Pith. sign in

REVIEW 3 major objections 4 minor 22 references

Detecting Distributed Denial of Service Attacks Using Logistic Regression and SVM Methods

T0 review · 3 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that logistic regression and SVM both reach 98.65% accuracy on a five-class DDoS detection benchmark, the highest reported for that dataset.

desk verdict The 98.65% claim is not supported by the paper's own tables, and the identical confusion matrices make the whole empirical section look unreliable. read the letter →

arxiv 2411.14512 v1 pith:U46IO4SH submitted 2024-11-21 cs.CR cs.LG

Mohammad Arafat Ullah , Arthy Anjum , Rashedul Amin Tuhin , Shamim Akhter This is my paper · ORCID
classification cs.CRcs.LG
keywords DDoSdetectionlogisticregressionsupportvectormachinemulticlassclassificationintrusionnetworksecurityUDPfloodSIDDOS
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that two standard, inexpensive classifiers—logistic regression and support vector machines—can detect and label distributed denial-of-service attacks in a public dataset of 1,048,574 records described by 27 network attributes. The authors report that both models achieve 98.65% classification accuracy across five classes (normal traffic, UDP flood, Smurf, SIDDOS, and HTTP flood), which they say is the highest accuracy so far reported on this particular dataset, edging past the 98.63% of a multilayer perceptron. The practical interest is that if this holds, a network operator can get near-best detection with a model that is simple to train and explain, without a deep network. The paper also reports per-class precision and recall, showing both models classify UDP flood and HTTP flood well but recover only about a third of SIDDOS attacks.

What carries the argument

The load-bearing object is the five-class DDoS dataset taken from the prior study [5]: 1,048,574 rows, 27 continuous and symbolic network attributes plus a class label, with about 90% normal traffic and 10% attacks (UDP flood 9%, with Smurf, SIDDOS, and HTTP flood making up the rest). The argument is carried by a standard supervised pipeline—label encoding of categorical features, min-max normalization to the range 0 to 1, an 80/20 train-test split, and two off-the-shelf classifiers, logistic regression and a support vector machine (a max-margin classifier that separates classes by a learned boundary)—and by confusion matrices and classification reports showing that the two models behave identically on the test set. The reported accuracy is the weighted fraction of test records whose predicted class matches the true class.

What would settle it

Re-run both models with a stratified random 80/20 split, or with 10-fold cross-validation, that preserves the dataset's roughly 90% Normal and 9% UDP-Flood proportions, and report per-class recall. If the accuracy drops materially below 98.65%, or if the Normal-class recall changes from the 0.94 shown in Tables III and V, the headline number is an artifact of the skewed test split rather than a property of the classifiers.

Watch

Extended reading notes

Core claim

On the authors' own terms, the central discovery is that logistic regression (with an LBFGS solver) and SVM (scikit-learn SVC with gamma=scale and one-vs-one decision function) produce identical performance on the DDoS dataset: the same 98.65% accuracy, the same confusion matrix, and the same per-class precision and recall. Both models correctly classify nearly all UDP-Flood test records and most HTTP-Flood records, but SIDDOS recall is only 0.33, meaning two of every three SIDDOS attacks are missed. Because the two classifiers give the same numbers and the same matrix, the authors treat the result as a mutual confirmation and conclude that these models set a new high mark for this dataset, above the Naive Bayes 96.91%, Random Forest 98.02%, and MLP 98.63% reported for the same data in the original dataset paper.

Load-bearing premise

The claim rests on assuming that the 80/20 train-test split gives a fair sample of all five classes, but the test set shown in the confusion matrices is overwhelmingly UDP-Flood and nearly empty of Normal records, so the reported 98.65% figure depends on that assumption.

