DDoS Attack Detection with LightGBM in DART Mode: Benchmarking GridSearchCV Against Optuna Hyperparameter Tuning
DOI:
https://doi.org/10.5281/zenodo.24011828Keywords:
DDoS detection, LightGBM, DART, hyperparameter tuning, Optuna, GridSearchCV, CIC-DDoS2019Abstract
Distributed Denial of Service (DDoS) attacks continue to threaten servers, websites, and critical infrastructure, with SYN flood remaining one of the most common attack types. Manual detection through firewall rules is slow, non-adaptive to new patterns, and dependent on scarce security expertise. This paper presents a machine learning approach that classifies network traffic as benign or SYN flood attack using LightGBM in DART boosting mode, and benchmarks two hyperparameter tuning strategies: GridSearchCV and Optuna. Experiments use the CIC-DDoS2019 dataset, specifically the SYN flood training subset of 3,517 samples with 37.3% benign and 62.7% attack traffic. Preprocessing removes identity columns that cause data leakage, handles infinite values, encodes labels, and keeps numeric features, while class imbalance is addressed with balanced class weights. The model is evaluated with stratified 5-fold cross-validation using precision, recall, F1-score, and F1-macro. GridSearchCV exhaustively tests 4 discrete combinations of max_depth and num_leaves, while Optuna explores a wider continuous space over 8 trials with Bayesian TPE, keeping the learning rate fixed at 0.1 for a fair comparison. GridSearchCV achieves an F1-macro of 0.9912 in 38.44 seconds, while Optuna achieves 0.9909 in 30.15 seconds, making Optuna approximately 21% faster with a negligible F1 difference of 0.0003. Confusion matrices show near-perfect detection with only 29 false negatives in both models, and feature importance analysis identifies packet size, flow duration, and inter-arrival time as the key discriminating signals. The main contribution is empirical evidence that Bayesian hyperparameter optimization matches exhaustive grid search quality while substantially reducing tuning time for intrusion detection models.
References
[1] S. T. Zargar, J. Joshi, and D. Tipper, "A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks," IEEE Commun. Surv. Tutorials, vol. 15, no. 4, pp. 2046-2069, Fourth Quarter 2013. DOI: 10.1109/SURV.2013.031413.00127
[2] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, "Survey of Intrusion Detection Systems: Techniques, Datasets and Challenges," Cybersecurity, vol. 2, no. 1, p. 20, 2019. DOI: 10.1186/s42400-019-0038-7
[3] I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, "Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy," in Proc. IEEE 53rd Int. Carnahan Conf. Security Technology, Chennai, India, 2019. DOI: 10.1109/CCST.2019.8888419
[4] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization," in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), Funchal, Madeira, Portugal, 2018, pp. 108-116. DOI: 10.5220/0006639801080116
[5] M. S. Elsayed, N.-A. Le-Khac, S. Dev, and A. D. Jurcut, "DDoSNet: A Deep-Learning Model for Detecting Network Attacks," in Proc. IEEE 21st Int. Symp. "A World of Wireless, Mobile and Multimedia Networks" (WoWMoM), Cork, Ireland, 2020, pp. 391-396. DOI: 10.1109/WoWMoM49955.2020.00072
[6] R. Doriguzzi-Corin, S. Millar, S. Scott-Hayward, J. Martinez-del-Rincon, and D. Siracusa, "LUCID: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection," IEEE Trans. Netw. Service Manag., vol. 17, no. 2, pp. 876-889, Jun. 2020. DOI: 10.1109/TNSM.2020.2971776
[7] S. Haider, A. Akhunzada, I. Mustafa, T. B. Patel, A. Fernandez, K.-K. R. Choo, and J. Iqbal, "A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks," IEEE Access, vol. 8, pp. 53972-53983, 2020. DOI: 10.1109/ACCESS.2020.2976908
[8] I. Ahmad, M. Basheri, M. J. Iqbal, and A. Rahim, "Performance Comparison of Support Vector Machine, Random Forest, and Extreme Learning Machine for Intrusion Detection," IEEE Access, vol. 6, pp. 33789-33795, 2018. DOI: 10.1109/ACCESS.2018.2841987
[9] Z. Chen, F. Jiang, Y. Cheng, X. Gu, W. Liu, and J. Peng, "XGBoost Classifier for DDoS Attack Detection and Analysis in SDN-Based Cloud," in Proc. 2018 IEEE Int. Conf. Big Data and Smart Computing (BigComp), Shanghai, China, 2018, pp. 251-256. DOI: 10.1109/BigComp.2018.00044
[10] S. S. Dhaliwal, A.-A. Nahid, and R. Abbas, "Effective Intrusion Detection System Using XGBoost," Information, vol. 9, no. 7, p. 149, 2018. DOI: 10.3390/info9070149
[11] L. Prokhorenkova, G. Gusev, A. Vorobev, A. V. Dorogush, and A. Gulin, "CatBoost: Unbiased Boosting with Categorical Features," in Proc. 32nd Conf. Neural Information Processing Systems (NeurIPS), Montréal, QC, Canada, 2018, pp. 6638-6648.
