{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T14:37:31Z","timestamp":1774967851154,"version":"3.50.1"},"reference-count":94,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2025,3,22]],"date-time":"2025-03-22T00:00:00Z","timestamp":1742601600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100013781","name":"Prince Mohammad bin Fahd University","doi-asserted-by":"publisher","award":["PCC-Grant-202202"],"award-info":[{"award-number":["PCC-Grant-202202"]}],"id":[{"id":"10.13039\/501100013781","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Prince Sultan University and EIAS Data Science Lab","award":["PCC-Grant-202202"],"award-info":[{"award-number":["PCC-Grant-202202"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>A software-defined network (SDN) is a new architecture approach for constructing and maintaining networks with the main goal of making the network open and programmable. This allows the achievement of specific network behavior by updating and installing software, instead of making physical changes to the network. Thus, SDNs allow far more flexibility and maintainability compared to conventional device-dependent architectures. Unfortunately, like their predecessors, SDNs are prone to distributed denial of service (DDoS) attacks. These attack paralyze networks by flooding the controller with bogus requests. The answer to this problem is to ignore machines in the network sending these requests. This can be achieved by incorporating classification algorithms that can distinguish between genuine and bogus requests. There is abundant literature on the application of such algorithms on conventional networks. However, because SDNs are relatively new, they lack such abundance both in terms of novel algorithms and effective datasets when it comes to DDoS attack detection. To address these issues, the present study analyzes several variants of the decision tree algorithm for detection of DDoS attacks while using two recently proposed datasets for SDNs. The study finds that a decision tree constructed with a hill climbing approach, termed the greedy decision tree, iteratively adds features on the basis of model performance and provides a simpler and more effective strategy for the detection of DDoS attacks in SDNs when compared with recently proposed schemes in the literature. Furthermore, stability analysis of the greedy decision tree provides useful insights about the performance of the algorithm. One edge that greedy decision tree has over several other methods is its enhanced interpretability in conjunction with higher accuracy.<\/jats:p>","DOI":"10.3390\/fi17040136","type":"journal-article","created":{"date-parts":[[2025,3,24]],"date-time":"2025-03-24T04:48:18Z","timestamp":1742791698000},"page":"136","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Distributed Denial of Service Attack Detection in Software-Defined Networks Using Decision Tree Algorithms"],"prefix":"10.3390","volume":"17","author":[{"given":"Ali","family":"Zaman","sequence":"first","affiliation":[{"name":"College of Computing and Information Sciences, Karachi Institute of Economics and Technology, Karachi 75190, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2948-9527","authenticated-orcid":false,"given":"Salman A.","family":"Khan","sequence":"additional","affiliation":[{"name":"College of Computing and Information Sciences, Karachi Institute of Economics and Technology, Karachi 75190, Pakistan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3580-5960","authenticated-orcid":false,"given":"Nazeeruddin","family":"Mohammad","sequence":"additional","affiliation":[{"name":"Cybersecurity Center, Prince Mohammad bin Fahd University, Al-Khobar 31952, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1610-9612","authenticated-orcid":false,"given":"Abdelhamied A.","family":"Ateya","sequence":"additional","affiliation":[{"name":"EIAS: Data Science and Blockchain Laboratory, College of Computer and Information Sciences, Prince Sultan University, Riyadh 11586, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6907-2318","authenticated-orcid":false,"given":"Sadique","family":"Ahmad","sequence":"additional","affiliation":[{"name":"EIAS: Data Science and Blockchain Laboratory, College of Computer and Information Sciences, Prince Sultan University, Riyadh 11586, Saudi