOTE. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Paper** & **Year** & \begin{tabular}{c} **Handling Missing** \\ **Values** \\ \end{tabular} & \begin{tabular}{c} **Handling Categorical** \\ **Data** \\ \end{tabular} & \
\begin{tabular}{c} **Standardization** \\ \end{tabular} &
\begin{tabular}{c} **Feature Selection** \\ \end{tabular} \\ \hline
[23] & 2022 & Minkowski Dist. & - & - & SMOTE \\
[24] & 2021 & Imputation & One Hot Encoding & Min-Max Scalar & Chi-Square Test \\
[22] & 2022 & - & Label Encoding & Standard Scalar & ExtraTreeClassifier \\
**Proposed** & **2023** & **-** & **One Hot,** & **Standard Scalar,** & **ExtraTreeClassifier** \\
**Model** & **2023** & **-** & **Label Encoding** & **Min-Max Scalar** & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of existing data pre-processing techniques and proposed procedures.