[12] Y. Zhang and Z. Wang, "Feature Engineering and Model Optimization Based Classification Method for Network Intrusion Detection," Appl. Sci., vol. 13, no. 16, p. 9363, 2023. DOI: 10.3390/app13169363
[13] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, "LightGBM: A Highly Efficient Gradient Boosting Decision Tree," in Proc. 31st Conf. Neural Information Processing Systems (NeurIPS), Long Beach, CA, USA, 2017, pp. 3146-3154.
[14] K. V. Rashmi and R. Gilad-Bachrach, "DART: Dropouts meet Multiple Additive Regression Trees," in Proc. 18th Int. Conf. Artificial Intelligence and Statistics (AISTATS), ser. Proceedings of Machine Learning Research, vol. 38, San Diego, CA, USA, 2015, pp. 489-497.
[15] J. Bergstra and Y. Bengio, "Random Search for Hyper-parameter Optimization," J. Mach. Learn. Res., vol. 13, pp. 281-305, 2012.
[16] J. Snoek, H. Larochelle, and R. P. Adams, "Practical Bayesian Optimization of Machine Learning Algorithms," in Proc. 26th Annu. Conf. Neural Information Processing Systems (NIPS 2012), Lake Tahoe, NV, USA, 2012, pp. 2960-2968.
[17] J. Bergstra, R. Bardenet, Y. Bengio, and B. Kegl, "Algorithms for Hyper-parameter Optimization," in Proc. 25th Annu. Conf. Neural Information Processing Systems (NIPS 2011), Granada, Spain, 2011, pp. 2546-2554.
[18] T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, "Optuna: A Next-generation Hyperparameter Optimization Framework," in Proc. 25th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining (KDD '19), Anchorage, AK, USA, 2019, pp. 2623-2631. DOI: 10.1145/3292500.3330701
[19] C. X. Ling and V. S. Sheng, "Cost-Sensitive Learning and the Class Imbalance Problem," in Encyclopedia of Machine Learning, C. Sammut and G. I. Webb, Eds. Boston, MA: Springer, 2011, pp. 231-235.
[20] R. Kohavi, "A Study of Cross-Validation and Bootstrap for Accuracy Estimation and Model Selection," in Proc. 14th Int. Joint Conf. Artif. Intell. (IJCAI), Montreal, QC, Canada, 1995, pp. 1137-1143.
