REVIEW 5 major objections 6 minor 32 references
Detection of Distributed Denial of Service Attacks based on Machine Learning Algorithms
T0 review · 5 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash
Pith's one-line read SVM classifies 97.1% of DDoS attacks correctly on a public flow dataset.
desk verdict A short, underspecified benchmark report; the 97.1% SVM accuracy is not established as an out-of-sample result, and the paper does not deserve referee time. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the SVM classifier built on the two features initial window forward bytes and initial window backward bytes. The argument is that attack flows cluster tightly in these two coordinates because attackers send near-identical request sizes, while legitimate clients send highly varied requests; the SVM then finds a hyperplane that separates the tight attack cluster from the spread of benign traffic. The paper's visual evidence places DDoS rows in the first 50 indices of the inspected data, which is what motivates the two-feature choice.
What would settle it
Run the same two-feature SVM on the same dataset with a randomized train/test split or five-fold cross-validation; if accuracy drops materially below 97.1%, the reported figure is an artifact of the original data ordering. A second check is to test a trivial rule that labels the first 50 rows as attacks and compare its accuracy with the SVM's.
Extended reading notes
Core claim
The paper's central claim is that the support vector machine is the best of the three tested classifiers on the paper's dataset, correctly detecting 97.1% of DDoS attacks while mislabeling 2.1% of benign attempts as attacks and 3.7% of attacks as benign. The claim rests on two selected flow features, the initial window forward bytes and initial window backward bytes, whose values are nearly constant across attack sessions and highly variable across legitimate sessions. Treating those two features as coordinates, the SVM draws a separating hyperplane between the two classes and classifies new flows by which side of the plane they fall on. The paper presents this as evidence that SVMs achieve better detection accuracy, training time, running time, and scalability than decision trees and logistic regression on this data.
Load-bearing premise
The reported 97.1% accuracy is presented as an out-of-sample test result, but the paper never states the train/test split and chose the two features after seeing that attacks sit in the first 50 rows, so the estimate could reflect label-informed feature selection rather than genuine generalization.
Editorial extensions
If this is right
- A two-feature SVM could be deployed at the server side to inspect each incoming request and block flows that fall on the attack side of the hyperplane.
- On this dataset, the SVM's 97.1% accuracy and 0.021 false-positive rate would mean roughly one benign request in 50 is blocked, while about four attacks in 100 slip through.
- The tight-cluster observation suggests that byte-count uniformity itself, not just raw byte counts, is a usable signal for spotting DDoS traffic.
- The reported numbers give a concrete baseline for comparing future detectors on the same dataset.
Reading between the lines
- Editorial inference: if DDoS rows really occupy only the first 50 indices of the loaded table, then a rule that simply flags the first 50 rows would likely match the SVM's accuracy, so the 97.1% figure needs confirmation on a randomized split or cross-validation.
- Editorial inference: the paper's uniformity observation points to a testable extension: aggregate statistics of byte counts (variance or entropy over a short window) may detect DDoS without needing packet-level features.
- Editorial inference: a direct head-to-head with a random-forest classifier on the same two features would clarify whether the advantage belongs to SVMs or to the features themselves.
- Editorial inference: the reported comparison to prior work includes a random-forest result at 96%, so the practical difference between the best classifiers here may be small.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper applies logistic regression, decision trees, and support vector machines to a dataset from the Canadian Institute of Cybersecurity to distinguish DDoS attacks from benign traffic. The authors report that SVM achieves 97.1% accuracy, with precision 0.980 and recall 0.971, and claim that this outperforms logistic regression, decision trees, and several prior approaches. The manuscript describes a feature-selection step based on two packet-byte features and evaluates classifiers using accuracy, precision, recall, F1-score, and false positive/negative rates.
Significance. If the experiments were properly validated, the headline result would be a modest confirmation that SVM works well on a small CIC DDoS sample. The paper does not introduce a new method or dataset, and its comparison to the literature is not on the same task. Its main potential value is as a reproducible benchmark, but the manuscript currently lacks the experimental detail needed for that value to be realized. The paper does provide a block diagram and reports confusion-matrix metrics, which is a reasonable starting point, but these are outweighed by the methodological omissions and internal contradictions.
major comments (5)
- [Section IV.B and Section III] The central claim that SVM achieves 97.1% accuracy on the test set is not supported as an out-of-sample result because the manuscript does not specify the train/test split ratio, randomization, stratification, dataset version, or SVM hyperparameters. Section III states that the two features were chosen "after analysing data" and that "the DDoS attacks data represented in index until 50"; this indicates that feature selection was performed with access to the labels and on a possibly ordered dataset, which can leak label information into the model. The authors must describe the split and feature-selection procedure in detail, or rerun the experiments with a random stratified split and feature selection confined to the training folds.
