A Stacking-Based Ensemble Model for Multiclass DDoS Detection Using Shallow and Deep Machine Learning Algorithms

doi:10.3390/app16020578

Return

A Stacking-Based Ensemble Model for Multiclass DDoS Detection Using Shallow and Deep Machine Learning Algorithms

2026-01-06

Eduardo Angulo

Leonardo Lizcano

José Márquez Díaz *

DOI：10.3390/app16020578

Original

Original request for help

Save

Abstract

En 中文

Distributed Denial-of-Service (DDoS) attacks remain a significant threat to the stability and reliability of modern networked systems. This study presents a hierarchical stacking ensemble that integrates multiple Shallow Machine Learning (S-ML) and Deep Machine Learning (D-ML) algorithms for multiclass DDoS detection. The proposed architecture consists of three layers: Layer Zero (base learners), Layer One (meta learners), and Layer Two (final voting). The base layer combines heterogeneous S-ML and D-ML models, tree-based, kernel-based, and neural architectures, while the meta layer employs regression and neural models trained on meta-features derived from base-layer predictions. The final decision is determined through a voting mechanism that aggregates the outputs of the meta models. Using the CIC-DDoS2019 dataset with a nine-class configuration, the model achieves an accuracy of 91.26% and macro F1-scores above 0.90 across most attack categories. Unlike many prior works that report near-perfect performance under binary or reduced-class settings, our evaluation addresses a more demanding multiclass scenario with large-scale traffic (similar to 8.85 M flows) and a broad feature space. The results demonstrate that the ensemble provides competitive multiclass detection performance and consistent behavior across heterogeneous attack types, supporting its applicability to high-volume network monitoring environments.

Keywords:

Distributed Denial of Service (DDoS)

multiclass classification

stacking ensemble

Shallow Machine Learning (S-ML)

Deep Machine Learning (D-ML)

hybrid models