{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T12:06:05Z","timestamp":1791893165431,"version":"4.3.4"},"update-to":[{"DOI":"10.12688\/f1000research.163778.1","type":"new_version","label":"New version","source":"publisher","updated":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T00:00:00Z","timestamp":1785110400000}}],"reference-count":32,"publisher":"F1000 Research Ltd","license":[{"start":{"date-parts":[[2026,7,27]],"date-time":"2026-07-27T00:00:00Z","timestamp":1785110400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["f1000research.com"],"crossmark-restriction":false},"short-container-title":["F1000Res"],"abstract":"<ns3:p>Background The explosive growth of Software-Defined Networks (SDN) has introduced unmatched scalability with increased flexibility, an essential component of this modern, complicated network infrastructure. While machine learning models promise to be a viable approach for detecting Distributed Denial of Service (DDoS) attacks, their efficiency relies on the quality of the engineered features. Methods In this study, an innovative approach for categorizing newly generated features based on domain-specific relevance is applied, followed by Principal Component Analysis (PCA) on each of the categories for dimensionality reduction. These new engineered features represent the originality of the features within the original dataset without losing their integrity by dropping multiple features from the original dataset. These PCA-transformed features, along with other individual features that were not used in the previous step, were merged into a single dataset for further processing using Machine Learning classifiers. This unique methodology not only addresses the curse of dimensionality but also ensures that the meaningful variance within the categories of features is retained. The CICDDoS2019 dataset was used to evaluate the developed model against features engineered from this dataset. Performance was evaluated using accuracy, precision, recall, F1-score, ROC-AUC, log loss, ECE, and cross-validation. The primary dataset comprised of 499,998 total samples consisting of nine attack and one benign classes, split into training, validation, and test sets. Each category group retained \u226595% variance, compressing 45 to 27 PCA components. The proposed grouped PCA pipeline, with all transformers fitted on the training partition, achieved a weighted F1-score of 0.9991, AUROC of 1.0000, and mean ECE of 0.000276 on the primary dataset, improving further to 0.9994, 1.0000, and 0.000202, respectively on a doubled dataset, with five and ten-fold cross-validation confirming strong generalisability and scalability across both scales. Conclusion This planned and logically structured approach underscores the importance of domain-driven feature generation and categorization.<\/ns3:p>","DOI":"10.12688\/f1000research.163778.2","type":"journal-article","created":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T11:39:10Z","timestamp":1791891550000},"page":"743","update-policy":"https:\/\/doi.org\/10.12688\/f1000research.crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Applying Principal Component Analysis for Categorized Dimensionality Reduction in DDoS Detection for Software-Defined Networks"],"prefix":"10.12688","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8725-2029","authenticated-orcid":false,"given":"Keerthana","family":"Balaji","sequence":"first","affiliation":[{"name":"Manipal School of Information Sciences Manipal Karnataka Manipal Academy of Higher Education"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2201-8730","authenticated-orcid":false,"given":"Mamatha","family":"Balachandra","sequence":"additional","affiliation":[{"name":"Manipal Institute of Technology Manipal Karnataka Manipal Academy of Higher Education"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2560","published-online":{"date-parts":[[2026,7,27]]},"reference":[{"key":"ref1","doi-asserted-by":"publisher","first-page":"3-14","DOI":"10.26636\/jtit.2016.4.757","article-title":"Traffic engineering in software defined networks: a survey.","volume":"4","author":"M Abbasi","year":"2016","journal-title":"Journal of Telecommunications and Information Technology."},{"key":"ref2","doi-asserted-by":"publisher","first-page":"74-98","DOI":"10.1016\/j.comnet.2014.07.004","article-title":"Software defined networking: State of the art and research challenges.","volume":"72","author":"M Jammal","year":"2014\/10\/29","journal-title":"Comput. Netw."},{"key":"ref3","doi-asserted-by":"publisher","first-page":"333-346","DOI":"10.3390\/telecom5020017","article-title":"Feature-Selection-Based DDoS Attack Detection Using AI Algorithms.","volume":"5","author":"M Raza","year":"2024","journal-title":"Telecom."},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3390\/sym14061095","article-title":"Machine-Learning-Based DDoS Attack Detection Using Mutual Information and Random Forest Feature Importance Method.","volume":"14","author":"M Alduailij","year":"2022","journal-title":"Symmetry."