- [Section IV.C and Table II] There is a direct contradiction in the reported error rates: Table II lists SVM FP=0.021 and FN=0.037, while Section IV.C states "fp= 0.009" and "fn = 0.045" and translates these to one and five per 100 benign/DDoS attempts. The F1-scores in Table II are also inconsistent with the reported precision and recall values; for example, for SVM the harmonic mean of 0.980 and 0.971 is 0.975, not the reported 0.962, and similar discrepancies appear for decision tree and logistic regression. These numbers need to be reconciled or recomputed.
- [Section IV.C] The comparison to prior work does not support the claim of superiority. "Mellor et al. [27]" is a remote sensing forest classification study, not a DDoS detection paper; the text references "Table 3" but no such table appears in the manuscript; and "Agarwal et al. [24]" reports MSE for predicting the number of zombies, which is not comparable to classification accuracy. The authors should either provide a table of comparable DDoS detection results on the same or similar datasets, or remove the comparison.
- [Section IV.A] The dataset is identified only as "the dataset of Canadian Institute of Cybersecurity" without a version (e.g., CICIDS2017, CICIDS2018, or CICDDoS2019) and without the total number of instances or the class balance. Table I shows only five rows, so it is impossible to know the scale or difficulty of the classification problem. Without this information, the results cannot be reproduced or properly evaluated.
- [Section V] The conclusion acknowledges limitations only in a vague sentence ("This work has some limitations"), and that sentence is duplicated verbatim. Given the methodological concerns about data leakage and missing experimental details, a substantive limitations and validity discussion is required before the headline accuracy can be accepted.
minor comments (6)
- [Equation (3)] The feature list "x1, x1, x2, .... xk" duplicates x1; the intended notation is presumably x1, x2, ..., xk.
- [Figure 2 caption] The caption of Figure 2 should define what is plotted on the axes and what the index refers to; the current caption and surrounding text do not make the visualization self-contained.
- [References] References [21] and [23] are blog posts rather than peer-reviewed sources; consider replacing them with authoritative references.
- [Section V] The sentence "This work has some imitations" is a typo for "limitations," and the sentence is repeated verbatim in the conclusion.
- [Throughout] There are numerous grammatical errors (e.g., "These attacks was observed," "It need networking," "one great work used") that should be corrected during revision.
- [Introduction] The D-WARD system is rendered as "D-W ARD" with a space, and "Mellor el al." should be "Mellor et al."
Circularity Check
No circularity: the paper reports a measured SVM accuracy (97.1%) and makes no derivation that reduces to its inputs; feature-selection-after-label-inspection is a validity concern, not definitional circularity.
full rationale
The paper contains no derivation chain that equates its conclusion to its inputs by construction. The central claim, '97.1% of DDoS attacks are successfully detected by the Support Vector Machine,' is presented as an empirical test-set accuracy (Section IV-B: 'the accuracy of test set is almost 0.971'), not as a quantity derived from a fitted parameter or an assumed model. The SVM, decision tree, and logistic regression results in Table II are reported measurements on the Canadian Institute of Cybersecurity dataset. The feature-selection step in Section III ('After loading datasets using pandas, we have chosen two attributes, initial window forward bytes and backward bytes... After analysing data, we observed the DDoS attacks data represented in index until 50') does suggest possible label-informed feature choice or an unstated non-random split, which is a selection-bias or reproducibility concern, but it is not circularity: the accuracy is not forced to equal the input by definition, and no equation in the paper reduces the output to the input. The paper compares with prior work (e.g., Mellor et al. [27]) on a different task, but that is an external-comparability weakness, not a circular step. There are no load-bearing self-citations, no imported uniqueness theorems, and no ansatz smuggled in via citation. The self-reported limitation 'This work has some imitations' is noted but does not bear on circularity. Overall, the paper's weakness is methodological reporting, not circular reasoning.
