AI-Driven Network Security: Detecting and Mitigating DDoS, Malware, and Backdoor Attacks with Isolation and Random Forest Algorithm
Elang Prasakti Ghani, Aghus Sofwan, Maman Somantri · 2025
Slot Backdoor attacks have become a growing cybersecurity threat in Indonesia, particularly exploiting vulnerabilities to inject unauthorized online gambling advertisements into university websites. These attacks alter website appearances, disrupt academic services, and negatively impact Webometrics rankings by reducing site accessibility and credibility. University XYZ experienced a severe decline in its Webometrics ranking, dropping from the top 5 to around 1000 due to repeated Slot Backdoor attacks. Following the deployment of the proposed machine learning-based mitigation system, the university successfully recovered and returned to the top 5 rankings. To address such threats, this study proposes an anomaly detection and prevention system at the network layer using machine learning. The system integrates Isolation Forest for anomaly detection and the Random Forest for attack classification. Isolation Forest identifies users with more than four failed login attempts within an hour, triggering a warning. If no further attempts follow in the next hour, the status returns to Normal; otherwise, access is Blocked to prevent brute-force and backdoor attacks. Random Forest then classifies network anomalies into Normal, Distributed Denial of Service (DDoS), and Malware/Backdoor threats. Evaluation metrics accuracy, precision, recall, F1-score, and confusion matrix confirm the system's effectiveness. The Random Forest classifier achieved 93 percent accuracy, with 88 percent precision for DDoS, 97 percent for Malware or Backdoor, and 100 percent for Normal traffic. Isolation Forest demonstrated 100 percent accuracy in DDoS and malware/backdoor mitigation with minimal false positives. By combining anomaly detection and threat classification, this approach significantly enhances cybersecurity resilience and offers a practical solution for protecting university networks like University XYZ.