},{"key":"ref5","doi-asserted-by":"publisher","first-page":"395-401","DOI":"10.30630\/joiv.5.4.734","article-title":"Feature Selection Approach to Detect DDoS Attack Using Machine Learning Algorithms.","volume":"5","author":"M Azmi","year":"2021","journal-title":"JOIV: International Journal on Informatics Visualization."},{"key":"ref6","first-page":"8658-8669","article-title":"Feature engineering and machine learning framework for DDoS attack detection in the standardized internet of things.","volume":"10","author":"M Malik","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref7","doi-asserted-by":"publisher","first-page":"6176","DOI":"10.3390\/s23136176","article-title":"A DDoS detection method based on feature engineering and machine learning in software-defined networks.","volume":"23","author":"Z Liu","year":"2023","journal-title":"Sensors."},{"key":"ref8","doi-asserted-by":"publisher","first-page":"1862-1880","DOI":"10.1109\/TCCN.2022.3186331","article-title":"A flow-based anomaly detection approach with feature selection method against ddos attacks in sdns.","volume":"8","author":"M El Sayed","year":"2022","journal-title":"IEEE Transactions on Cognitive Communications and Networking."},{"key":"ref9","doi-asserted-by":"publisher","first-page":"107530","DOI":"10.1016\/j.comnet.2020.107530","article-title":"Machine learning-based traffic prediction models for intelligent transportation systems.","volume":"181","author":"A Boukerche","year":"2020","journal-title":"Comput. Netw."},{"key":"ref10","doi-asserted-by":"publisher","first-page":"673-710","DOI":"10.1007\/s12243-020-00770-7","article-title":"A review on machine learning\u2013based approaches for Internet traffic classification.","volume":"75","author":"O Salman","year":"2020","journal-title":"Ann. Telecommun."},{"key":"ref11","doi-asserted-by":"publisher","first-page":"1294","DOI":"10.3390\/math12091294","article-title":"Improvement of Distributed Denial of Service Attack Detection through Machine Learning and Data Processing.","volume":"12","author":"F Becerra-Suarez","year":"2024","journal-title":"Mathematics."},{"key":"ref12","doi-asserted-by":"publisher","first-page":"6","DOI":"10.14569\/IJACSA.2021.0121277","article-title":"Detecting distributed denial of service attacks using machine learning models.","volume":"12","author":"E Alghoson","year":"2021","journal-title":"Algorithms."},{"key":"ref13","doi-asserted-by":"publisher","first-page":"421-431","DOI":"10.32985\/ijeces.14.4.6","article-title":"An effective deep learning based multi-class classification of dos and ddos attack detection.","volume":"14","author":"A Silivery","year":"2023","journal-title":"Int. J. Electr. Comput. Eng. Syst."},{"key":"ref15","doi-asserted-by":"publisher","first-page":"13039-13075","DOI":"10.1007\/s00500-021-06608-1","article-title":"Deep learning approaches for detecting DDoS attacks: A systematic review.","volume":"27","author":"M Mittal","year":"2023","journal-title":"Soft. Comput."},{"key":"ref16","doi-asserted-by":"publisher","first-page":"103117","DOI":"10.1016\/j.cose.2023.103117","article-title":"Detecting DDoS attacks using adversarial neural network.","volume":"127","author":"A Mustapha","year":"2023","journal-title":"Comput. Secur."},{"key":"ref17","doi-asserted-by":"publisher","first-page":"322","DOI":"10.3390\/electronics8030322","article-title":"Features dimensionality reduction approaches for machine learning based network intrusion detection.","volume":"8","author":"R Abdulhammed","year":"2019","journal-title":"Electronics."},{"key":"ref18","first-page":"1869-1880","article-title":"A new proactive feature selection model based on the enhanced optimization algorithms to detect DRDoS attacks.","volume":"12","author":"R Nuiaa","year":"2022","journal-title":"Int. J. Electr. Comput. Eng."},{"key":"ref19","doi-asserted-by":"publisher","first-page":"7872","DOI":"10.3390\/app13137872","article-title":"Real-Time Detection of DDoS Attacks Based on Random Forest in SDN.","volume":"13","author":"R Ma","year":"2023","journal-title":"Appl. Sci."},{"key":"ref22","doi-asserted-by":"publisher","first-page":"305-314","DOI":"10.31289\/jite.v5i2.6112","article-title":"Impact of feature selection methods on machine learning-based for detecting DDoS attacks: Literature review.","volume":"5","author":"M Faiz","year":"2022","journal-title":"Journal of Informatics and Telecommunication Engineering."},{"key":"ref23","doi-asserted-by":"publisher","first-page":"43-47","DOI":"10.14445\/22315381\/IJETT-V68I4P208S","article-title":"Feature analysis of iot botnet attacks based on RNN and LSTM.","volume":"68","author":"J Kim","year":"2020","journal-title":"Int. J. Eng. Trends Technol."},{"key":"ref24","doi-asserted-by":"publisher","first-page":"761-785","DOI":"10.1007\/s10207-019-00434-1","article-title":"DDoS attack detection with feature engineering and machine learning: the framework and performance evaluation.","volume":"18","author":"M Aamir","year":"2019","journal-title":"Int. J. Inf. Secur."},{"key":"ref25","first-page":"177-200","article-title":"Towards a reliable intrusion detection benchmark dataset.","volume":"2018","author":"I Sharafaldin","year":"2018","journal-title":"Software Networking."},{"key":"ref26","doi-asserted-by":"publisher","first-page":"3183","DOI":"10.3390\/app13053183","article-title":"Machine learning techniques to detect a DDoS attack in SDN: A systematic review.","volume":"13","author":"T Ali","year":"2023","journal-title":"Appl. Sci."