{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T13:11:32Z","timestamp":1778245892779,"version":"3.51.4"},"reference-count":20,"publisher":"Wiley","issue":"1","license":[{"start":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:00:00Z","timestamp":1778198400000},"content-version":"vor","delay-in-days":127,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Networks and Communications"],"published-print":{"date-parts":[[2026,1]]},"abstract":"<jats:p>Anomaly detection plays a critical role in mitigating cybersecurity threats, particularly Distributed Denial of Service (DDoS) attacks. This study evaluates the performance of tree\u2010based and ensemble learning models, including Decision Tree, Random Forest, and XGBoost, for classifying Snort log data, alongside the application of Isolation Forest for time\u2010series anomaly detection. The experiments were conducted using ICMP\u2010based Ping Flood attacks in a controlled network environment, with data collected from Snort intrusion detection system logs. The classification results indicate that XGBoost achieved the highest performance, with 99.81% accuracy, 99.93% precision, 99.65% recall, and 99.79% F1\u2010score under a 70\u201330 train\u2010test split. Random Forest and Decision Tree also demonstrated strong performance, while Logistic Regression showed lower effectiveness due to its limitations in modeling nonlinear patterns. For anomaly detection, Isolation Forest was applied to time\u2010series data collected over a 19\u2010day period. The model detected 93 anomaly points, of which 41 overlapped with Wireshark\u2010confirmed events. However, a false positive rate of 41.67% was observed, indicating the need for parameter tuning to balance detection sensitivity and operational efficiency. Overall, the findings demonstrate that ensemble\u2010based learning approaches, particularly XGBoost, are effective for detecting DDoS\u2010related patterns within the experimental setting. However, the results are limited to ICMP\u2010based attack scenarios in a controlled environment. Further validation, including cross\u2010validation, multi\u2010attack evaluation, and deployment\u2010level performance analysis, is required to assess generalizability and practical applicability.<\/jats:p>","DOI":"10.1155\/jcnc\/3114551","type":"journal-article","created":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T12:26:58Z","timestamp":1778243218000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Evaluation of Machine Learning Techniques for Denial\u2010of\u2010Service Attack Detection in Digital Information Exchange"],"prefix":"10.1155","volume":"2026","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-1658-0211","authenticated-orcid":false,"given":"Piyapol","family":"Suwimol","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8912-7678","authenticated-orcid":false,"given":"Krishna","family":"Chimmanee","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7418-1790","authenticated-orcid":false,"given":"Auttapon","family":"Pomsathit","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","published-online":{"date-parts":[[2026,5,8]]},"reference":[{"key":"e_1_2_10_1_2","doi-asserted-by":"publisher","DOI":"10.28991\/CEJ-2025-011-05-022"},{"key":"e_1_2_10_2_2","first-page":"11245","article-title":"Integrating Gradient Boosting With Feature Engineering for Cybersecurity","volume":"10","author":"Cheng Y.","year":"2022","journal-title":"IEEE Access"},{"key":"e_1_2_10_3_2","first-page":"1","article-title":"A Review of Ensemble Learning Models for Intrusion Detection in Modern Networks","volume":"55","author":"Shang S.","year":"2023","journal-title":"ACM Computing Surveys"},{"key":"e_1_2_10_4_2","article-title":"Enhanced Anomaly Detection Algorithms for Imbalanced Datasets in IDS","volume":"225","author":"Wang J.","year":"2023","journal-title":"Expert Systems with Applications"},{"key":"e_1_2_10_5_2","article-title":"A Dynamic Approach to Traffic Anomaly Detection Using Isolation Forest","volume":"6","author":"Sun J.","year":"2023","journal-title":"Cybersecurity"},{"key":"e_1_2_10_6_2","first-page":"65892","article-title":"Big Data ETL Pipelines for Cybersecurity: Challenges and Best Practices","volume":"9","author":"Puschmann F.","year":"2021","journal-title":"IEEE Access"},{"key":"e_1_2_10_7_2","first-page":"135","article-title":"Imbalanced Data Handling in Cybersecurity Pipelines","volume":"20","author":"Sharma A.","year":"2022","journal-title":"Journal of Network Security"},{"key":"e_1_2_10_8_2","first-page":"1847","article-title":"Feature Engineering Strategies for Anomaly Detection in IDS Logs","volume":"16","author":"Li Y.","year":"2021","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"e_1_2_10_9_2","doi-asserted-by":"publisher","DOI":"10.1051\/e3sconf\/202018401052"},{"key":"e_1_2_10_10_2","article-title":"Hot Spot Identification Method Based on Andrews Curves","volume":"2023","author":"Papageorgiou G. K.","year":"2023","journal-title":"Computational and Mathematical Methods in Medicine"},{"key":"e_1_2_10_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/CISS56502.2023.10089725"},{"key":"e_1_2_10_12_2","doi-asserted-by":"publisher","DOI":"10.3390\/s22176599"},{"key":"e_1_2_10_13_2","first-page":"58","article-title":"An SDN-based Decision Tree Detection (DTD) Model for Detecting DDoS Attacks in Cloud Environment","volume":"13","author":"Jeba Praba J.","year":"2022","journal-title":"International Journal of Advanced Computer Science and Applications"},{"key":"e_1_2_10_14_2","first-page":"234","article-title":"DDOS Detection System Using C4.5 Decision Tree Algorithm","volume":"7","author":"Pydipalli M.","year":"2021","journal-title":"International Journal of Scientific Research in Computer Science, Engineering and Information Technology"},{"key":"e_1_2_10_15_2","first-page":"1","article-title":"Adaptive Window Size Selection in Piecewise Aggregate Approximation for Efficient Anomaly Detection in Time-Series Data","volume":"12","author":"Banu S. S. S.","year":"2021","journal-title":"Journal of Network and Computer Applications"},{"key":"e_1_2_10_16_2","article-title":"Distribution and Volume Based Scoring for Isolation Forests","author":"Dhouib H.","year":"2023","journal-title":"arXiv preprint arXiv:2309.11450"},{"key":"e_1_2_10_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2019.2947676"},{"key":"e_1_2_10_18_2","volume-title":"Deep Isolation Forest for Anomaly Detection","author":"Xu H.","year":"2022"},{"key":"e_1_2_10_19_2","article-title":"Performance and Efficacy of Snort Versus Suricata in Intrusion Detection Systems","volume":"3232","author":"Singh S. K.","year":"2021","journal-title":"AIP Conference Proceedings"},{"key":"e_1_2_10_20_2","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1802.00508"}],"container-title":["Journal of Computer Networks and Communications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/jcnc\/3114551","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1155\/jcnc\/3114551","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1155\/jcnc\/3114551","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T12:27:01Z","timestamp":1778243221000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1155\/jcnc\/3114551"}},"subtitle":[],"editor":[{"given":"Sohini","family":"Basu Roy","sequence":"additional","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2026,1]]},"references-count":20,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,1]]}},"alternative-id":["10.1155\/jcnc\/3114551"],"URL":"https:\/\/doi.org\/10.1155\/jcnc\/3114551","archive":["Portico"],"relation":{},"ISSN":["2090-7141","2090-715X"],"issn-type":[{"value":"2090-7141","type":"print"},{"value":"2090-715X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1]]},"assertion":[{"value":"2025-10-25","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-03-27","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-08","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"3114551"}}