Andi Maslan, Cik Feresa Mohd Foozy, Kamaruddin Malik Mohamad, Abdul Hamid, Dedy Fitriawan, Joni Hasugian
There are three main approaches to distributed denial of service (DDoS) detection: anomaly-based, pattern-based, and heuristic-based. The heuristic-based approach combines the strengths of both anomaly and pattern detection. However, existing DDoS detection systems still struggle with hypertext transfer protocol (HTTP) payload-level analysis due to high false positive rates and limited dataset granularity. To overcome these limitations, this study proposes a novel heuristic method based on a hybrid N-gram model that integrates two key components: chi-square distance (CSD)Payload+N-gram and cosine similarity (CS)Payload+N-gram. The CSDPayload measures the difference between a given payload and normal traffic using the CSD, while CSPayload evaluates their similarity using CS. These metrics form a comprehensive feature set evaluated on three benchmark datasets: CIC2019, MIB2016, and H2N-Payload. The methodology involves extracting HTTP traffic, converting it into hexadecimal payloads, and applying N-gram analysis (1-to 6-Gram). Frequency distributions are used to calculate CSD, CS, and Pearson’s chi-square test for payload classification. Feature selection based on weight correlation refines the input for machine learning classifiers support vector machine (SVM), k-nearest neighbors (KNN), and neural network (NN). Experimental results indicate high accuracy, particularly for the 4-Gram model: NN achieves 99.65%, KNN 95.14%, and SVM 99.73%. © 2025, Institute of Advanced Engineering and Science. All rights reserved.
Department of Informatic Engineering, Faculty of Engineering and Computer Science, Universitas Putera Batam, Batam, Indonesia; Faculty of Computer Science and Information Technology, Universiti Tun Hussein Onn Malaysia, Batu Pahat, Malaysia; Faculty of Technical and Vocational Education, Universiti Tun Hussein Onn Malaysia, Batu Pahat, Malaysia; Department of Remote Sensing and Geographic Information System, Vocational School, Universitas Negeri Padang, Padang, Indonesia; PT. Angkasa Pura Indonesia, Jakarta, Indonesia