},{"key":"ref27","doi-asserted-by":"publisher","first-page":"e5402","DOI":"10.1002\/cpe.5402","article-title":"Machine learning algorithms to detect DDoS attacks in SDN.","volume":"32","author":"R Santos","year":"2020","journal-title":"Concurr. Comput. Pract. Exp."},{"key":"ref28","doi-asserted-by":"publisher","first-page":"14","DOI":"10.3390\/technologies9010014","article-title":"An investigation into the application of deep learning in the detection and mitigation of DDOS attack on SDN controllers.","volume":"9","author":"J Gadze","year":"2021","journal-title":"Technologies."},{"key":"ref29","doi-asserted-by":"publisher","first-page":"466-474","DOI":"10.1016\/j.procs.2019.11.146","article-title":"Dealing with noise problem in machine learning data-sets: A systematic review.","volume":"161","author":"S Gupta","year":"2019","journal-title":"Procedia Comput. Sci."},{"key":"ref30","first-page":"96-103","article-title":"Sensitivity of different machine learning algorithms to noise.","volume":"26","author":"A Atla","year":"2011","journal-title":"J. Comput. Sci. Coll."},{"key":"ref31","doi-asserted-by":"publisher","first-page":"11634","DOI":"10.3390\/app112411634","article-title":"Efficient Detection of DDoS Attacks Using a Hybrid Deep Learning Model with Improved Feature Selection.","volume":"11","author":"D Alghazzawi","year":"2021","journal-title":"Appl. Sci."},{"key":"ref32","doi-asserted-by":"publisher","first-page":"3333","DOI":"10.3390\/s23063333","article-title":"An intelligent agent-based detection system for DDoS attacks using automatic feature extraction and selection.","volume":"23","author":"R Abu Bakar","year":"2023","journal-title":"Sensors."},{"key":"ref33","article-title":"Metrics for multi-class classification: an overview.","author":"M Grandini","year":"2020","journal-title":"arXiv preprint arXiv:2008.05756."},{"key":"ref34","first-page":"2","article-title":"Survey on multiclass classification methods.","volume":"19","author":"M Aly","year":"2005","journal-title":"Neural Netw."},{"key":"ref35","doi-asserted-by":"crossref","DOI":"10.1145\/775047.775151","article-title":"Transforming classifier scores into accurate multiclass probability estimates.","author":"B Zadrozny","year":"2002","journal-title":"Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining."}],"container-title":["F1000Research"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/f1000research.com\/articles\/14-743\/v2\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/f1000research.com\/articles\/14-743\/v2\/pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/f1000research.com\/articles\/14-743\/v2\/iparadigms","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T11:39:12Z","timestamp":1791891552000},"score":1,"resource":{"primary":{"URL":"https:\/\/f1000research.com\/articles\/14-743\/v2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,27]]},"references-count":32,"URL":"https:\/\/doi.org\/10.12688\/f1000research.163778.2","relation":{"has-version":[{"id-type":"doi","id":"10.12688\/f1000research.163778.1","asserted-by":"subject"}],"has-review":[{"id-type":"doi","id":"10.5256\/f1000research.201849.r509928","asserted-by":"subject"}]},"ISSN":["2046-1402"],"issn-type":[{"value":"2046-1402","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,27]]},"assertion":[{"value":"Indexed","URL":"https:\/\/f1000research.com\/articles\/14-743\/v2#article-reports","order":0,"name":"referee-status","label":"Referee status","group":{"name":"current-referee-status","label":"Current Referee Status"}},{"value":"10.5256\/f1000research.180178.r440059, Dr.V.Latha Jothi, Gokulraj S, Russia S, Velalar College of Engineering and Technology, Erode, 12 Jan 2026, version 1, 1 approved, 1 approved with reservations","URL":"https:\/\/f1000research.com\/articles\/14-743\/v1#referee-response-440059","order":0,"name":"referee-response-440059","label":"Referee Report","group":{"name":"article-reports","label":"Article Reports"}},{"value":"10.5256\/f1000research.180178.r471423, Hambali Moshood Abiola, Federal University Wukari, Wukari, Taraba, 06 May 2026, version 1, 1 approved, 1 approved with reservations","URL":"https:\/\/f1000research.com\/articles\/14-743\/v1#referee-response-471423","order":1,"name":"referee-response-471423","label":"Referee Report","group":{"name":"article-reports","label":"Article Reports"}},{"value":"10.5256\/f1000research.201849.r509928, C. M. Nalayini Nalayini, Velammal Engineering College, Chennai, 03 Sep 2026, version 2, indexed","URL":"https:\/\/f1000research.com\/articles\/14-743\/v2#referee-response-509928","order":2,"name":"referee-response-509928","label":"Referee Report","group":{"name":"article-reports","label":"Article Reports"}},{"value":"The author(s) declared that no grants were involved in supporting this work","order":3,"name":"grant-information","label":"Grant Information"},{"value":"This is an open access article distributed under the terms of the Creative Commons Attribution Licence, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.","order":0,"name":"copyright-info","label":"Copyright"}]}}