Matrix Pearson Correlation Feature Selection and ESPRT for DDoS Anomaly Detection
Basheer Husham Ali, Khaled Mansour Al-Rawe, Ayad Mahmood Kwad, Omar A. Abdulkareem, Nasri Sulaiman, Suphian Mohammed Tariq · Engineering Technology & Applied Science Research · 2025
Many approaches have been proposed to identify malicious anomalous traffic. Statistical models are techniques that rely on the analysis and investigation of network traffic to obtain a deeper understanding. Combining the Sequential Probability Ratio Test (SPRT) and Entropy (E) is an effective technique that can be used to detect anomalies. The most common anomalies targeting servers are Distributed Denial of Service (DDoS) attacks, which are designed to prevent legitimate users from accessing services provided by a targeted server or controller. The first goal of this study is to detect malicious traffic and identify two different types of DDoS anomalies, NTP and DNS anomalies, which are commonly exploited in reflection or amplification attacks due to their stateless UDP-based nature, by implementing an Entropy and Sequential Probability Ratio Test approach (ESPRT). The second is to select relevant features to improve the detection performance by implementing a Pearson Correlation Coefficient (PCC) approach. The CIC-DDoS2019 dataset was utilized to evaluate the proposed approach. ESPRT achieved high accuracy, ranging from 97.27 to 96.23% when the number of features ranged from 5 to 55, and had a low False Positive Rate (FPR), ranging from 0.01 to 0.03.