[21] J. Davis and M. Goadrich, "The Relationship Between Precision-Recall and ROC Curves," in Proc. 23rd Int. Conf. Mach. Learn. (ICML), Pittsburgh, PA, USA, 2006, pp. 233-240. DOI: 10.1145/1143844.1143874
[22] T. Saito and M. Rehmsmeier, "The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets," PLoS ONE, vol. 10, no. 3, e0118432, 2015. DOI: 10.1371/journal.pone.0118432
[23] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, "SMOTE: Synthetic Minority Over-sampling Technique," J. Artif. Intell. Res., vol. 16, pp. 321-357, 2002. DOI: 10.1613/jair.953
[24] S. M. H. Mirsadeghi, H. Bahsi, R. Vaarandi, and W. Inoubli, "Learning From Few Cyber-Attacks: Addressing the Class Imbalance Problem in Machine Learning-Based Intrusion Detection in Software-Defined Networking," IEEE Access, vol. 11, pp. 140428-140442, 2023. DOI: 10.1109/ACCESS.2023.3341755
[25] T. Chen and C. Guestrin, "XGBoost: A Scalable Tree Boosting System," in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining (KDD '16), San Francisco, CA, USA, 2016, pp. 785-794. DOI: 10.1145/2939672.2939785
[26] L. Breiman, "Random Forests," Mach. Learn., vol. 45, no. 1, pp. 5-32, 2001. DOI: 10.1023/A:1010933404324
[27] M. C. Belavagi and B. Muniyal, "Performance Evaluation of Supervised Machine Learning Algorithms for Intrusion Detection," Procedia Comput. Sci., vol. 89, pp. 117-123, 2016. DOI: 10.1016/j.procs.2016.06.016
[28] X. Ma and W. Shi, "AESMOTE: Adversarial Reinforcement Learning With SMOTE for Anomaly Detection," IEEE Trans. Netw. Sci. Eng., vol. 8, no. 2, pp. 943-956, 2021. DOI: 10.1109/TNSE.2020.3004312
[29] R. Abdulhammed, M. Faezipour, A. Abuzneid, and A. Abumallouh, "Deep and Machine Learning Approaches for Anomaly-Based Intrusion Detection of Imbalanced Network Traffic," IEEE Sensors Lett., vol. 3, no. 1, pp. 1-4, 2019. DOI: 10.1109/LSENS.2018.2879990
[30] B. W. Matthews, "Comparison of the Predicted and Observed Secondary Structure of T4 Phage Lysozyme," Biochim. Biophys. Acta, vol. 405, no. 2, pp. 442-451, 1975. DOI: 10.1016/0005-2795(75)90109-9
[31] S. Sunardi and S. Suyahman, "Analisis Komparasi Prediksi Serangan DDoS Menggunakan Machine Learning," in Proc. Informatics Collaborations and Dissemination Meeting, vol. 1, no. 1, pp. 84-91, 2025.
[32] F. Fitriyadi, S. Suyahman, and S. A. Asif, "Evaluation of Campus Wi-Fi Network Security Against Man-in-the-Middle Attacks Using AI-Based Intrusion Detection Systems," J. Electrical, Computer and Informatics, 2025.
[2] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, "Survey of Intrusion Detection Systems: Techniques, Datasets and Challenges," Cybersecurity, vol. 2, no. 1, p. 20, 2019. DOI: 10.1186/s42400-019-0038-7
[3] I. Sharafaldin, A. H. Lashkari, S. Hakak, and A. A. Ghorbani, "Developing Realistic Distributed Denial of Service (DDoS) Attack Dataset and Taxonomy," in Proc. IEEE 53rd Int. Carnahan Conf. Security Technology, Chennai, India, 2019. DOI: 10.1109/CCST.2019.8888419
[4] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization," in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), Funchal, Madeira, Portugal, 2018, pp. 108-116. DOI: 10.5220/0006639801080116
[5] M. S. Elsayed, N.-A. Le-Khac, S. Dev, and A. D. Jurcut, "DDoSNet: A Deep-Learning Model for Detecting Network Attacks," in Proc. IEEE 21st Int. Symp. "A World of Wireless, Mobile and Multimedia Networks" (WoWMoM), Cork, Ireland, 2020, pp. 391-396. DOI: 10.1109/WoWMoM49955.2020.00072