Arabia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9349-1985","authenticated-orcid":false,"given":"Mohammed A.","family":"ElAffendi","sequence":"additional","affiliation":[{"name":"EIAS: Data Science and Blockchain Laboratory, College of Computer and Information Sciences, Prince Sultan University, Riyadh 11586, Saudi Arabia"}]}],"member":"1968","published-online":{"date-parts":[[2025,3,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"103108","DOI":"10.1016\/j.jnca.2021.103108","article-title":"Automated DDOS attack detection in software defined networking","volume":"187","author":"Ahuja","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"165263","DOI":"10.1109\/ACCESS.2020.3022633","article-title":"InSDN: A novel SDN intrusion dataset","volume":"8","author":"Elsayed","year":"2020","journal-title":"IEEE Access"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"19616","DOI":"10.1109\/ACCESS.2019.2897095","article-title":"ARCA-IoT: An attack-resilient cloud-assisted IoT system","volume":"7","author":"Javaid","year":"2019","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"102370","DOI":"10.1016\/j.scs.2020.102370","article-title":"Secure and resilient demand side management engine using machine learning for IoT-enabled smart grid","volume":"62","author":"Babar","year":"2020","journal-title":"Sustain. Cities Soc."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"149","DOI":"10.1016\/j.future.2021.03.011","article-title":"DoS and DDoS attacks in Software Defined Networks: A survey of existing solutions and research challenges","volume":"122","author":"Eliyan","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_6","unstructured":"Nicholson, P. (2023, October 03). AWS hit by Largest Reported DDoS Attack of 2.3 Tbps. Available online: https:\/\/www.a10networks.com\/blog\/aws-hit-by-largest-reported-ddos-attack-of-2-3-tbps\/."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"2037","DOI":"10.3844\/jcssp.2014.2037.2046","article-title":"Review clustering mechanisms of distributed denial of service attacks","volume":"10","author":"Bhaya","year":"2014","journal-title":"J. Comput. Sci."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"5654","DOI":"10.1109\/JSEN.2023.3331311","article-title":"Intelligent secured traffic optimization model for urban sensing applications with Software Defined Network","volume":"24","author":"Rehman","year":"2024","journal-title":"IEEE Sens. J."},{"key":"ref_9","first-page":"771","article-title":"DDoS Detection in SDN using Machine Learning Techniques","volume":"71","author":"Nadeem","year":"2021","journal-title":"Comput. Mater. Contin."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"102460","DOI":"10.1016\/j.jnca.2019.102460","article-title":"Network anomaly detection based on logistic regression of nonlinear chaotic invariants","volume":"148","author":"Palmieri","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"e5402","DOI":"10.1002\/cpe.5402","article-title":"Machine learning algorithms to detect DDoS attacks in SDN","volume":"32","author":"Santos","year":"2019","journal-title":"Concurr. Comput. Pract. Exp."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Niyaz, Q., Sun, W., and Javaid, A. (2016). A deep learning based DDoS detection system in software-defined networking (SDN). arXiv.","DOI":"10.4108\/eai.28-12-2017.153515"},{"key":"ref_13","unstructured":"da Silva, A.S., Wickboldt, J.A., Granville, L.Z., and Schaeffer-Filho, A. (2016, January 25\u201329). ATLANTIC: A framework for anomaly traffic detection, classification, and mitigation in SDN. Proceedings of the NOMS 2016-2016 IEEE\/IFIP Network Operations and Management Symposium, Istanbul, Turkey."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bahashwan, A.A., Anbar, M., Manickam, S., Al-Amiedy, T.A., Aladaileh, M.A., and Hasbullah, I.H. (2023). A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking. Sensors, 23.","DOI":"10.3390\/s23094441"},{"key":"ref_15","unstructured":"Karan, B., Narayan, D., and Hiremath, P. (2018, January 20\u201322). Detection of DDoS attacks in software defined networks. Proceedings of the 2018 3rd International Conference on Computational Systems and Information Technology for Sustainable Solutions (CSITSS), Bengaluru, India."