Assumptions & free parameters
free parameters (3)
- SVM hyperparameters (kernel, C, gamma) =
not reported, defaults assumed
- Train/test split ratio =
not reported
- Feature set for training =
ambiguous (two features vs. nine columns)
assumptions (3)
- domain assumption Labels in the CIC dataset are correct ground truth
- domain assumption Training and test data come from the same distribution
- standard math The standard logistic/sigmoid function in Eq. (2)
Cite this review
Pith. "Pith review of Detection of Distributed Denial of Service Attacks based on Machine Learning Algorithms." pith.science (2026). https://pith.science/paper/J6LLEHQD
@misc{pith2026250200975,
author = {Pith},
title = {Pith review of: Detection of Distributed Denial of Service Attacks based on Machine Learning Algorithms},
year = {2026},
howpublished = {\url{https://pith.science/paper/J6LLEHQD}},
note = {Machine review of arXiv:2502.00975}
}
read the original abstract
Distributed Denial of Service (DDoS) attacks make the challenges to provide the services of the data resources to the web clients. In this paper, we concern to study and apply different Machine Learning (ML) techniques to separate the DDoS attack instances from benign instances. Our experimental results show that forward and backward data bytes of our dataset are observed more similar for DDoS attacks compared to the data bytes for benign attempts. This paper uses different machine learning techniques for the detection of the attacks efficiently in order to make sure the offered services from web servers available. This results from the proposed approach suggest that 97.1% of DDoS attacks are successfully detected by the Support Vector Machine (SVM). These accuracies are better while comparing to the several existing machine learning approaches.
Figures
Reference graph
Works this paper leans on
-
[27]
A. Mellor, A. Haywood, C. Stone, and S. Jones, “The performance of random forests in an operational setting for large area sclerophyll forest classification,” *Remote Sensing*, vol. 5, no. 6, pp. 2838–2856, 2013. Available: https://doi.org/10.3390/rs5062838, last visited 1/3/2025
-
[24]
SVM based scheme for predicting number of zombies in a DDoS attack,
P. K. Agrawal, B. B. Gupta, and S. Jain, “SVM based scheme for predicting number of zombies in a DDoS attack,” *2011 European Intelligence and Security Informatics Conference*, Athens, pp. 178- 182, 2011. Available: https://doi.org/10.1109/EISIC.2011.19, last visited 1/3/2025
-
[1]
Constructing detection knowledge for DDoS intrusion tolerance,
S. C. Lin and S. S. Tseng, “Constructing detection knowledge for DDoS intrusion tolerance,” *Expert Systems with Applications*, vol. 27, no. 3, pp. 379-390, 2004. Available: https://doi.org/10.1016/j.eswa.2004.05.016, last visited 1/3/2025
-
[2]
Worldwide infrastructure security report,
D. Anstee, D. Bussiere, G. Sockrider, and C. Morales, “Worldwide infrastructure security report,” Arbor Networks, Burlington, MA, USA, Tech. Rep 9, 2014. Available: N/A, last visited 1/3/2025
work page 2014
-
[3]
The dark menace: Characterizing network-based attacks in the cloud,
R. Miao, R. Potharaju, M. Yu, and N. Jain, “The dark menace: Characterizing network-based attacks in the cloud,” *Proceedings of the ACM Conference on Internet Measurement Conference*, pp. 169-182,
-
[4]
On networking of In- ternet of Things: Explorations and challenges,
H. Ma, L. Liu, A. Zhou, and D. Zhao, “On networking of In- ternet of Things: Explorations and challenges,” *IEEE Internet of Things Journal*, vol. 3, no. 4, pp. 441-452, Aug. 2016. Available: https://doi.org/10.1109/JIOT.2015.2493082, last visited 1/3/2025
-
[5]
Risks of automation: A cautionary total-system per- spective of our cyber future,
P. G. Neumann, “Risks of automation: A cautionary total-system per- spective of our cyber future,” *Communications of the ACM*, vol. 59, no. 10, pp. 26-30, Oct. 2016. Available: https://doi.org/10.1145/2988445, last visited 1/3/2025
-
[6]
Knowledge aware proactive nodes selection approach for en- ergy management in Internet of Things,
X. Liu, S. Zhao, A. Liu, N. Xiong, and A. V . Vasilakos, “Knowledge aware proactive nodes selection approach for en- ergy management in Internet of Things,” *Future Generation Computer Systems*, vol. 92, pp. 1142-1156, 2019. Available: https://doi.org/10.1016/j.future.2017.07.022, last visited 1/3/2025
Show all 32 references
-
[7]
Context- aware collect data with energy efficient in cyber physical cloud sys- tems,
Y . Liu, A. Liu, S. Guo, Z. Li, Y .-J. Choi, and H. Sekiya, “Context- aware collect data with energy efficient in cyber physical cloud sys- tems,” *Future Generation Computer Systems*, vol. 105, pp. 932-947,
-
[8]
DDoS detec- tion and analysis in SDN-based environment using support vec- tor machine classifier,
R. T. Kokila, S. T. Selvi, and K. Govindarajan, “DDoS detec- tion and analysis in SDN-based environment using support vec- tor machine classifier,” *2014 IEEE Sixth International Conference on Advanced Computing (ICoAC)*, pp. 205-210, 2014. Available: https://doi.org/10.1109/I...