Editorial extensions

If this is right

  • If the reported accuracy holds, a network intrusion system could use logistic regression instead of a multilayer perceptron and obtain essentially the same accuracy with lower training cost and easier interpretability.
  • The identical confusion matrices imply that on this dataset two very different classifiers have converged on the same decision behavior, which supports the idea that the 27 features carry enough signal to separate most classes.
  • The SIDDOS recall of 0.33 means that the headline 98.65% accuracy does not imply dependable detection of every attack class; a deployment focused on SQL-injection DDoS would need additional features or a different model.
  • The comparison suggests the practical ceiling on this dataset is near 98.6% for simple classifiers, so meaningful further gains would require new features or hybrid methods rather than another off-the-shelf model.
  • Because the original dataset paper [5] did not report precision and recall for its models, the per-class numbers here are the first direct comparison for those metrics on this data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The test set's composition—187,848 UDP-Flood records but only 380 Normal records, against a full dataset that is 90% Normal—suggests the reported accuracy mostly measures the model's ability to recognize UDP flood, not its ability to recognize normal traffic; a stratified random split would be a stricter test.
  • The fact that two different classifiers produce identical confusion matrices raises the possibility that one dominant class (UDP flood) drives both models' decisions; testing on per-class balanced subsets would show whether the equivalence survives.
  • A natural extension the authors do not run is feature selection or ablation: with 27 mostly continuous network attributes, removing correlated features (packet counts, rates, sizes) could show which attributes actually carry the DDoS signal.
  • Combining this dataset with additional DDoS datasets, as the authors say they plan to do, would test whether logistic regression and SVM keep their edge when class proportions and attack mixes change.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes logistic regression and support vector machine classifiers for detecting and classifying DDoS attacks (Normal, UDP-Flood, Smurf, SIDDOS, HTTP-Flood) on a dataset of about 1,048,574 records with 27 features. The authors report that both classifiers achieve 98.65% accuracy on a 20% test split, claim this is the highest accuracy on this dataset compared with prior work (MLP: 98.63%, Random Forest: 98.02%, Naive Bayes: 96.91%), and provide confusion matrices and classification reports in Sections V.A and V.B.

Significance. If the reported results were valid, the contribution would be modest: two standard classifiers applied to a public dataset with a small accuracy improvement over an existing MLP result. The paper does not provide code, hyperparameter details beyond a few settings (e.g., gamma=scale, ovo decision function, LBFGS solver), or statistical significance tests, so reproducibility and evidentiary value are limited. The paper does make an explicit and falsifiable comparison claim against prior work, which is a strength in principle, but the internal inconsistencies detailed below destroy the basis for that claim.

major comments (3)
  1. [Section III.D and Section V.A, Tables II and III] The test-set class counts reported in Tables II and III are impossible given the dataset description in Section III.D. The full dataset is stated to contain 97,521 UDP-Flood records and 1,997 HTTP-Flood records. A 20% test split (about 209,715 records) cannot contain 187,848 UDP-Flood instances and 19,637 HTTP-Flood instances, as shown by the row sums in Table II and the support column in Table III. This means the matrix/table labels, the split description, or the dataset description are wrong; in any case, the reported 98.65% accuracy cannot be attributed to the named classes on the described dataset.
  2. [Tables II and IV (Sections V.A and V.B)] Tables II and IV are cell-for-cell identical for two different scikit-learn estimators (LogisticRegression with lbfgs and SVC with gamma=scale and ovo decision function). Producing exactly the same 209,715-instance confusion matrix with two distinct models, including all 1,899 misclassifications of HTTP-Flood as UDP-Flood and 800 SIDDOS misclassifications, is extremely implausible. The paper provides no explanation, and this strongly suggests the two results were not obtained from independent model fits, undermining the claimed 'comparative study'.
  3. [Section V.C, Accuracy claim] The central claim that both models achieve 'the highest achieved accuracy' depends entirely on the contradictory confusion matrices and classification reports. Since the class distributions in those exhibits are inconsistent with the dataset totals, the accuracy value of 98.65% is not a meaningful measure of generalization to the stated data distribution. The comparison to previous accuracies (96.91%, 98.02%, 98.63%) therefore cannot be accepted as stated.
minor comments (4)
  1. [Section III.D] The text says 'The SMURF, SIDDOS, and HTTPS are 6211, 3198, and 1997 of the whole observations respectively,' but Table II and the class descriptions use 'HTTP-Flood'; also the sum of the stated class counts (939,648 + 97,521 + 6,211 + 3,198 + 1,997 = 1,048,575) differs by one from the stated total of 1,048,574 records.
  2. [Section IV.B] The solver is referred to as 'LBSFGS solver'; the correct scikit-learn name is 'lbfgs'.
  3. [Section IV.A and Table I] Several entries in Table I are labeled 'Continuous' despite being symbolic or categorical (e.g., SRC_ADD, DES_ADD, PKT_ID, FLAGS, NODE_NAME_FROM), and the min-max normalization formula is referenced but not actually shown in the text.
  4. [References] Reference [10] contains garbled non-English text instead of a proper title and venue, and reference [6] appears to combine two different papers (Loukas et al. and Sabrina et al.) under a single citation to a 2017 LSTM technical report.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the accuracy result is an empirical measurement, not derived from the paper's inputs; internal data inconsistencies are correctness risks, not circularity.