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Yang, L., and Zhao, H. (2018, January 16\u201318). DDoS attack identification and defense using SDN based on machine learning method. Proceedings of the 2018 15th International Symposium on Pervasive Systems, Algorithms and Networks (I-SPAN), Yichang, China.","DOI":"10.1109\/I-SPAN.2018.00036"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Sudar, K.M., Beulah, M., Deepalakshmi, P., Nagaraj, P., and Chinnasamy, P. (2021, January 27\u201329). Detection of Distributed Denial of Service Attacks in SDN using Machine learning techniques. Proceedings of the 2021 International Conference on Computer Communication and Informatics (ICCCI), Coimbatore, India.","DOI":"10.1109\/ICCCI50826.2021.9402517"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Kavitha, M., Suganthy, M., Biswas, A., Srinivsan, R., Kavitha, R., and Rathesh, A. (2022, January 13\u201315). Machine Learning Techniques for Detecting DDoS Attacks in SDN. Proceedings of the 2022 International Conference on Automation, Computing and Renewable Systems (ICACRS), Pudukkottai, India.","DOI":"10.1109\/ICACRS55517.2022.10029110"},{"key":"ref_19","first-page":"101176","article-title":"Detecting flooding DDoS attacks in software defined networks using supervised learning techniques","volume":"35","author":"Wang","year":"2022","journal-title":"Eng. Sci. Technol. Int. J."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2417","DOI":"10.1007\/s11277-021-09071-1","article-title":"A machine learning based detection and mitigation of the DDOS attack by using SDN controller framework","volume":"127","author":"Revathi","year":"2022","journal-title":"Wirel. Pers. Commun."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Gebremeskel, T.G., Gemeda, K.A., Krishna, T.G., and Ramulu, P.J. (2023). DDoS Attack Detection and Classification Using Hybrid Model for Multicontroller SDN. Wirel. Commun. Mob. Comput., 9965945.","DOI":"10.1155\/2023\/9965945"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"3828","DOI":"10.3390\/app13063828","article-title":"Hybrid Deep Learning Approach for Automatic DoS\/DDoS Attacks Detection in Software-Defined Networks","volume":"13","author":"Elubeyd","year":"2023","journal-title":"Appl. Sci."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Hassan, A.I., El Reheem, E.A., and Guirguis, S.K. (2024). An entropy and machine learning based approach for DDoS attacks detection in software defined networks. Sci. Rep., 14.","DOI":"10.1038\/s41598-024-67984-w"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Luong, T.K., Tran, T.D., and Le, G.T. (2020, January 26\u201327). DDoS attack detection and defense in SDN based on machine learning. Proceedings of the 2020 7th NAFOSTED Conference on Information and Computer Science (NICS), Ho Chi Minh City, Vietnam.","DOI":"10.1109\/NICS51282.2020.9335867"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"229","DOI":"10.1016\/j.procs.2021.10.078","article-title":"Analysis of machine learning for securing software-defined networking","volume":"194","author":"Alamri","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_26","unstructured":"Karki, D., and Dawadi, B.R. (2022, January 9\u201310). Machine Learning based DDoS Detection System in Software-Defined Networking. Proceedings of the 11th IOE Graduate Conference, Pokhara, Nepal."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"348","DOI":"10.18267\/j.aip.199","article-title":"Efficient Machine Learning Model for DDoS Detection System Based on Dimensionality Reduction","volume":"11","author":"Dheyab","year":"2022","journal-title":"Acta Inform. Pragensia"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"16444","DOI":"10.48084\/etasr.8362","article-title":"Detection of DDoS Attacks using Fine-Tuned Multi-Layer Perceptron Models","volume":"14","author":"Sanmorino","year":"2024","journal-title":"Eng. Technol. Appl. Sci. Res."