# Enhancing ML-Based DoS Attack Detection Through Combinatorial Fusion Analysis

**Authors:** Evans Owusu, Mohamed Rahouti, D. Frank Hsu, Kaiqi Xiong, Yufeng Xin  
**arXiv:** [2312.00006](https://arxiv.org/abs/2312.00006)  
**Date:** 2023-10-02  
**Summary page:** https://www.summarizepaper.com/en/paper/2312.00006v1/

## Key points

- Study focuses on mitigating Denial-of-Service (DoS) attacks
- Machine learning (ML) models commonly used for DoS attack detection
- Researchers propose combinatorial fusion method to enhance ML model performance
- Methodology involves considering score and rank functions for each model
- Various metrics applied to factor in diversity strength or performance of scoring systems
- 2-model combination approach employed to fuse six models by pairing them two at a time
- LYCOS-IDS2017 dataset utilized for evaluation, consisting of five days' worth of network flow entries with 83 features
- Training set (75%) and test set (25%) used for training and assessment of ML models
- Prediction probabilities generated by each model collected, highest probability selected as final prediction
- Probabilities and confidence scores play vital role in ML models, assisting in post-processing tasks such as thresholding, ranking, and model fusion
- Different combinatorial fusion metrics explored to combine scores across multiple models
- Conventional ensemble methods used for performance evaluation
- Detailed methodology presented for enhancing DoS attack detection through combinatorial fusion of multiple ML models.

## Summary

This study focuses on mitigating Denial-of-Service (DoS) attacks, which are crucial for ensuring the security and availability of online services. While machine learning (ML) models are commonly used for DoS attack detection, there is a need to enhance their performance. To address this, the researchers propose an innovative method called combinatorial fusion, which combines multiple ML models using advanced algorithms. The methodology utilized in this study involves considering both the score and rank functions for each model, known as scoring systems. Various metrics such as average score combination, average rank combination, and weighted combination are applied to factor in the diversity strength or performance of each scoring system. Additionally, a 2-model combination approach is employed to fuse six models by pairing them two at a time. To evaluate the effectiveness of the proposed fusion approach, the researchers utilize the LYCOS-IDS2017 dataset created through the LycoSTand flow extractor. This dataset consists of five days' worth of network flow entries with 83 features in total. The data is split into a training set (75%) and a test set (25%). The six ML models are trained on the training data and their performance is assessed on unseen data from the test dataset. The prediction probabilities generated by each model across different classes are collected. The class with the highest probability is selected as the final prediction for each data entry. These probabilities serve as scores for each individual data entry and form a new dataset along with the original data items. The researchers emphasize that probabilities and confidence scores play a vital role in ML models, providing insight into prediction likelihood and confidence for each label. They assist in post-processing tasks such as thresholding, ranking, and model fusion. By exploring different combinatorial fusion metrics to combine these scores across multiple models, they aim to identify an optimal approach for developing an effective combined model. In terms of performance evaluation, conventional ensemble methods such as voting-based ensembles and collective confidence are employed to combine the multiple ML classification models. Specific metrics are used to evaluate their performance. Overall, this study presents a detailed methodology for enhancing DoS attack detection through combinatorial fusion of multiple ML models.