# XGBoost-Based Detection of DDoS Attacks in Named Data Networking
## 4 Experiment Analysis
### Analysis of Experiment Result  
In this section, we first determined the evaluation criteria for I-CIFPAs, and conducted analysis and experiments based on the proposed XGBoost detection model. At the same time, the parameters are continuously adjusted according to the Bayesian optimization algorithm to obtain an enhanced XGBoost model. Finally, the results are compared with other algorithms to verify the performance of the proposed method. Table 1 presents the optimized classifier. Bayesian optimization was applied to adjust the key hyperparameters of XGBoost, aiming to enhance its performance in detecting Distributed Denial of Service (DDoS) attacks in NDN. Compared to the XGBoost baseline  
Figure 7: Changes in OutInterests of routing nodes under different attacks. model, after applying Bayesian optimization, the max_depth parameter was increased from 6 to 7, allowing the model to have stronger expressive power while maintaining generalization; the n_estimators was increased from 100 to 200 to enhance the model's learning capability; the eta (learning rate) was reduced from 0.3 to 0.1 to ensure a more stable training process and avoid performance degradation due to premature convergence. Additionally, the gamma (penalty coefficient) was adjusted from 0 to 0.01, introducing moderate regularization to prevent overfitting; the subsample (random sampling ratio) was decreased from 1 to 0.8, introducing some randomness during training to improve generalization; the min_child_weight was increased from 1 to 10, imposing stricter constraints on the minimum weight of leaf nodes to reduce noise influence and make the model more robust. These adjustments to the optimized parameters not only ensure real-time detection but also improve the generalization ability of the XGBoost model, making it more accurate and efficient in DDoS attack detection tasks within NDN environments. Figures 8-11 present the detection results of I-CIFPA attacks using the proposed method. In this experiment, test data were utilized for validation and detection purposes. To demonstrate the superiority of multi-feature integration, individual feature values were first separately employed for detection, followed by a comprehensive analysis using combined multi-feature values. The detection results are presented as follows. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Adjusted Parameter** & **Interval** & **Value** \\ \hline max\_depth & [1, 10] & 7 \\ n\_estimator & [1, 500] & 200 \\ eta & [0.01, 0.5] & 0.1 \\ gamma & [0.001, 10] & 0.01 \\ subsample & [0.01, 1] & 0.8 \\ min\_child\_weight & [0, 20] & 10 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Optimal parameters of Improved XGBoost. Figure 8: The result of the proposed method through CacheHits. As shown in Figure 11, the enhanced XGBoost model under multiple features shows a good advantage in detection rate. This section verifies the effectiveness and practicality of the multi-feature fusion strategy by comparing the experimental results of single-feature detection and joint multi-feature detection. Figures 8-10 reveal the limitations of single-feature detection; CacheHits reflects the node cache efficiency, but cannot distinguish between normal high-demand traffic and abnormal cache behavior caused by attacks. TimeOutInterest represents the proportion of unresponded interest packets, and its detection results are easily affected by non-attack factors such as network congestion. OutInterests can intuitively indicate interest packet flooding attacks, but it is not sensitive enough to low-rate covert attacks. In contrast, the joint multi-feature method integrates multiple dimensions such as  
Figure 10: The result of the proposed method through OutInterests. Figure 9: The result of the proposed method through TimeOutInterests. cache occupancy patterns and interest packet routing characteristics to obtain better detection results and better performance. This method significantly improves the model's ability to distinguish complex attacks without introducing too much computational overhead.