DDoS detection in network traffic using LightGBM: A study on the CICIDS2018 dataset

Abstract

—Distributed Denial of Service (DDoS) attacks continue to pose a critical threat to the integrity and availability of modern network infrastructures, particularly within increasingly interconnected digital ecosystems. This study investigates the efficacy of the Light Gradient Boosting Machine (LightGBM) algorithm for the detection of DDoS attacks, employing the widely recognised CICIDS2018 dataset as a benchmark. A structured preprocessing strategy was applied to improve the model’s classification accuracy and generalizability, which involved data cleaning, strategic feature selection, and the use of the Synthetic Minority Oversampling Technique (SMOTE) to address class imbalance. Emphasis was placed on flow-level network features, which facilitated highdimensional learning while preserving contextual traffic characteristics. The LightGBM-based detection model achieved a classification accuracy of 95.84%, accompanied by robust precision and recall metrics. These results underscore the potential of LightGBM as a viable approach for DDoS detection in static or semi-controlled environments, while also identifying opportunities for future research in real-time or adaptive intrusion detection systems.