Publication Details
Abstract
Distributed Denial-of-Service (DDoS) attacks constitute a persistent and significant threat to the availability of Internet services, cloud platforms, and Internet of Things infrastructures. Numerous machine-learning approaches conceptualize DDoS detection as a single classification task, in which a single model labels network traffic as either benign or malicious. While such systems may demonstrate strong performance on benchmark datasets, they remain susceptible to dataset bias, class imbalance, concept drift, suboptimally calibrated thresholds, and limited interpretability. This study introduces an agent-oriented, adaptive machine-learning framework that allocates traffic monitoring, feature extraction, supervised classification, anomaly detection, normal-behavior modeling, transparent rule analysis, evidence fusion, explanation, analyst feedback, and bias monitoring to specialized agents. The architecture amalgamates independent sources of evidence, thereby mitigating overreliance on any single model, dataset, or feature family. The proposed methodology employs CIC-DDoS2019 for primary offline training and incorporates cross-dataset testing, nested cross-validation, per-attack metrics, probability calibration, agent-ablation studies, and concept-drift monitoring. An event-driven Spring microservice implementation facilitates modular model replacement. Rather than asserting unverified experimental results, this paper provides a reproducible architecture and evaluation protocol, thereby laying the foundation for developing adaptive, interpretable, and bias-aware multi-agent DDoS detection systems.