{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T17:20:21Z","timestamp":1779384021871,"version":"3.53.1"},"reference-count":33,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2023,5,29]],"date-time":"2023-05-29T00:00:00Z","timestamp":1685318400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>The exponential growth of the Internet of Things (IoT) has led to the rapid expansion of interconnected systems, which has also increased the vulnerability of IoT devices to security threats such as distributed denial-of-service (DDoS) attacks. In this paper, we propose a machine learning pipeline that specifically addresses the issue of DDoS attack detection in IoT networks. Our approach comprises of (i) a processing module to prepare the data for further analysis, (ii) a dynamic attribute selection module that selects the most adaptive and productive features and reduces the training time, and (iii) a classification module to detect DDoS attacks. We evaluate the effectiveness of our approach using the CICI-IDS-2018 dataset and five powerful yet simple machine learning classifiers\u2014Decision Tree (DT), Gaussian Naive Bayes, Logistic Regression (LR), K-Nearest Neighbor (KNN), and Random Forest (RF). Our results demonstrate that DT outperforms its counterparts and achieves up to 99.98% accuracy in just 0.18 s of CPU time. Our approach is simple, lightweight, and accurate for detecting DDoS attacks in IoT networks.<\/jats:p>","DOI":"10.3390\/computers12060115","type":"journal-article","created":{"date-parts":[[2023,5,30]],"date-time":"2023-05-30T02:04:21Z","timestamp":1685412261000},"page":"115","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":33,"title":["Machine Learning-Based Dynamic Attribute Selection Technique for DDoS Attack Classification in IoT Networks"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3925-621X","authenticated-orcid":false,"given":"Subhan","family":"Ullah","sequence":"first","affiliation":[{"name":"Department of Computer Science, National University of Computer and Emerging Sciences (NUCES-FAST), Islamabad 44000, Pakistan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2253-5922","authenticated-orcid":false,"given":"Zahid","family":"Mahmood","sequence":"additional","affiliation":[{"name":"Department of Computer Science and IT, University of Kotli Azad Jammu and Kashmir, Kotli 11100, Pakistan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1136-7452","authenticated-orcid":false,"given":"Nabeel","family":"Ali","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, Capital University of Science and Technology (CUST), Islamabad 44000, Pakistan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8105-6791","authenticated-orcid":false,"given":"Tahir","family":"Ahmad","sequence":"additional","affiliation":[{"name":"Center for Cybersecurity, Brunno Kessler Foundation, 38123 Trento, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2723-2410","authenticated-orcid":false,"given":"Attaullah","family":"Buriro","sequence":"additional","affiliation":[{"name":"Faculty of Engineering, Free University Bozen-Bolzano, 39100 Bolzano, Italy"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,5,29]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"3769","DOI":"10.1109\/COMST.2019.2934468","article-title":"Defense mechanisms against DDoS attacks in a cloud computing environment: State-of-the-art and research challenges","volume":"21","author":"Agrawal","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"2383","DOI":"10.1007\/s11227-020-03323-w","article-title":"The DDoS attacks detection through machine learning and statistical methods in SDN","volume":"77","author":"Soltanaghaei","year":"2021","journal-title":"J. Supercomput."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Fazeldehkordi, E., Owe, O., and Ramezanifarkhani, T. (2019, January 26\u201327). A language-based approach to prevent DDoS attacks in distributed financial agent systems. Proceedings of the Computer Security: ESORICS 2019 International Workshops, IOSec, MSTEC, and FINSEC, Luxembourg. Revised Selected Papers 2.","DOI":"10.1007\/978-3-030-42051-2_18"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Cheng, J., Li, J., Tang, X., Sheng, V.S., Zhang, C., and Li, M. (2019). A novel DDoS attack detection method using optimized generalized multiple kernel learning. arXiv.","DOI":"10.32604\/cmc.2020.06176"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.adhoc.2018.01.013","article-title":"6LowPSec: An end-to-end security protocol for 6LoWPAN","volume":"82","author":"Glissa","year":"2019","journal-title":"Ad Hoc Netw."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"794326","DOI":"10.1155\/2013\/794326","article-title":"Routing attacks and countermeasures in the RPL-based internet of things","volume":"9","author":"Wallgren","year":"2013","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/MWC.2016.7721741","article-title":"Toward end-to-end biomet rics-based security for IoT infrastructure","volume":"23","author":"Hossain","year":"2016","journal-title":"IEEE Wirel. Commun."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Glissa, G., and Meddeb, A. (2017, January 26\u201330). 6LoWPAN multi-layered security protocol based on IEEE 802.15.4 security features. Proceedings of the 2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC), Valencia, Spain.","DOI":"10.1109\/IWCMC.2017.7986297"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"834","DOI":"10.1109\/JSYST.2016.2535730","article-title":"A light-weight countermeasure to forwarding misbehavior in wireless sensor networks: Design, analysis, and evaluation","volume":"12","author":"Pu","year":"2016","journal-title":"IEEE Syst. J."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Hossain, M., Karim, Y., and Hasan, R. (2018, January 19\u201321). Secupan: A security scheme to mitigate fragmentation-based network attacks in 6lowpan. Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, Tempe, AZ, USA.","DOI":"10.1145\/3176258.3176326"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Gara, F., Saad, L.B., and Ayed, R.B. (2017, January 26\u201330). An intrusion detection system for selective forwarding attack in IPv6-based mobile WSNs. Proceedings of the 2017 13th International Wireless Communications and Mobile Computing Conference (IWCMC), Valencia, Spain.","DOI":"10.1109\/IWCMC.2017.7986299"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"24694","DOI":"10.1109\/ACCESS.2018.2831284","article-title":"A DDoS attack detection and mitigation with software-defined Internet of Things framework","volume":"6","author":"Yin","year":"2018","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1016\/j.comnet.2018.03.020","article-title":"REATO: REActing TO Denial of Service attacks in the Internet of Things","volume":"137","author":"Sicari","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"36191","DOI":"10.1109\/ACCESS.2020.2974293","article-title":"RTVD: A real-time volumetric detection scheme for DDoS in the Internet of Things","volume":"8","author":"Li","year":"2020","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Khan, Z.A., and Herrmann, P. (2017, January 27\u201329). A trust based distributed intrusion detection mechanism for internet of things. Proceedings of the 2017 IEEE 31st International Conference on Advanced Information Networking and Applications (AINA), Taipei, Taiwan.","DOI":"10.1109\/AINA.2017.161"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Airehrour, D., Gutierrez, J., and Ray, S.K. (2016, January 8\u201312). A lightweight trust design for IoT routing. Proceedings of the 2016 IEEE 14th International Conference on Dependable, Autonomic and Secure Computing, 14th International Conference on Pervasive Intelligence and Computing, 2nd International Conference on Big Data Intelligence and Computing and Cyber Science and Technology Congress (DASC\/PiCom\/DataCom\/CyberSciTech), Auckland, New Zealand.","DOI":"10.1109\/DASC-PICom-DataCom-CyberSciTec.2016.105"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"5143","DOI":"10.1002\/sec.1684","article-title":"Mitigation of black hole attacks in routing protocol for low power and lossy networks","volume":"9","author":"Ahmed","year":"2016","journal-title":"Secur. Commun. Netw."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1016\/j.jnca.2017.04.002","article-title":"Internet of Things security: A survey","volume":"88","author":"Alaba","year":"2017","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1016\/j.future.2017.08.043","article-title":"Distributed attack detection scheme using deep learning approach for Internet of Things","volume":"82","author":"Diro","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-baiot\u2014Network-based detection of iot botnet attacks using deep autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_21","unstructured":"Goodfellow, I., Bengio, Y., and Courville, A. (2016). Deep Learning, MIT Press."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.comcom.2018.03.008","article-title":"OpCloudSec: Open cloud software defined wireless network security for the Internet of Things","volume":"122","author":"Sharma","year":"2018","journal-title":"Comput. Commun."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"McDermott, C.D., Majdani, F., and Petrovski, A.V. (2018, January 8\u201313). Botnet detection in the internet of things using deep learning approaches. Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, Brazil.","DOI":"10.1109\/IJCNN.2018.8489489"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Bhunia, S.S., and Gurusamy, M. (2017, January 22\u201324). Dynamic attack detection and mitigation in IoT using SDN. Proceedings of the 2017 27th International Telecommunication Networks and Applications Conference (ITNAC), Melbourne, Australia.","DOI":"10.1109\/ATNAC.2017.8215418"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Ullah, S., Ahmad, T., Buriro, A., Zara, N., and Saha, S. (2022). TrojanDetector: A Multi-Layer Hybrid Approach for Trojan Detection in Android Applications. Appl. Sci., 12.","DOI":"10.3390\/app122110755"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Liu, Z., Thapa, N., Shaver, A., Roy, K., Yuan, X., and Khorsandroo, S. (2020, January 6\u20137). Anomaly detection on iot network intrusion using machine learning. Proceedings of the 2020 International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (icABCD), Durban, South Africa.","DOI":"10.1109\/icABCD49160.2020.9183842"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"2508","DOI":"10.3390\/app13042508","article-title":"MalwD&C: A Quick and Accurate Machine Learning-Based Approach for Malware Detection and Categorization","volume":"13","author":"Buriro","year":"2023","journal-title":"Appl. Sci."},{"key":"ref_28","first-page":"1041","article-title":"Learning from Imbalanced Data","volume":"21","author":"He","year":"2009","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_29","unstructured":"Buriro, A., Ricci, F., and Crispo, B. (July, January 28). SwipeGAN: Swiping Data Augmentation Using Generative Adversarial Networks for Smartphone User Authentication. Proceedings of the 3rd ACM Workshop on Wireless Security and Machine Learning, Abu Dhabi, United Arab Emirates."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"181","DOI":"10.26599\/BDMA.2020.9020003","article-title":"Applying big data based deep learning system to intrusion detection","volume":"3","author":"Zhong","year":"2020","journal-title":"Big Data Min. Anal."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"87593","DOI":"10.1109\/ACCESS.2019.2925828","article-title":"An optimization method for intrusion detection classification model based on deep belief network","volume":"7","author":"Wei","year":"2019","journal-title":"IEEE Access"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"165","DOI":"10.33851\/JMIS.2019.6.4.165","article-title":"An intrusion detection model based on a convolutional neural network","volume":"6","author":"Kim","year":"2019","journal-title":"J. Multimed. Inf. Syst."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Khan, M.A. (2021). HCRNNIDS: Hybrid convolutional recurrent neural network-based network intrusion detection system. Processes, 9.","DOI":"10.3390\/pr9050834"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/12\/6\/115\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T19:44:44Z","timestamp":1760125484000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/12\/6\/115"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5,29]]},"references-count":33,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2023,6]]}},"alternative-id":["computers12060115"],"URL":"https:\/\/doi.org\/10.3390\/computers12060115","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,5,29]]}}}