RO-DAD: a resource-optimized DDoS attack detection framework using multi-stage feature selection in cloud computing

Cloud computing has transformed the modern IT infrastructure with its scalable, cost-effective, and on-demand services. Distributed Denial-of-Service (DDoS) attacks, however, are growing in number and sophistication, and they can adversely affect service availability, negatively impact performance, cause financial losses, and damage reputation, particularly in the cloud environment. Conventional detection methods are not always adequate to deal with the dynamic and massive nature of these attacks. To solve these challenges, this paper proposes a machine learning-based Resource-Optimized DDoS Attack Detection (RO-DAD) framework that enhances detection efficiency through a multi-stage feature selection pipeline. The proposed framework integrates Domain Knowledge (DK) filtering, Least Significant (LS) feature elimination, and Most Significant (MS) selection, where the MS stage is implemented using an embedded tree-based feature selection mechanism. This design enables systematic identification of the most informative features while reducing computational complexity and eliminating redundant attributes. The framework is assessed using the CICDDoS2019 dataset, and experimental findings show that the proposed approach achieves high detection performance, reaching up to 99% accuracy and F1-score, while significantly reducing the dimensionality of features and computational overhead. This confirms that effective feature optimization can maintain strong detection capability while enabling scalable and resource-efficient deployment in cloud environments.