FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection

The rise of Distributed Denial of Service (DDoS) attacks on the internet has necessitated the development of robust and efficient detection mechanisms. DDoS attacks continue to present a significant threat, making it imperative to find efficient ways to detect and prevent these attacks promptly. Traditional machine learning approaches raise privacy concerns when handling sensitive data. In response, federated learning has emerged as a promising paradigm, allowing model training across decentralized devices without centralizing data. However, challenges such as the non-IID (Non-Independent and Identically Distributed) problem persist due to data distribution imbalances among devices. In this research, we propose personalized federated learning (PFL) as a solution for detecting DDoS attacks. PFL preserves data privacy by keeping sensitive information localized on individual devices during model training, thus addressing privacy concerns that are inherent in traditional approaches. In this paper, we propose federated learning with DBSCAN clustering (FedDB). By combining personalized training with model aggregation, our approach effectively mitigates the common challenge of non-IID data in federated learning setups. The integration of DBSCAN clustering further enhances our method by effectively handling data distribution imbalances and improving the overall detection accuracy. Results indicate that our proposed model improves performance, achieving relatively consistent accuracy across all clients, demonstrating that our method effectively overcomes the non-IID problem. Evaluation of our approach utilizes the CICDDOS2019 dataset. Through comprehensive experimentation, we demonstrate the efficacy of personalized federated learning in enhancing detection accuracy while safeguarding data privacy and mitigating non-IID concerns.