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Mehmood, S., Amin, R., Mustafa, J., Hussain, M., Alsubaei, F.S., and Zakaria, M.D. (2025). Distributed Denial of Services (DDoS) attack detection in SDN using Optimizer-equipped CNN-MLP. PLoS ONE, 20.","DOI":"10.1371\/journal.pone.0312425"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Rahman, O., Quraishi, M.A.G., and Lung, C.H. (2019, January 8\u201313). DDoS attacks detection and mitigation in SDN using machine learning. Proceedings of the 2019 IEEE World Congress on Services (SERVICES), Milan, Italy.","DOI":"10.1109\/SERVICES.2019.00051"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Almadhor, A., Altalbe, A., Bouazzi, I., Hejaili, A.A., and Kryvinska, N. (2024). Strengthening network DDOS attack detection in heterogeneous IoT environment with federated XAI learning approach. Sci. Rep., 14.","DOI":"10.1038\/s41598-024-76016-6"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Kyaw, A.T., Oo, M.Z., and Khin, C.S. (2020, January 24\u201327). Machine-learning based DDOS attack classifier in software defined network. Proceedings of the 2020 17th International Conference on Electrical Engineering\/Electronics, Computer, Telecommunications and Information Technology (ECTI-CON), Phuket, Thailand.","DOI":"10.1109\/ECTI-CON49241.2020.9158230"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Firdaus, D., Munadi, R., and Purwanto, Y. (2020, January 10\u201311). Ddos attack detection in software defined network using ensemble k-means++ and random forest. Proceedings of the 2020 3rd International Seminar on Research of Information Technology and Intelligent Systems (ISRITI), Yogyakarta, Indonesia.","DOI":"10.1109\/ISRITI51436.2020.9315521"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Nugraha, B., and Murthy, R.N. (2020, January 10\u201312). Deep learning-based slow DDoS attack detection in SDN-based networks. Proceedings of the 2020 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Leganes, Spain.","DOI":"10.1109\/NFV-SDN50289.2020.9289894"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"254","DOI":"10.1016\/j.procs.2021.07.032","article-title":"Deep learning algorithms for detecting denial of service attacks in software-defined networks","volume":"191","author":"Farhat","year":"2021","journal-title":"Procedia Comput. Sci."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"2836","DOI":"10.11591\/eei.v11i5.4155","article-title":"DDoS attack detection in software defined networking controller using machine learning techniques","volume":"11","author":"Altamemi","year":"2022","journal-title":"Bull. Electr. Eng. Inform."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"1797","DOI":"10.11591\/eei.v12i3.5232","article-title":"Simulation of SDN in mininet and detection of DDoS attack using machine learning","volume":"12","author":"Karthika","year":"2023","journal-title":"Bull. Electr. Eng. Inform."},{"key":"ref_38","first-page":"1503","article-title":"Machine learning based detection of DDoS attacks in software defined network","volume":"32","author":"Kannan","year":"2023","journal-title":"Indones. J. Electr. Eng. Comput. Sci."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"e350","DOI":"10.1002\/spy2.350","article-title":"Detection of attacks on software defined networks using machine learning techniques and imbalanced data handling methods","volume":"7","author":"Hassan","year":"2024","journal-title":"Secur. Priv."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Haq, I., Khan, S.A., Mohammad, N., and Zaman, A. (2024, January 13\u201314). Optimizing Distributed Denial of Service (DDoS) Attack Detection Techniques on Software Defined Network (SDN) Using Feature Selection. Proceedings of the 2024 4th International Conference on Innovations in Computer Science (ICONICS), Karachi, Pakistan.","DOI":"10.1109\/ICONICS64289.2024.10824467"},{"key":"ref_41","first-page":"7","article-title":"A comparative study of categorical variable encoding techniques for neural network classifiers","volume":"175","author":"Potdar","year":"2017","journal-title":"Int. J. Comput. Appl."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40537-020-00305-w","article-title":"Survey on categorical data for neural networks","volume":"7","author":"Hancock","year":"2020","journal-title":"J. Big Data"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"4716","DOI":"10.1016\/j.jfranklin.2019.01.046","article-title":"Financial system modeling using deep neural networks (DNNs) for effective risk assessment and prediction","volume":"356","author":"Duan","year":"2019","journal-title":"J. Frankl. Inst."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"306","DOI":"10.1109\/TPAMI.1979.4766926","article-title":"A problem of dimensionality: A simple example","volume":"PAMI-1","author":"Trunk","year":"1979","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"ref_45","unstructured":"Wheeler, A. (2023, December 12). PCA Does Not Make Sense After One Hot Encoding. Available online: https:\/\/andrewpwheeler.com\/2021\/06\/22\/pca-does-not-make-sense-after-one-hot-encoding\/."