2014
-
[9]
A feasible method to combat against DDoS attack in SDN network,
N.-N. Dao, J. Park, M. Park, and S. Cho, “A feasible method to combat against DDoS attack in SDN network,” *2015 IEEE Inter- national Conference on Information Networking (ICOIN)*, pp. 309- 311, 2015. Available: https://doi.org/10.1109/ICOIN.2015.7057902, last visited 1/3/2025
2015
-
[10]
SDN-based architecture for IoT and improvement of the security,
O. Flauzac, C. Gonzalez, A. Hachani, and F. Nolot, “SDN-based architecture for IoT and improvement of the security,” *2015 IEEE 29th International Conference on Advanced Information Network- ing and Applications Workshops*, pp. 688-693, 2015. Available: https://doi.org/10.1109...
2015 doi
-
[11]
Securing SDN infrastruc- ture of IoT–fog networks from MitM attacks,
C. Li, Z. Qin, E. Novak, and Q. Li, “Securing SDN infrastruc- ture of IoT–fog networks from MitM attacks,” *IEEE Internet of Things Journal*, vol. 4, no. 5, pp. 1156-1164, 2017. Available: https://doi.org/10.1109/JIOT.2017.2685596, last visited 1/3/2025
2017
-
[12]
DDoS attack mitigation in Inter- net of Things using software-defined networking,
M. E. Ahmed and H. Kim, “DDoS attack mitigation in Inter- net of Things using software-defined networking,” *2017 IEEE Third International Conference on Big Data Computing Service and Applications (BigDataService)*, pp. 271-276, 2017. Available: https://doi.org/10.1109/BigData...
2017 doi
-
[13]
Robust Support Vector Machines for Anomaly Detection in Computer Security,
W. Hu, Wenjie, Y . Liao, and V . R. Vemuri, “Robust Support Vector Machines for Anomaly Detection in Computer Security,” *In ICMLA*, pp. 168-174, 2003. Available: N/A, last visited 1/3/2025
2003
-
[14]
DDoS resilient scheduling to counter application layer attacks un- der imperfect detection,
S. Ranjan, R. Swaminathan, M. Uysal, and E. W. Knightly, “DDoS resilient scheduling to counter application layer attacks un- der imperfect detection,” *In INFOCOM, Citeseer*, 2006. Available: https://doi.org/10.1109/INFOCOM.2006.127, last visited 1/3/2025
2006 doi
-
[15]
Available: http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q1- 2015.pdf, last visited 1/3/2025
McAfee Lab Threat Report. Available: http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q1- 2015.pdf, last visited 1/3/2025
2015
-
[16]
(2003, March)
Noh, S., Lee, C., Choi, K., & Jung, G. (2003, March). Detecting distributed denial of service (ddos) attacks through inductive learning. In International Conference on Intelligent Data Engineering and Automated Learning (pp. 286-295). Berlin, Heidelberg: Springer Berlin Heidelberg
2003
-
[17]
A hybrid machine learning approach to network anomaly detection,
T. Shon and J. Moon, “A hybrid machine learning approach to network anomaly detection,” *Information Sciences*, vol. 177, no. 18, pp. 3799-3821, 2007. Available: https://doi.org/10.1016/j.ins.2007.03.025, last visited 1/3/2025
2007 doi
-
[18]
Naive Bayes vs Decision Trees in Intrusion Detection Systems,
N. B. Amor, S. Benferhat, and Z. Elouedi, “Naive Bayes vs Decision Trees in Intrusion Detection Systems,” *Proceedings of the 2004 ACM Symposium on Applied Computing*, ACM, pp. 420-424, 2004. Avail- able: https://doi.org/10.1145/967900.967989, last visited 1/3/2025
2004
-
[19]
Attacking DDoS at the source,
J. Mirkovic, G. Prier, and P. Reiher, “Attacking DDoS at the source,” *10th IEEE International Conference on Network Protocols*, pp. 312- 321, 2002. Available: https://doi.org/10.1109/ICNP.2002.1181418, last visited 1/3/2025
