Comparative Evaluation of Machine Learning Models with Different Data Balancing Techniques for DDoS Attack Detection

Comparative Evaluation of Machine Learning Models with Different Data Balancing Techniques for DDoS Attack Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Comparative Evaluation of Machine Learning Models with Different Data Balancing Techniques for DDoS Attack Detection Dipok Deb, Hansapani Rodrigo, Sanjeev Kumar This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8888642/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 4 You are reading this latest preprint version Abstract This study investigates and compares the efficacy of Machine Learning models for the detection of TCP SYN-based Distributed Denial of Service (DDoS) attacks, utilizing the CIC-DDoS 2019 and CIC-IoT 2023 datasets. To address the inherent data imbalance in the dataset, several balancing techniques, such as Synthetic Minority Oversampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN), Synthetic Minority Oversampling Technique (SMOTE) with Tomek Links (SMOTE-TomekLink), and Synthetic Minority Oversampling Technique (SMOTE) and Edited Nearest Neighbors (SMOTE-ENN), have been applied to enhance model performance. For Machine learning, Random Forest, Naive Bayes, and Logistic Regression models were evaluated using various metrics such as accuracy, precision, recall, F1 score, balanced accuracy, ROC-AUC, and detection time. The detection performance of each model is optimized by varying the classification cutoff threshold. Furthermore, unlike other works in the literature, we utilized two different datasets for training and testing to show the robustness of our machine learning models. For training, we utilized the CIC-DDoS-2019 dataset, and to test, we used the CIC-IoT-2023 dataset. This study highlights the critical role of data balancing in improving detection capabilities. It was observed that Logistic Regression with the balancing techniques SMOTE consistently demonstrated superior performance compared with tree-based models and probabilistic models. Our tuning of cutoff values for optimization of these models revealed the trade-offs inherent in precision-recall dynamics and further improved the models' performance. Moreover, our study in this paper offers practical insights into enhancing the performance of intrusion detection systems by integrating balancing techniques and optimizing thresholds, thus paving the way for more robust cybersecurity frameworks. Physical sciences/Engineering Physical sciences/Mathematics and computing DDoS Attack TCP SYN Attack Attack Detection Data Balancing Machine Learning Cutoff Optimization Cybersecurity Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 18 Feb, 2026 Editor assigned by journal 16 Feb, 2026 Submission checks completed at journal 16 Feb, 2026 First submitted to journal 15 Feb, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8888642","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":592495863,"identity":"502d2763-da42-4cc3-a906-6b0419e9becf","order_by":0,"name":"Dipok Deb","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAx0lEQVRIiWNgGAWjYDCCwwwMjA0MzAwG7A0MDBVgDtFaeA4wMJwhSssBmBaJBCK18B3nPfhwBoO1nLnkG8MPBxhsZDccIKBF8jBfsuEGhnRjy9k5xhIHGNKMCWoxOMxjJvmA4XDihts5ZswfQAxitdRvuHnGDOix/0Rq2cBwOMHgBg9IywHCWsB+mWGQbrizJ61Y4oBBsvFMQlr4zp89+LCnwlrenP3wxg8HKuxk+whpYWDgATkP7k6CymFaRsEoGAWjYBTgAwDsLEYdmsrqbwAAAABJRU5ErkJggg==","orcid":"","institution":"University of Central Florida","correspondingAuthor":true,"prefix":"","firstName":"Dipok","middleName":"","lastName":"Deb","suffix":""},{"id":592495864,"identity":"9a7e8bb5-a056-4d25-aefc-e3c86e55634a","order_by":1,"name":"Hansapani Rodrigo","email":"","orcid":"","institution":"The University of Texas Rio Grande Valley","correspondingAuthor":false,"prefix":"","firstName":"Hansapani","middleName":"","lastName":"Rodrigo","suffix":""},{"id":592495865,"identity":"2558bb44-7b25-4a95-a5ae-4b446744f3b3","order_by":2,"name":"Sanjeev Kumar","email":"","orcid":"","institution":"The University of Texas Rio Grande Valley","correspondingAuthor":false,"prefix":"","firstName":"Sanjeev","middleName":"","lastName":"Kumar","suffix":""}],"badges":[],"createdAt":"2026-02-15 22:24:09","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8888642/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8888642/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":102964493,"identity":"8eba9cad-f961-4831-b517-538a82976e54","added_by":"auto","created_at":"2026-02-19 04:22:30","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":732682,"visible":true,"origin":"","legend":"","description":"","filename":"ManuscriptLatexfile.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8888642/v1_covered_84511698-aacf-4aa5-99c8-15f7b14ec6de.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Comparative Evaluation of Machine Learning Models with Different Data Balancing Techniques for DDoS Attack Detection","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"DDoS Attack, TCP SYN Attack, Attack Detection, Data Balancing, Machine Learning, Cutoff Optimization, Cybersecurity","lastPublishedDoi":"10.21203/rs.3.rs-8888642/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8888642/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eThis study investigates and compares the efficacy of Machine Learning models for the detection of TCP SYN-based Distributed Denial of Service (DDoS) attacks, utilizing the CIC-DDoS 2019 and CIC-IoT 2023 datasets. To address the inherent data imbalance in the dataset, several balancing techniques, such as Synthetic Minority Oversampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN), Synthetic Minority Oversampling Technique (SMOTE) with Tomek Links (SMOTE-TomekLink), and Synthetic Minority Oversampling Technique (SMOTE) and Edited Nearest Neighbors (SMOTE-ENN), have been applied to enhance model performance. For Machine learning, Random Forest, Naive Bayes, and Logistic Regression models were evaluated using various metrics such as accuracy, precision, recall, F1 score, balanced accuracy, ROC-AUC, and detection time. The detection performance of each model is optimized by varying the classification cutoff threshold. Furthermore, unlike other works in the literature, we utilized two different datasets for training and testing to show the robustness of our machine learning models. For training, we utilized the CIC-DDoS-2019 dataset, and to test, we used the CIC-IoT-2023 dataset. This study highlights the critical role of data balancing in improving detection capabilities. It was observed that Logistic Regression with the balancing techniques SMOTE consistently demonstrated superior performance compared with tree-based models and probabilistic models. Our tuning of cutoff values for optimization of these models revealed the trade-offs inherent in precision-recall dynamics and further improved the models' performance. Moreover, our study in this paper offers practical insights into enhancing the performance of intrusion detection systems by integrating balancing techniques and optimizing thresholds, thus paving the way for more robust cybersecurity frameworks.\u003c/p\u003e","manuscriptTitle":"Comparative Evaluation of Machine Learning Models with Different Data Balancing Techniques for DDoS Attack Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-02-18 05:11:15","doi":"10.21203/rs.3.rs-8888642/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-02-18T09:35:48+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-02-17T04:52:15+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-02-17T04:50:54+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2026-02-15T22:13:51+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"0b6919d0-457e-469a-bc57-38543d31ea60","owner":[],"postedDate":"February 18th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[{"id":63043584,"name":"Physical sciences/Engineering"},{"id":63043585,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-03-01T10:08:03+00:00","versionOfRecord":[],"versionCreatedAt":"2026-02-18 05:11:15","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8888642","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8888642","identity":"rs-8888642","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}