full rationale

The paper does not present a derivation chain in which a predicted quantity is algebraically or definitionally identical to an input. The central claim is that two classifiers achieve 98.65% accuracy on a test split (Section V.A-B), which is empirically measured from confusion matrices (Tables II and IV). The comparison with prior work (Section V.C) is a benchmark claim, not a fitted parameter renamed as prediction. The dataset source [5] and ML references [6]-[7] are external prior works; the authors' own prior work is not invoked to justify any load-bearing premise, and no uniqueness theorem or ansatz is imported from self-citations. Consequently, none of the enumerated circularity patterns apply. The manuscript does contain serious internal inconsistency: the reported test-set support values (187,848 UDP-Flood and 19,637 HTTP-Flood in Tables III/V) exceed the stated full-dataset class totals (97,521 and 1,997 in Section III.D), and Tables II and IV are cell-for-cell identical for two different sklearn estimators. These problems undermine the reliability of the reported 98.65% accuracy and the validity of the benchmark claim, but they are evidence of data-handling or reporting error rather than circular reasoning. Under the hard rules, a non-finding is appropriate.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new entities or fitted parameters. Its central claim relies on the assumption that the data split is random and representative, which is contradicted by the reported test set composition. The only hand-chosen parameters are standard solver and kernel settings.

free parameters (3)
  • SVM gamma setting = scale
    Chosen by hand, not tuned against a validation set. It is a standard scikit-learn default and does not materially affect the central claim.
  • SVM decision function shape = ovo
    One-vs-one multiclass strategy, chosen by hand. Standard for multiclass SVM, not fitted to data.
  • Logistic regression solver = LBFGS (called LBSFGS in paper)
    Standard solver choice for multiclass logistic regression, not fitted to data.
assumptions (3)
  • domain assumption The dataset is clean and contains no duplicate or redundant records.
    Stated in Section III.A; if false, the accuracy could be inflated by data leakage or repeated samples.
  • domain assumption An 80/20 split of the dataset yields a representative test set.
    Invoked in Section IV.A. The confusion matrices in Tables II and IV show a test set distribution very different from the full dataset, so this assumption is violated.
  • domain assumption The 27 attributes are sufficient to discriminate DDoS classes.
    Implied in Section III.B and used throughout; no feature selection or ablation is performed to test this.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detecting Distributed Denial of Service Attacks Using Logistic Regression and SVM Methods." pith.science (2026). https://pith.science/paper/U46IO4SH

@misc{pith2026241114512,
  author       = {Pith},
  title        = {Pith review of: Detecting Distributed Denial of Service Attacks Using Logistic Regression and SVM Methods},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U46IO4SH}},
  note         = {Machine review of arXiv:2411.14512}
}
read the original abstract

A distributed denial-of-service (DDoS) attack is an attempt to produce humongous traffic within a network by overwhelming a targeted server or its neighboring infrastructure with a flood of service requests ceaselessly coming from multiple remotely controlled malware-infected computers or network-connected devices. Thus, exploring DDoS attacks by recognizing their functionalities and differentiating them from normal traffic services are the primary concerns of network security issues particularly for online businesses. In modern networks, most DDoS attacks occur in the network and application layer including HTTP flood, UDP flood, SIDDOS, SMURF, SNMP flood, IP NULL, etc. The goal of this paper is to detect DDoS attacks from all service requests and classify them according to DDoS classes. In this regard, a standard dataset is collected from the internet which contains several network-related attributes and their corresponding DDoS attack class name. Two(2) different machine learning approaches, SVM and Logistic Regression, are implemented in the dataset for detecting and classifying DDoS attacks, and a comparative study is accomplished among them in terms of accuracy, precision, and recall rates. Logistic Regression and SVM both achieve 98.65% classification accuracy which is the highest achieved accuracy among other previous experiments with the same dataset.

Figures

Figures reproduced from arXiv: 2411.14512 by the authors.