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Ghosh, A.M., and Grolinger, K. (2019, January 5\u20138). Deep learning: Edge-cloud data analytics for iot. Proceedings of the 2019 IEEE Canadian Conference of Electrical and Computer Engineering (CCECE), Edmonton, AB, Canada.","DOI":"10.1109\/CCECE.2019.8861806"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1037\/1082-989X.12.3.336","article-title":"Nonlinear principal components analysis: Introduction and application","volume":"12","author":"Linting","year":"2007","journal-title":"Psychol. Methods"},{"key":"ref_48","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Hinton","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Xu, X., Xie, Z., Yang, Z., Li, D., and Xu, X. (2020). A t-SNE based classification approach to compositional microbiome data. Front. Genet., 11.","DOI":"10.3389\/fgene.2020.620143"},{"key":"ref_50","unstructured":"Vidyala, R. (2023, November 11). What, Why and How of t-SNE. Available online: https:\/\/medium.com\/data-science\/what-why-and-how-of-t-sne-1f78d13e224d#:~:text=t%2DSNE%20plots%20are%20highly,parameter%20for%20all%20the%20runs."},{"key":"ref_51","unstructured":"Shah, R., and Silwal, S. (2019). Using dimensionality reduction to optimize t-sne. arXiv."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Waagen, D., Hulsey, D., Godwin, J., Gray, D., Barton, J., and Farmer, B. (2021, January 12\u201316). t-SNE or not t-SNE, that is the question. Proceedings of the Automatic Target Recognition XXXI, SPIE, Online.","DOI":"10.1117\/12.2585535"},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Bahashwan, A.A., Anbar, M., Manickam, S., Issa, G., Aladaileh, M.A., Alabsi, B.A., and Rihan, S.D.A. (2024). HLD-DDoSDN: High and low-rates dataset-based DDoS attacks against SDN. PLoS ONE, 19.","DOI":"10.1371\/journal.pone.0297548"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Negera, W.G., Schwenker, F., Debelee, T.G., Melaku, H.M., and Feyisa, D.W. (2023). Lightweight model for botnet attack detection in software defined network-orchestrated IoT. Appl. Sci., 13.","DOI":"10.3390\/app13084699"},{"key":"ref_55","first-page":"1","article-title":"ENIXMA: ENsemble of EXplainable Methods for detecting network Attack","volume":"7","author":"Abtahi","year":"2024","journal-title":"Comput. Knowl. Eng."},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"1754","DOI":"10.1016\/j.neucom.2005.12.118","article-title":"Support vector machine interpretation","volume":"69","year":"2006","journal-title":"Neurocomputing"},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Br\u00fcggenj\u00fcrgen, S., Schaaf, N., Kerschke, P., and Huber, M.F. (2022, January 12\u201314). Mixture of Decision Trees for Interpretable Machine Learning. Proceedings of the 2022 21st IEEE International Conference on Machine Learning and Applications (ICMLA), Nassau, Bahamas.","DOI":"10.1109\/ICMLA55696.2022.00190"},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"115","DOI":"10.1007\/s42979-023-02383-y","article-title":"Towards Interpretable Machine-Learning-Based DDoS Detection","volume":"5","author":"Zhou","year":"2023","journal-title":"SN Comput. Sci."},{"key":"ref_59","unstructured":"Pandey, P. (2024, February 16). Interpretable or Accurate? Why Not Both?. Available online: https:\/\/towardsdatascience.com\/interpretable-or-accurate-why-not-both-4d9c73512192."},{"key":"ref_60","doi-asserted-by":"crossref","unstructured":"Dinov, I.D., and Dinov, I.D. (2018). Black box machine-learning methods: Neural networks and support vector machines. Data Science and Predictive Analytics: Biomedical and Health Applications using R, Springer.","DOI":"10.1007\/978-3-319-72347-1_11"},{"key":"ref_61","unstructured":"Siklar, M. (2024, February 16). Why Building Black-Box Models Can Be Dangerous. Available online: https:\/\/towardsdatascience.com\/why-building-black-box-models-can-be-dangerous-6f885b252818."},{"key":"ref_62","unstructured":"Molnar, C. (2025, January 25). Interpretable Machine Learning. Available online: https:\/\/christophm.github.io\/interpretable-ml-book\/."