DETEKSI SERANGAN LRDDOS MENGGUNAKAN ENSEMBLE STACKING DENGAN KNN DAN XGBOOST

Low-Rate Distributed Denial of Service (LRDDoS) attacks are a form of DDoS attacks that are difficult to detect due to their traffic patterns resembling normal network behavior while continuously disrupting network performance. In a Software-Defined Internet of Things (SD-IoT) environment, such attacks can significantly affect service availability due to the centralized controller-based architecture. This study aims to analyze the performance of K-Nearest Neighbors (KNN), Extreme Gradient Boosting (XGBoost), and Ensemble Stacking methods in detecting LRDDoS attacks within an SD-IoT network. The dataset used in this study consists of 200,000 records, including 160,006 training data and 39,994 testing data, with 22 extracted network traffic features. The evaluation was conducted under three packet per second (pps) scenarios: 20pps, 50pps, and 70pps. Performance metrics used in this study include accuracy, precision, recall, F1-score, and predict loss. The results indicate that the KNN algorithm achieved relatively low and stable performance around 50% accuracy across all scenarios. XGBoost demonstrated the best performance at 50pps, achieving accuracy above 90% with balanced precision and recall values. The Ensemble Stacking method achieved 87.519% accuracy at 20pps but experienced performance degradation at 50pps and 70pps. Based on these findings, XGBoost is the most consistent algorithm for detecting LRDDoS attacks under the tested conditions, while the stacking method improves performance in low-traffic scenarios but lacks stability under higher traffic loads.