Machine Learning-Based DDoS Detection Using Variational Mode Decomposition

Machine Learning-Based DDoS Detection Using Variational Mode Decomposition | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Machine Learning-Based DDoS Detection Using Variational Mode Decomposition Lu Jing, Tian Yizhun, Jia Ruchun This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-6905437/v1 This work is licensed under a CC BY 4.0 License Status: Under Revision Version 1 posted 9 You are reading this latest preprint version Abstract With the rapid advancement of informatization and digitization, Distributed Denial-of-Service (DDoS) attacks have exhibited escalating scales and frequencies. The high-dimensional, dynamic, and non-stationary characteristics of network traffic data pose significant challenges to traditional feature optimization methods. This study investigates a strategic framework integrating Variational Mode Decomposition (VMD) with Random Forest Feature Importance (RFFI) and Pearson correlation coefficients for DDoS attack detection, aiming to explore its potential in optimizing network intrusion datasets. Experimental evaluations using common machine learning models demonstrate that the VMD-based framework enhances detection accuracy, achieving approximately 7% performance gain across optimal model configurations. Notably, the K-Nearest Neighbors (KNN) method attained the highest detection accuracy of 99.55%. These findings preliminarily validate the effectiveness of the VMD-based framework in processing non-stationary network data. Cybersecurity DDos detection Variational mode decomposition machine learning Intrision detection Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Revision Version 1 posted Editorial decision: Revision requested 04 Mar, 2026 Reviews received at journal 18 Nov, 2025 Reviewers agreed at journal 13 Nov, 2025 Reviews received at journal 08 Aug, 2025 Reviewers agreed at journal 06 Aug, 2025 Reviewers invited by journal 25 Jun, 2025 Editor assigned by journal 17 Jun, 2025 Submission checks completed at journal 16 Jun, 2025 First submitted to journal 16 Jun, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-6905437","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":477220799,"identity":"f7faf2c3-7557-4afd-a8b2-865fb75c9b54","order_by":0,"name":"Lu Jing","email":"","orcid":"","institution":"Civil Aviation Flight University of China","correspondingAuthor":false,"prefix":"","firstName":"Lu","middleName":"","lastName":"Jing","suffix":""},{"id":477220804,"identity":"f7227c0c-0d11-4176-b3d8-11df3a9dfada","order_by":1,"name":"Tian Yizhun","email":"","orcid":"","institution":"Civil Aviation Flight University of China","correspondingAuthor":false,"prefix":"","firstName":"Tian","middleName":"","lastName":"Yizhun","suffix":""},{"id":477220805,"identity":"78eb16dd-cfbe-4377-be08-174eb7ccd360","order_by":2,"name":"Jia Ruchun","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA7klEQVRIiWNgGAWjYBACxmYwdYCBgb0BISpBnBaeA4xwTXi1QAFQi0QCkVqY25mffeapuZO4XfL588c8DHXyBgeYD97mYbDLw+0wNuPZPMeeJe6cnWPYzMNw2HDDAbZkax6G5GI8fjFm5m04nLjhdg4jUMuBBIMDPGbSQEZiA04t7J8hWm4efwjUUgfUwv+NgBYeqC03GEAOYwbZwkZISzHjnGOHjTecyTGcOcfgsOHMw2zGlnMMknFqMew/vpnhTc1h2Q3Hjz/48KaiTp7vePPDG28q7HBrQZUwAGJmGAMHkMctNQpGwSgYBaMACgCSS1VeiyyMKQAAAABJRU5ErkJggg==","orcid":"","institution":"Sichuan University","correspondingAuthor":true,"prefix":"","firstName":"Jia","middleName":"","lastName":"Ruchun","suffix":""}],"badges":[],"createdAt":"2025-06-16 12:08:33","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-6905437/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-6905437/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":85685753,"identity":"bbee6660-5b85-4cb2-90c1-f7aa71deb0a3","added_by":"auto","created_at":"2025-06-30 15:55:36","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1128195,"visible":true,"origin":"","legend":"","description":"","filename":"ArticleTitle.pdf","url":"https://assets-eu.researchsquare.com/files/rs-6905437/v1_covered_8cce9cbd-8098-48e7-9c5d-4177df6e9af6.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Machine Learning-Based DDoS Detection Using Variational Mode Decomposition","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"cluster-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Cluster Computing](https://www.springer.com/journal/10586)","snPcode":"10586","submissionUrl":"https://submission.nature.com/new-submission/10586/3","title":"Cluster Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Cybersecurity, DDos detection, Variational mode decomposition, machine learning, Intrision detection","lastPublishedDoi":"10.21203/rs.3.rs-6905437/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-6905437/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eWith the rapid advancement of informatization and digitization, Distributed Denial-of-Service (DDoS) attacks have exhibited escalating scales and frequencies. The high-dimensional, dynamic, and non-stationary characteristics of network traffic data pose significant challenges to traditional feature optimization methods. This study investigates a strategic framework integrating Variational Mode Decomposition (VMD) with Random Forest Feature Importance (RFFI) and Pearson correlation coefficients for DDoS attack detection, aiming to explore its potential in optimizing network intrusion datasets. Experimental evaluations using common machine learning models demonstrate that the VMD-based framework enhances detection accuracy, achieving approximately 7% performance gain across optimal model configurations. Notably, the K-Nearest Neighbors (KNN) method attained the highest detection accuracy of 99.55%. These findings preliminarily validate the effectiveness of the VMD-based framework in processing non-stationary network data.\u003c/p\u003e","manuscriptTitle":"Machine Learning-Based DDoS Detection Using Variational Mode Decomposition","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-06-30 15:31:31","doi":"10.21203/rs.3.rs-6905437/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-03-05T00:56:34+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-18T08:41:52+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"283529858677291297289008569960215173560","date":"2025-11-13T06:37:10+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-08-08T09:19:42+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"68168583909054104455230277102764855245","date":"2025-08-06T04:47:41+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-06-25T06:16:01+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-06-17T06:26:10+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-06-17T01:26:24+00:00","index":"","fulltext":""},{"type":"submitted","content":"Cluster Computing","date":"2025-06-16T12:04:43+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"cluster-computing","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"","sideBox":"Learn more about [Cluster Computing](https://www.springer.com/journal/10586)","snPcode":"10586","submissionUrl":"https://submission.nature.com/new-submission/10586/3","title":"Cluster Computing","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"1165fdb0-4157-4998-9302-8cbac0291210","owner":[],"postedDate":"June 30th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"in-revision","subjectAreas":[],"tags":[],"updatedAt":"2026-03-05T01:09:11+00:00","versionOfRecord":[],"versionCreatedAt":"2025-06-30 15:31:31","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-6905437","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-6905437","identity":"rs-6905437","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}