},{"key":"ref_63","unstructured":"(2024, October 27). Anonymous. Available online: https:\/\/www.geeksforgeeks.org\/iterative-dichotomiser-3-id3-algorithm-from-scratch\/."},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"1","DOI":"10.17485\/ijst\/2017\/v10i18\/111768","article-title":"Comparing the efficacy of decision tree and its variants using medical data","volume":"10","author":"Abdullah","year":"2017","journal-title":"Indian J. Sci. Technol."},{"key":"ref_65","unstructured":"MARS, vs. (2025, March 08). CART Regression Predictive Power. Available online: https:\/\/stats.stackexchange.com\/questions\/584597\/mars-vs-cart-regression-predictive-power?newreg=089b481e966f41f1a224a90d681f7c09."},{"key":"ref_66","doi-asserted-by":"crossref","unstructured":"Breiman, L. (2017). Classification and Regression Trees, Routledge.","DOI":"10.1201\/9781315139470"},{"key":"ref_67","doi-asserted-by":"crossref","unstructured":"T\u0131r\u0131nk, C., \u00d6nder, H., Francois, D., Marcon, D., \u015een, U., Shaikenova, K., Omarova, K., and Tyasi, T.L. (2023). Comparison of the data mining and machine learning algorithms for predicting the final body weight for Romane sheep breed. PLoS ONE, 18.","DOI":"10.1371\/journal.pone.0289348"},{"key":"ref_68","unstructured":"Rashid, R. (2025, March 08). Digital Analytics Decision Trees; CHAID vs CART. Available online: https:\/\/www.linkedin.com\/pulse\/digital-analytics-decision-trees-chaid-vs-cart-raymond-rashid\/."},{"key":"ref_69","unstructured":"Shmueli, G. (2025, March 08). Classification Trees: CART vs. CHAID. Available online: https:\/\/www.bzst.com\/2006\/10\/classification-trees-cart-vs-chaid.html."},{"key":"ref_70","doi-asserted-by":"crossref","first-page":"159","DOI":"10.1016\/S0020-0255(01)00145-1","article-title":"An experimental study about the search mechanism in the SLAVE learning algorithm: Hill-climbing methods versus genetic algorithms","volume":"136","year":"2001","journal-title":"Inf. Sci."},{"key":"ref_71","doi-asserted-by":"crossref","unstructured":"Giarelis, N., Kanakaris, N., and Karacapilidis, N. (2020, January 5\u20137). An innovative graph-based approach to advance feature selection from multiple textual documents. Proceedings of the IFIP international Conference on Artificial Intelligence Applications and Innovations, Halkidiki, Greece.","DOI":"10.1007\/978-3-030-49161-1_9"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Kumar, R.R., Tarang, G.R., Adipudi, K.K., Parvathaneni, V., and Steven, G. (2024). Performance Comparison of A* Search Algorithm and Hill-Climb Search Algorithm: A Case Study. Multifaceted approaches for Data Acquisition, Processing & Communication, CRC Press.","DOI":"10.1201\/9781003470939-24"},{"key":"ref_73","doi-asserted-by":"crossref","unstructured":"Khan, S.A., Iqbal, K., Mohammad, N., Akbar, R., Ali, S.S.A., and Siddiqui, A.A. (2022). A Novel Fuzzy-Logic-Based Multi-Criteria Metric for Performance Evaluation of Spam Email Detection Algorithms. Appl. Sci., 12.","DOI":"10.3390\/app12147043"},{"key":"ref_74","doi-asserted-by":"crossref","unstructured":"Haseeb-Ur-Rehman, R.M.A., Aman, A.H.M., Hasan, M.K., Ariffin, K.A.Z., Namoun, A., Tufail, A., and Kim, K.H. (2023). High-speed network ddos attack detection: A survey. Sensors, 23.","DOI":"10.3390\/s23156850"},{"key":"ref_75","doi-asserted-by":"crossref","unstructured":"Adedeji, K.B., Abu-Mahfouz, A.M., and Kurien, A.M. (2023). DDoS attack and detection methods in internet-enabled networks: Concept, research perspectives, and challenges. J. Sens. Actuator Netw., 12.","DOI":"10.3390\/jsan12040051"},{"key":"ref_76","unstructured":"Lapolli, \u00c2.C., Marques, J.A., and Gaspary, L.P. (2019, January 8\u201312). Offloading real-time DDoS attack detection to programmable data planes. Proceedings of the 2019 IFIP\/IEEE Symposium on Integrated Network and Service Management (IM), Arlington, VA, USA."},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"Fonseca-Delgado, R., and Gomez-Gil, P. (October, January 30). An assessment of ten-fold and Monte Carlo cross validations for time series forecasting. Proceedings of the 2013 10th International Conference on Electrical Engineering, Computing Science and Automatic Control (CCE), Mexico City, Mexico.","DOI":"10.1109\/ICEEE.2013.6676075"},{"key":"ref_78","unstructured":"Patro, R. (2023, November 11). Cross-Validation: K Fold vs. Monte Carlo. Available online: https:\/\/towardsdatascience.com\/cross-validation-k-fold-vs-monte-carlo-e54df2fc179b."