Figure 1
Figure 1. UDP Flood Structure 2) SMURF: It is also a type of denial of service attack that is provided in the network layer. Smurf is provided through cracking IP addresses in a network for a large number of Internet Control Message Protocol (ICMP) traffic to the victim’s server [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. SMURF Attack Structure 3) SIDDOS: SQL Injection DDoS (SIDDOS) is a DDoS attack that occurs in the application layer. This attack is conducted through the insertion of an affected SQL statement as an array and passing this through the database of a website as an equation. Later this illegitimate allowing of this malicious resource provides denial to access the server [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. SIDDOS Attack Structure 4) HTTP FLOOD: HTTP FLOOD also occurs in the application layer. Unlike SIDDOS attackers send valid messages instead of illegitimate messages but at a very slow rate to a web application container web server. This provides denial of accessing the server’s service through slowing down the server. Flexibleness of accessing the http protocol as well as since it does not provide any illegitimate m… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Pie Chart of the occurrence of each class [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Accuracy, precision, and recall graph of pr [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

22 extracted references · 22 canonical work pages

  1. [1]

    Since it is a connectionless protocol, attackers use other comput ers or IOT devices as botnets through a command to use network workstations for the completion of the atta ck

    UDP FLOOD: User Datagram Protocol (UDP) Flood is a network layer DDoS attack. Since it is a connectionless protocol, attackers use other comput ers or IOT devices as botnets through a command to use network workstations for the completion of the atta ck. Then he/she could send a huge amount of UDP traffic to the victim’s server through the compromised com...

    work page

  2. [2]

    Smurf is provided through cracking IP addresses in a network for a large number of Internet Control Message Protocol (ICMP) traffic to the victim’s server

    SMURF: It is also a type of denial of service attack that is provided in the network layer. Smurf is provided through cracking IP addresses in a network for a large number of Internet Control Message Protocol (ICMP) traffic to the victim’s server. Fig. 2 shows how an attacker can provide ICMP traffic to the victim’s s erver. Fig. 2. SMURF Attack Structure

    work page

  3. [3]

    T his attack is conducted through the insertion of an aff ected SQL statement as an array and passing this through the database of a website as an equation

    SIDDOS: SQL Injection DDoS (SIDDOS) is a DDoS attack that occurs in the application layer. T his attack is conducted through the insertion of an aff ected SQL statement as an array and passing this through the database of a website as an equation. Later this illegitimate allowing of this malicious resource pr ovides denial to access the server. Fig. 3 sho...

    work page

  4. [4]

    Unlike SIDDOS attackers se nd valid messages instead of illegitimate messages but at a very slow rate to a web application container web s erver

    HTTP FLOOD: HTTP FLOOD also occurs in the application layer. Unlike SIDDOS attackers se nd valid messages instead of illegitimate messages but at a very slow rate to a web application container web s erver. This provides denial of accessing the server’s serv ice through slowing down the server. Flexibleness of accessing the http protocol as well as since ...

    work page 1997

  5. [5]

    Accur acy is the measurement of the rate of the correctly classi fied instances

    Accuracy: The Logistic Regression model achieved a classification accuracy of 98.65%. Accur acy is the measurement of the rate of the correctly classi fied instances. Since we have more than two classes in o ur dataset it cannot tell whether or not all classes a re being predicted equally, one or two classes have been avo ided

    work page

  6. [6]

    The constructed confusion matrix of the test dataset through the Logistic Regression model is presented in Table II

    Confusion Matrix: A confusion matrix is a table for summarizing the performance of a classification algorithm. The constructed confusion matrix of the test dataset through the Logistic Regression model is presented in Table II. TABLE II. Confusion Matrix of the Logistic Regression Model Actual Predicted Normal UDP- Flood Smurf SID DOS HTTP - Flood Normal ...

    work page

  7. [7]

    Precision: It is the fraction of relevant instances among the retrieved instances

    work page

  8. [8]

    The classification report which contains the information about precision and recall rate is pres ented in Table III

    Recall: It is the fraction of relevant instances that have been retrieved over the total amount of releva nt instances. The classification report which contains the information about precision and recall rate is pres ented in Table III

    work page

Show all 22 references
  1. [9]

    It also implies that the i nput features and output class level have a continuous relationship

    Classification Report: Almost all of the classes provide high precision and high recall hence the mo del is very good and effective. It also implies that the i nput features and output class level have a continuous relationship. TABLE III. Classification Report of the Logistic...

