Application of Adaptive Neuro-Fuzzy Inference System for DDoS Attack Detection Based on CIC-DDoS-2019 Dataset

The relevance. Distributed Denial of Service (DDoS) attacks remain a significant threat to the availability of online services. Traditional intrusion detection systems based on signatures or anomaly analysis face limitations in detecting new and complex attacks, while machine learning-based approaches, while showing high potential, often lack interpretability. Hybrid systems, such as the Adaptive Neuro-Fuzzy Inference System (ANFIS), combine the advantages of neural networks and fuzzy logic, offering both accuracy and interpretability. However, their effectiveness with respect to modern datasets with diverse attack vectors, such as CIC-DDoS-2019, needs to be investigated.Objective. The study aims to evaluate the performance and applicability of ANFIS for the task of DDoS attack detection using the current and challenging CIC-DDoS-2019 dataset. The ANFIS model was used in this work. The study was conducted on a representative subsample of the CIC-DDoS-2019 dataset. The methodology included careful data preprocessing, selection of the most relevant features and expert knowledge, and feature normalisation. The ANFIS model with Gaussian membership functions was trained using a hybrid optimisation algorithm (gradient descent and least squares method) on 80 % of the data. Performance was evaluated on the remaining 20 % of the test data using standard classification metrics: Accuracy, Precision, Recall, F1-Score, and error matrix analysis.Results. The experiments showed high performance of the ANFIS model. The following metrics were achieved: proportion of correctly classified objects (Accuracy) ‒ 97.82 %, accuracy (Precision) ‒ 99.52 %, completeness (Recall) ‒ 85.95 % and F1-measure ‒ 92.24 %. The results indicate a very low false positive rate, with some number of missed attacks.Novelty. The work demonstrates the application and performance evaluation of ANFIS on a modern and complex CIC-DDoS-2019 dataset containing relevant attack types.The study confirms the theoretical applicability of hybrid neuro-fuzzy models to solve current cybersecurity problems. The practical significance consists in demonstrating that ANFIS can serve as a basis for the development of effective DDoS attack detection systems, providing a high level of accuracy and acceptable detection completeness. The ability to analyze membership functions and rules implements interpretability, which is important for understanding system performance and threat analysis. The results provide benchmarks for ANFIS on this dataset.

ANFIS, DDoS attacks, intrusion detection, neuro-fuzzy systems, ANFIS, machine learning, network traffic analysis