2002 arXiv
-
[20]
Source-end DDoS defense,
“Source-end DDoS defense,” *Second IEEE International Symposium on Network Computing and Applications*, pp. 171-178, 2003. Avail- able: https://doi.org/10.1109/NCA.2003.1201153, last visited 1/3/2025
2003 arXiv
-
[21]
Available: https://medium.com/app- affairs/9-applications-of-machine-learning-from-day-to-day-life- 112a47a429d0, last visited 1/3/2025
Application of Machine Learning. Available: https://medium.com/app- affairs/9-applications-of-machine-learning-from-day-to-day-life- 112a47a429d0, last visited 1/3/2025
2025
-
[22]
Machine learning algorithms: A review,
A. Dey, “Machine learning algorithms: A review,” *International Journal of Computer Science and Information Technologies*, vol. 7, no. 3, pp. 1174–1179, 2016. Available: https://doi.org/10.21275/ART20203995, last visited 1/3/2025
2016 doi
-
[23]
Available: https://machinelearningmastery.com/logistic- regression-for-machine-learning/, last visited 1/3/2025
Logistic Regression. Available: https://machinelearningmastery.com/logistic- regression-for-machine-learning/, last visited 1/3/2025
2025
-
[25]
Detecting DDoS attacks using machine learning techniques and contemporary intrusion detection dataset,
N. Bindra and M. Sood, “Detecting DDoS attacks using machine learning techniques and contemporary intrusion detection dataset,” *Au- tomatic Control and Computer Sciences*, vol. 53, no. 5, pp. 419- 428, 2019. Available: https://doi.org/10.3103/S0146411619050043, last visited 1/3/2025
2019 doi
-
[26]
Improving classification accuracy based on random forest model with uncorrelated high perform- ing trees,
S. Bharathidason and C. J. Venkataeswaran, “Improving classification accuracy based on random forest model with uncorrelated high perform- ing trees,” *International Journal of Computer Applications*, vol. 101, no. 13, pp. 26-30, 2014. Available: https://doi.org/10.5120/17749-...
2014 doi
-
[28]
Evalua- tion of machine learning algorithms for intrusion detection sys- tem,
M. Almseidin, S. Alzubi, and K. M. Alkasassbeh, “Evalua- tion of machine learning algorithms for intrusion detection sys- tem,” *2017 IEEE 15th International Symposium on Intelligent Systems and Informatics (SISY)*, pp. 277-282, 2017. Available: https://doi.org/10.1109/SISY .2...
2017
-
[29]
HTTP flood attack detection in application layer using machine learning metrics and bio-inspired bat algorithm,
I. Sreeram and V . P. K. Vuppala, “HTTP flood attack detection in application layer using machine learning metrics and bio-inspired bat algorithm,” *Applied Computing and Informatics*, vol. 15, no. 1, pp. 59-66, 2019. Available: https://doi.org/10.1016/j.aci.2017.10.003, last ...
2019 doi
-
[30]
An investigation on intrusion detection system using machine learning,
R. Patgiri, U. Varshney, T. Akutota, and R. Kunde, “An investigation on intrusion detection system using machine learning,” *2018 IEEE Symposium Series on Computational Intelligence (SSCI)*, pp. 1684- 1691, 2018. Available: https://doi.org/10.1109/SSCI.2018.8628676, last visit...
2018
-
[2015]
Available: https://doi.org/10.1145/2815675.2815707, last visited 1/3/2025
2025
-
[2020]
Available: https://doi.org/10.1016/j.future.2017.05.029, last visited 1/3/2025
2017 doi
Reviewed August 9, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.