  2. [10]

    The confusion matrix of this model is presented in Table IV

    Accuracy: The SVM model has provided 98.65% accuracy which is the highest accuracy along with t he Logistic Regression model of all the constructed mo dels. The confusion matrix of this model is presented in Table IV. The classification report of this model is pres ented in Table V

  3. [11]

    TABLE IV

    Confusion Matrix: The confusion matrix table (TABLE IV) shows that it has equally predicted all of the classes and it has not avoided one or two classes. TABLE IV. Confusion Matrix of the SVM model Actual Predicted Normal UDP- Flood Smurf SIDDOS HTTP- Flood Normal 359 0 21 0 0...

  4. [12]

    Only the SIDDOS class provides high precisi on but low recall

    Classification Report: All of the classes except the SIDDOS class have achieved high precision and h igh recall. Only the SIDDOS class provides high precisi on but low recall. The table (TABLE V) shows SVM also provides almost the same precision and recall rate as the previous...

  5. [13]

    Analysis of accounting models for the detection of duplicate requests in web services,

    S. Venkatesan, M. S. Saleem Basha, C. Chellappa n, A. Vaish, and P. Dhavachelvan, “Analysis of accounting models for the detection of duplicate requests in web services,” J. King Saud Univ. - Comput. Inf. Sci. , vol. 25, no. 1, pp. 7–24, 2013

    2013

  6. [14]

    Botnet detection based on traffic behavior analysis and flow intervals,

    D. Zhao et al. , “Botnet detection based on traffic behavior analysis and flow intervals,” Comput. Secur. , vol. 39, no. PARTA, pp. 2–16, 2013

    2013

  7. [15]

    Protecting web 2.0 s ervices from botnet exploitations,

    N. H. Vo and J. Pieprzyk, “Protecting web 2.0 s ervices from botnet exploitations,” Proc. - 2nd Cybercrime Trust. Comput. Work. CTC 2010 , pp. 18–28, 2010

    2010

  8. [16]

    Emerging Research in Computing, Informa tion, Communication, and Applications,

    T. De, “Emerging Research in Computing, Informa tion, Communication, and Applications,” Emerg. Res. Comput. Information, Commun. Appl. , no. June 2017, 2015

    2017

  9. [17]

    Detecting Distributed Denial of Service Attacks Us ing Data Mining Techniques,

    M. Alkasassbeh, G. Al-Naymat, A. B.A, and M. Al mseidin, “Detecting Distributed Denial of Service Attacks Us ing Data Mining Techniques,” Int. J. Adv. Comput. Sci. Appl. , vol. 7, no. 1, 2016

    2016

  10. [18]

    P. K. Bediako, “Long Short-Term Memory Recurren t Neural Network for detecting DDoS flooding attacks within TensorFlow Implementation framework. Long Short-Ter m Memory Recurrent Neural Network for detecting DDoS flooding attacks within TensorFlow Implementation framework,” 2017

    2017

  11. [19]

    DDoS attack detection using machine learning techniques in cloud computing environments,

    M. Zekri, S. El Kafhali, N. Aboutabit, and Y. S aadi, “DDoS attack detection using machine learning techniques in cloud computing environments,” Proc. 2017 Int. Conf. Cloud Comput. Technol. Appl. CloudTech 2017 , vol. 2018-Janua, no. October, pp. 1–7, 2018

    2017

  12. [20]

    DDoS attack detection using unique source IP deviation,

    R. C. Baishya, N. Hoque, and D. K. Bhattacharyy a, “DDoS attack detection using unique source IP deviation,” Int. J. Netw. Secur. , vol. 19, no. 6, pp. 929–939, 2017

    2017

  13. [21]

    Detection of DD OS Attacks in Network Traffic Using Deep Learning,

    A. S. Unal and M. Hacibeyoglu, “Detection of DD OS Attacks in Network Traffic Using Deep Learning,” pp. 722–72 6, 2018

    2018

  14. [22]

    N. C. I. Seer et al. , “No Title ﺑﻴﺒﻴﺐ ﺛﺒﺜﺒﺜﺐ vol. ﺙ ﻗﻘﺜﻖ no. April, p. , ﺛﻘﺜﻘﺜﻘﺜﻖ 2018 . 0.984 0.986 0.988 0.99 0.992 accuracy precision recall

    2018

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.