[6] R. Doriguzzi-Corin, S. Millar, S. Scott-Hayward, J. Martinez-del-Rincon, and D. Siracusa, "LUCID: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection," IEEE Trans. Netw. Service Manag., vol. 17, no. 2, pp. 876-889, Jun. 2020. DOI: 10.1109/TNSM.2020.2971776
[7] S. Haider, A. Akhunzada, I. Mustafa, T. B. Patel, A. Fernandez, K.-K. R. Choo, and J. Iqbal, "A Deep CNN Ensemble Framework for Efficient DDoS Attack Detection in Software Defined Networks," IEEE Access, vol. 8, pp. 53972-53983, 2020. DOI: 10.1109/ACCESS.2020.2976908
[8] I. Ahmad, M. Basheri, M. J. Iqbal, and A. Rahim, "Performance Comparison of Support Vector Machine, Random Forest, and Extreme Learning Machine for Intrusion Detection," IEEE Access, vol. 6, pp. 33789-33795, 2018. DOI: 10.1109/ACCESS.2018.2841987
[9] Z. Chen, F. Jiang, Y. Cheng, X. Gu, W. Liu, and J. Peng, "XGBoost Classifier for DDoS Attack Detection and Analysis in SDN-Based Cloud," in Proc. 2018 IEEE Int. Conf. Big Data and Smart Computing (BigComp), Shanghai, China, 2018, pp. 251-256. DOI: 10.1109/BigComp.2018.00044
[10] S. S. Dhaliwal, A.-A. Nahid, and R. Abbas, "Effective Intrusion Detection System Using XGBoost," Information, vol. 9, no. 7, p. 149, 2018. DOI: 10.3390/info9070149
[11] L. Prokhorenkova, G. Gusev, A. Vorobev, A. V. Dorogush, and A. Gulin, "CatBoost: Unbiased Boosting with Categorical Features," in Proc. 32nd Conf. Neural Information Processing Systems (NeurIPS), Montréal, QC, Canada, 2018, pp. 6638-6648.
[12] Y. Zhang and Z. Wang, "Feature Engineering and Model Optimization Based Classification Method for Network Intrusion Detection," Appl. Sci., vol. 13, no. 16, p. 9363, 2023. DOI: 10.3390/app13169363
[13] G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, and T.-Y. Liu, "LightGBM: A Highly Efficient Gradient Boosting Decision Tree," in Proc. 31st Conf. Neural Information Processing Systems (NeurIPS), Long Beach, CA, USA, 2017, pp. 3146-3154.
[14] K. V. Rashmi and R. Gilad-Bachrach, "DART: Dropouts meet Multiple Additive Regression Trees," in Proc. 18th Int. Conf. Artificial Intelligence and Statistics (AISTATS), ser. Proceedings of Machine Learning Research, vol. 38, San Diego, CA, USA, 2015, pp. 489-497.
[15] J. Bergstra and Y. Bengio, "Random Search for Hyper-parameter Optimization," J. Mach. Learn. Res., vol. 13, pp. 281-305, 2012.
[16] J. Snoek, H. Larochelle, and R. P. Adams, "Practical Bayesian Optimization of Machine Learning Algorithms," in Proc. 26th Annu. Conf. Neural Information Processing Systems (NIPS 2012), Lake Tahoe, NV, USA, 2012, pp. 2960-2968.
[17] J. Bergstra, R. Bardenet, Y. Bengio, and B. Kegl, "Algorithms for Hyper-parameter Optimization," in Proc. 25th Annu. Conf. Neural Information Processing Systems (NIPS 2011), Granada, Spain, 2011, pp. 2546-2554.
[18] T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, "Optuna: A Next-generation Hyperparameter Optimization Framework," in Proc. 25th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining (KDD '19), Anchorage, AK, USA, 2019, pp. 2623-2631. DOI: 10.1145/3292500.3330701
[19] C. X. Ling and V. S. Sheng, "Cost-Sensitive Learning and the Class Imbalance Problem," in Encyclopedia of Machine Learning, C. Sammut and G. I. Webb, Eds. Boston, MA: Springer, 2011, pp. 231-235.