},{"key":"ref_79","unstructured":"(2025, March 07). Ensemble Algorithms. Available online: https:\/\/www.mathworks.com\/help\/stats\/ensemble-algorithms.html."},{"key":"ref_80","unstructured":"(2023, December 13). How Do You Choose Between Simple Random and Stratified Sampling?. Available online: https:\/\/www.linkedin.com\/advice\/3\/how-do-you-choose-between-simple-random-stratified-sampling."},{"key":"ref_81","first-page":"e52","article-title":"Sampling methods in clinical research; an educational review","volume":"5","author":"Elfil","year":"2017","journal-title":"Emergency"},{"key":"ref_82","doi-asserted-by":"crossref","first-page":"49","DOI":"10.1145\/1882471.1882479","article-title":"Apples-to-apples in cross-validation studies: Pitfalls in classifier performance measurement","volume":"12","author":"Forman","year":"2010","journal-title":"ACM SIGKDD Explor. Newsl."},{"key":"ref_83","doi-asserted-by":"crossref","first-page":"145","DOI":"10.1142\/S0218001402001599","article-title":"Improving stability of decision trees","volume":"16","author":"Last","year":"2002","journal-title":"Int. J. Pattern Recognit. Artif. Intell."},{"key":"ref_84","doi-asserted-by":"crossref","unstructured":"Jacobucci, R. (2018). Decision Tree Stability and Its Effect on Interpretation. [Ph.D. Thesis, University of Notre Dame].","DOI":"10.31234\/osf.io\/f2utw"},{"key":"ref_85","doi-asserted-by":"crossref","unstructured":"Szeghalmy, S., and Fazekas, A. (2023). A comparative study of the use of stratified cross-validation and distribution-balanced stratified cross-validation in imbalanced learning. Sensors, 23.","DOI":"10.3390\/s23042333"},{"key":"ref_86","unstructured":"(2025, March 07). Impact of Dataset Size on Classification Performance. Available online: https:\/\/dspace.mit.edu\/bitstream\/handle\/1721.1\/131330\/applsci-11-00796.pdf?sequence=1."},{"key":"ref_87","unstructured":"Kusumura, Y. (2025, March 07). Maintain Model Robustness: Strategies to Combat Feature Drift in Machine Learning. Available online: https:\/\/dotdata.com\/blog\/maintain-model-robustness-strategies-to-combat-feature-drift-in-machine-learning\/."},{"key":"ref_88","doi-asserted-by":"crossref","first-page":"570","DOI":"10.1109\/TPDS.2025.3526238","article-title":"A Comparative Study of Sampling Methods with Cross-Validation in the FedHome Framework","volume":"36","author":"Ahmadi","year":"2025","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_89","unstructured":"(2025, March 07). Decision Trees. Available online: https:\/\/www.ibm.com\/think\/topics\/decision-trees."},{"key":"ref_90","unstructured":"(2025, March 07). 8 Key Advantages and Disadvantages of Decision Trees. Available online: https:\/\/insidelearningmachines.com\/advantages_and_disadvantages_of_decision_trees\/."},{"key":"ref_91","unstructured":"Williams, S. (2024, March 14). Global Surge in DDoS Attacks Causes Dire Financial Consequences. Available online: https:\/\/securitybrief.in\/story\/global-surge-in-ddos-attacks-causes-dire-financial-consequences."},{"key":"ref_92","unstructured":"Smith, G. (2024, March 14). DDoS Statistics: How Large a Threat Are DDoS Attacks?. Available online: https:\/\/www.stationx.net\/ddos-statistics\/."},{"key":"ref_93","doi-asserted-by":"crossref","first-page":"60","DOI":"10.1016\/j.intell.2017.07.004","article-title":"Spearman\u2019s law of diminishing returns. A meta-analysis","volume":"65","author":"Blum","year":"2017","journal-title":"Intelligence"},{"key":"ref_94","unstructured":"Hern\u00e1ndez-Orallo, J. (September, January 29). Is Spearman\u2019s law of diminishing returns (SLODR) meaningful for artificial agents?. Proceedings of the ECAI \u201422nd European Conference on Artificial Intelligence, The Hague, The Netherlands."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/4\/136\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T16:58:29Z","timestamp":1760029109000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/17\/4\/136"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,22]]},"references-count":94,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,4]]}},"alternative-id":["fi17040136"],"URL":"https:\/\/doi.org\/10.3390\/fi17040136","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,22]]}}}