A Distributed Denial of Service (DDoS) attack floods a target system, server, or network with massive traffic from numerous sources, overwhelming it and disrupting normal functionality. Such attacks often leverage botnets—large groups of compromised devices—that generate malicious traffic at scale, making detection increasingly complex. This results in service unavailability for legitimate users, causing downtime, damage, or the exploitation of weaknesses. Existing models face challenges, including overfitting to training data, which limits their ability to generalize, and underfitting, which leads to missing critical attack patterns. Moreover, conventional detection methods struggle to adapt when attackers continuously evolve their strategies, leading to reduced robustness in real-world deployment. To overcome these challenges, this research paper presents an Adaptive Hierarchical Density-Based Spatial Clustering of Applications With Noise Approach (Ada- HDBSCAN) for detecting DDoS attacks using clustering. The process begins by simulating a cloud model and collecting input log data from the NSL-KDD dataset. Feature selection is performed using Gini Impurity-based Weighted Random Forest (GIWRF) and Sequential Forward Search (SFS) techniques to identify the most relevant features from the input data. This hybrid feature selection strategy ensures that redundant or noisy attributes are removed, thereby improving both efficiency and accuracy. Subsequently, clustering-based detection is carried out using Ada-HDBSCAN, which classifies the data as either DDoS-affected or normal. Ada-HDBSCAN is an innovative approach developed by adaptively modifying the clustering parameters of Hierarchical Density-Based Spatial Clustering of Applications With Noise (HDBSCAN). The developed Ada- HDBSCAN method achieved an Adjusted Rand Index (ARI) of 0.966, a V-measure of 0.959, and a Silhouette score of 0.978, respectively.
Buy article PDF