[20] R. Kohavi, "A Study of Cross-Validation and Bootstrap for Accuracy Estimation and Model Selection," in Proc. 14th Int. Joint Conf. Artif. Intell. (IJCAI), Montreal, QC, Canada, 1995, pp. 1137-1143.
[21] J. Davis and M. Goadrich, "The Relationship Between Precision-Recall and ROC Curves," in Proc. 23rd Int. Conf. Mach. Learn. (ICML), Pittsburgh, PA, USA, 2006, pp. 233-240. DOI: 10.1145/1143844.1143874
[22] T. Saito and M. Rehmsmeier, "The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets," PLoS ONE, vol. 10, no. 3, e0118432, 2015. DOI: 10.1371/journal.pone.0118432
[23] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, "SMOTE: Synthetic Minority Over-sampling Technique," J. Artif. Intell. Res., vol. 16, pp. 321-357, 2002. DOI: 10.1613/jair.953
[24] S. M. H. Mirsadeghi, H. Bahsi, R. Vaarandi, and W. Inoubli, "Learning From Few Cyber-Attacks: Addressing the Class Imbalance Problem in Machine Learning-Based Intrusion Detection in Software-Defined Networking," IEEE Access, vol. 11, pp. 140428-140442, 2023. DOI: 10.1109/ACCESS.2023.3341755
[25] T. Chen and C. Guestrin, "XGBoost: A Scalable Tree Boosting System," in Proc. 22nd ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining (KDD '16), San Francisco, CA, USA, 2016, pp. 785-794. DOI: 10.1145/2939672.2939785
[26] L. Breiman, "Random Forests," Mach. Learn., vol. 45, no. 1, pp. 5-32, 2001. DOI: 10.1023/A:1010933404324
[27] M. C. Belavagi and B. Muniyal, "Performance Evaluation of Supervised Machine Learning Algorithms for Intrusion Detection," Procedia Comput. Sci., vol. 89, pp. 117-123, 2016. DOI: 10.1016/j.procs.2016.06.016
[28] X. Ma and W. Shi, "AESMOTE: Adversarial Reinforcement Learning With SMOTE for Anomaly Detection," IEEE Trans. Netw. Sci. Eng., vol. 8, no. 2, pp. 943-956, 2021. DOI: 10.1109/TNSE.2020.3004312
[29] R. Abdulhammed, M. Faezipour, A. Abuzneid, and A. Abumallouh, "Deep and Machine Learning Approaches for Anomaly-Based Intrusion Detection of Imbalanced Network Traffic," IEEE Sensors Lett., vol. 3, no. 1, pp. 1-4, 2019. DOI: 10.1109/LSENS.2018.2879990
[30] B. W. Matthews, "Comparison of the Predicted and Observed Secondary Structure of T4 Phage Lysozyme," Biochim. Biophys. Acta, vol. 405, no. 2, pp. 442-451, 1975. DOI: 10.1016/0005-2795(75)90109-9
[31] S. Sunardi and S. Suyahman, "Analisis Komparasi Prediksi Serangan DDoS Menggunakan Machine Learning," in Proc. Informatics Collaborations and Dissemination Meeting, vol. 1, no. 1, pp. 84-91, 2025.
[32] F. Fitriyadi, S. Suyahman, and S. A. Asif, "Evaluation of Campus Wi-Fi Network Security Against Man-in-the-Middle Attacks Using AI-Based Intrusion Detection Systems," J. Electrical, Computer and Informatics, 2025.
Downloads
Published
2026-10-30
How to Cite
[1]
I. Y. Surianto, “DDoS Attack Detection with LightGBM in DART Mode: Benchmarking GridSearchCV Against Optuna Hyperparameter Tuning”, KOMPUTER, vol. 1, no. 1, pp. 26–35, Oct. 2026.
Issue
Section
Articles
