# XGBoost-Based Detection of DDoS Attacks in Named Data Networking
## 3 The Attack Model and Detection Method
### _The Detection Mechanism of Improved XGBoost_  
Based on the overall detection process proposed earlier, the XGBoost algorithm is applied within the detection workflow. Compared with traditional IFA attack detection algorithms [10], XGBoost introduces the Gradient Boosting mechanism and automatic feature selection [16], enabling it to more precisely capture pattern changes in attack traffic. Furthermore, this method can address the issue of imbalanced data, effectively reducing the risk of minority attack samples being overlooked through sample weight adjustment and loss function optimization. Additionally, XGBoost does not rely on fixed thresholds but instead dynamically adjusts its detection strategy in a data-driven manner, meeting the real-time attack detection requirements in NDN environments. The core components of the detection framework are illustrated in Figure 3, which includes a feature extraction module,  
Figure 2: Overall architecture of the detection method. tree splits layer, transformed feature layer, softmax layer, and network decision layer. The feature extraction module collects and integrates multi-dimensional traffic features, the tree splits layer learns the importance of data features through multiple decision trees, the transformed feature layer further optimizes feature representation, the softmax layer is used for normalization calculations, and ultimately, the network decision layer provides the decision result for attack detection. The entire detection framework possesses strong generalization capability and real-time performance, making it suitable for various complex attack scenarios in NDN environments. To evaluate the designed detection model, a data set \(D=(X_{i},y_{i})_{i=1}^{M}\) is proposed, where \(X_{i}=(x_{i,1},x_{i,2},\ldots x_{i,m})\) represents the network traffic composed of \(m\) features. The label \(y_{i}\in\{0,1,2\}\) indicates different network states, including normal (0), I-CIFPA (1) and other network state (2). We further define \(y_{i,n}\), denoting the true score of the \(i\)-th sample on the \(n\)-th class, where  
\[y_{i,n}\in\left\{ \begin{array}{ll}1,&\text{if}\;\;y_{i}=n,\\ 0,&\text{else}.\end{array} \right. \tag{1}\]  
In order to effectively detect and distinguish normal traffic from I-CIFPA attacks, we adopted a multi-class classification model based on XGBoost. This approach enables us to build a separate decision tree for each network state and iteratively optimize it using the gradient boosting algorithm. Let the training dataset be represented as \(D=(X_{i},y_{i})_{i=1}^{M}\). The model output for the \(i\)-th sample on class \(n\) after \(t\) rounds is denoted as \(\hat{y}_{i,n}^{t}\), and the aggregated score from the previous rounds is  
\[\hat{y}_{i,n}^{t-1}=\sum_{k=0}^{t-1}\hat{y}_{i,n}^{(t-1)}. \tag{2}\]  
We use softmax to convert the raw scores into probabilities:  
Figure 3: Detection model based on improved XGBoost. \[p_{i,c}^{t-1}=\frac{e^{g_{i,n}^{d-1}}}{\sum_{c=0}^{2}e^{g_{i,c}^{t-1}}} \tag{3}\]  
In this case, the corresponding loss function can be expressed as  
\[L(y,\hat{y})=-\sum_{i=1}^{M}\sum_{n=0}^{2}y_{i,n}p_{i,c}^{t-1}+\Omega(f), \tag{4}\]  
where \(\Omega(f_{t})\) is the regularization term defined as:  
\[\Omega(f_{t})=\gamma T+\frac{1}{2}\lambda\sum_{j=1}^{T}w_{j}^{2}, \tag{5}\]  
Here, \(T\) is the number of leaves in the \(t\)-th tree, \(w_{j}\) is the score of the \(j\)-th leaf node, and \(\lambda\), \(\gamma\) are regularization parameters that help control model complexity and overfitting. To optimize the model efficiently, we apply a second-order Taylor expansion to approximate the loss function. This leads to the following objective:  
\[L\left(y,\hat{y}^{(t)}\right)=\sum_{j=1}^{T}\left[G_{j}w_{j}+\frac{1}{2}\left( H_{j}+\lambda\right)w_{j}^{2}\right]+\gamma T. \tag{6}\]  
where  
If \(p_{2}>\{p_{1},p_{3}\}\), the network status will be judged as other attack. If \(p_{3}>\{p_{1},p_{2}\}\), the network status will be judged as I-CIFPA.